A federal court will be scrutinizing one of the National Security Agency’s worst spying programs on Monday. The case has the potential to restore crucial privacy protections for the millions of Americans who use the internet to communicate with family, friends, and others overseas.
The Sophos Blog
RISC-V International Staff RISC-V International’s staff bring together expertise from multiple disciplines to advance our mission of promoting the RISC-V instruction set architecture (ISA). On the RISC-V blog, we highlight...
Find out what your organisation must do to comply with the GDPR and learn how you can help individuals to exercise their data protection rights.
The Sophos Blog
DNSSEC is a system of digital signatures that prevent DNS spoofing. Using DNSSEC, it does not matter where your DNS answers came from, since the DNS resolver or application can verify the DNSSEC signatures to ensure the DNS data is not tampered with..DNS is hierarchical, which means that the parent zone vouches for…
npm Blog (Archive); updates from the npm team are now published on the GitHub Blog and the GitHub Changelog
With 2019 a day away, let’s reflect on the past to see how we can improve. Yes, let’s take a long look back 30 years and reflect on the original fuzzing paper, An Empirical Study of the Reliability of UNIX Utilities, and its 1995 follow-up, Fuzz Revisited, by Barton P. Miller. In this blog post, […]
From shopping to social media, the average online user will have hundreds of accounts requiring passwords. At the same time, the number of user data breaches occurring each year continues ...
San Francisco – The Electronic Frontier Foundation (EFF) and mobile security company Lookout have uncovered a new malware espionage campaign infecting thousands of people in more than 20 countries. Hundreds of gigabytes of data has been stolen, primarily through mobile devices compromised by fake...
Developers already use HTTPS to communicate with Firebase Cloud Messaging (FCM). The channel between FCM server endpoint and the device is encrypted with SSL over TCP. However, messages are not encrypted end-to-end (E2E) between the developer server and the user device unless developers take special measures. To this…
“Never answer an anonymous letter” —Yogi Berra Did you ever wonder why doctor offices ask for your social security number? They don’t want to keep your SSN, but it’s the primary “key” that identifies you to an insurance company. In computer science/math terms, they need to call a function. Let’s call it: int…
Our smart devices, such as mobile phones and tablets, contain a wealth of important personal information that needs to be kept safe. Google is constantly trying to find new and better ways protect that valuable information on Android devices. From partnering with external researchers to find and fix vulnerabilities…
By using Cloud Spanner as a storage backend for HashiCorp Vault, you get all the benefits of a traditional relational database, the scalability of a globally-distributed data store, and the availability of a fully managed service.
Posted by Ivan Fratric, Google Project ZeroIntroductionVulnerabilities in the VBScript scripting ...
by Annie Edmundson, Paul Schmitt, Nick Feamster The recent news that Cloudflare is deploying their own DNS recursive resolver has once again raised hopes that users will enjoy improved privacy, since they can send DNS traffic encrypted to Cloudflare, rather than to their ISP. In this post, we explain why this approach…
Posted by David Benjamin, Chrome networking *Updated on October 17, 2018 with details about changes in other browsers TLS (Transport Lay...
During Congressional hearings about Facebook’s data practices in the wake of the Cambridge Analytica fiasco, Mark Zuckerberg drew an important distinction between what we expect from our Internet service providers (ISPs, such as Comcast or Verizon) as opposed to platforms like Facebook that operate...
Posted by Natalie Silvanovich, Project ZeroOver the past five years, video conferencing support i...
Two years ago this week Cloudflare introduced Opportunistic Encryption, a feature that provided additional security and performance benefits to websites that had not yet moved to HTTPS.
Exploring container security: Let Google do the patching with new managed base images
This blog post describes techniques that utilize ACLs, maps, and stick tables.
Two years ago, when we began taking on blockchain security engagements, there were no tools engineered for the work. No static analyzers, fuzzers, or reverse engineering tools for Ethereum. So, we invested significant time and expertise to create what we needed, adapt what we already had, and refine the work…
Like many others, we have been following the latest developments in Australia related to the “Assistance and Access” bill with a growing sense of frustration. The widespread adoption of strong cryptography and end-to-end encryption has given people around the world the ability to protect their pe...
The EU has proposed a new law aimed at terrorist content online. Here we outline how the proposal poses a risk for rights and the internet ecosystem.
