241
Tales of SugarCRM Security Horrors
This is the personal website of Egidio Romano, a very curious guy from Sicily, Italy. He's a computer security enthusiast, particularly addicted to webapp security.
242
Internet Censorship Bill Could Spell Disaster for Speech and Innovation
There’s a new bill in Congress that would threaten your right to free expression online. If that weren’t enough, it could also put small Internet businesses in danger of catastrophic litigation. Don’t let its name fool you: the Stop Enabling Sex Traffickers Act (SESTA, S. 1693) wouldn’t help punish...
243
Yubikey with USB-C
Learn more about what's happening within the tech and cybersecurity industry and the developments in our business and security keys within our Yubico Blog.
244
From Markdown to remote code execution in Atom
Recently I took a look at Atom, a text editor by GitHub. With a little bit of work, I was able to chain multiple vulnerabilities in Atom into an actual Remote Code Execution. The vulnerabiliti…
245
Fighting Neo-Nazis and the Future of Free Expression
In the wake of Charlottesville, both GoDaddy and Google have refused to manage the domain registration for the Daily Stormer, a neo-Nazi website that, in the words of the Southern Poverty Law Center, is “dedicated to spreading anti-Semitism, neo-Nazism, and white nationalism.” Subsequently...
246
247
ACME Support in Apache HTTP Server Project
We’re excited that support for getting and managing TLS certificates via the ACME protocol is coming to the Apache HTTP Server Project (httpd). ACME is the protocol used by Let’s Encrypt, and hopefully other Certificate Authorities in the future. We anticipate this feature will significantly aid the adoption of HTTPS…
248
We will no longer use the phrase “zero knowledge” to describe our software
Space Cybersecurity has become a prominent topic in the news, particularly when it comes to protecting space-related assets and technologies.
249
Building Safe AI: A Tutorial on Homomorphically Encrypted Deep Learning
A machine learning craftsmanship blog.
250
251
How to confirm a Google user’s specific email address
I reported an issue to Google, which allows an attacker to confirm whether someone is logged in to any one of a list of specific Google accounts.
252
Virtual Keyboard Developer Leaked 31M Client Records
Find out more about the biggest 2017 data breaches in this MacKeeper report!
253
Securing a laptop for travel to China
We're all impatiently waiting on quantum-proof asymmetrical crypto algorithms to become commonplace. Until that happens, we must all live with the assumption that all currently used asymmetric crypto will be trivially decryptable once quantum computers become powerful enough. This is probably the reason why government…
254
I can no longer recommend MailChimp
MailChimp doesn’t seem to think double opt-in is a good idea for mailing lists anymore.
255
HTTP security headers
Appcanary makes sure you never run vulnerable software on your servers. Like our blog? Subscribe to our newsletter or podcast . Browse the archive , or follow us on twitter , github or rss .
256
Hardening the Kernel in Android Oreo
News and insights on the Android platform, developer tools, and events.
257
Australian PM Calls for End-To-End Encryption Ban
"The laws of mathematics are very commendable but the only law that applies in Australia is the law of Australia", said Australian Prime Minister Malcolm Turnbull today. He has been rightly mocked for this nonsense claim, that foreshadows moves to require online messaging providers to provide law...
258
Formal Verification: The Gap Between Perfect Code and Reality
Thanks to Vlad Brown and Drawings Team for Russian and Uzbek translations. In Fall 2017, I took MIT’s 6.826, Principles of Computer Systems, taught by Turing Award-winner Butler Lampson, Nickolai Z
259
260
261
Behind the Masq: Yet More DNS and DHCP Vulnerabilities
Posted by Fermin J. Serna, Staff Software Engineer, Matt Linton, Senior Security Engineer and Kevin Stadmeyer, Technical Program Manager O...
262
263
Comcast uses MITM JavaScript injection to serve account related information
For years, Comcast and other large telecommunication companies around the world have injected javascript into your web browsing experience to serve
264
The CIA's “Development Tradecraft Do's and Dont's”
Useful best practices for malware writers, courtesy of the CIA. Seems like a lot of good advice. General: DO obfuscate or encrypt all strings and configuration data that directly relate to tool functionality. Consideration should be made to also only de-obfuscating strings in-memory at the moment the data is needed…
265
Security Keys
Security Keys are (generally) USB-connected hardware fobs that are capable of key generation and oracle signing. Websites can “enroll” a security key by asking it to generate a public key bound to an “appId” (which is limited by the browser based on the site's origin). Later, when a user wants to log in, the website…
266
267
Tor's Fall Harvest: The Next Generation of Onion Services
We are hyped to present the next generation of onion services! We've been working on this project non-stop for the past 4 years and we officially launched it two weeks ago by publishing our first alpha releases. All in all, the new system is a well needed improvement that fixes many shortcomings of the old design, and…
268
269
270