271
AdGuard DNS: A Privacy-Oriented DNS Server
AdGuard DNS: a privacy-oriented DNS service that blocks trackers and ads anywhere, from your PC and mobile devices to smart TV and IoT.
272
Spectre/Meltdown Pits Transparency Against Liability
There is a lot of righteous anger directed toward Intel over CPU bugs that were revealed by Spectre/Meltdown. I agree that things could have been handled better, particularly with regards to transparency and the sharing of information among the relevant user communities that could have worked together to deploy…
273
The Justice Dept's secret rules for targeting journalists with FISA court orders
The Justice Dept has kept these FISA court rules for targeting journalists secret for years.
274
275
Maximizing password manager attack surface
Kaspersky Password Manager uses a unique approach to maximize the attack surface. A quick introduction.
276
Secure Boot and the 2018 MacBook Pro
the vent for my mind
277
What We Learned About the Hemisphere Program After Suing the DEA
As the year draws to a close, so has EFF’s long-running Freedom of Information Act lawsuit against the Drug Enforcement Agency about the mass phone surveillance program infamously known as “Hemisphere.” We won our case and freed up tons of records. (So did the Electronic Privacy Information Center...
278
279
280
Vulnerability of Speculative Processors to Cache Timing Side-Channel Mechanism
Arm is committed to upholding the highest standards of security across its products and the wider Arm ecosystem. To support its partners and the broader community, Arm publishes three types of security-related documentation, Security Bulletins, Security Updates, and Security Articles.
281
Three Charged in Fatal Kansas ‘Swatting’ Attack
Federal prosecutors have charged three men with carrying out a deadly hoax known as “swatting,” in which perpetrators call or message a target’s local 911 operators claiming a fake hostage situation or a bomb threat in progress at the target’s address — with the expectation that local police may respond to the scene…
282
283
An Update on AMD Processor Security
The AMD Product Security Incident Response Team (PSIRT) is the focal point for reporting potential product security issues to AMD. AMD PSIRT works with both the AMD internal product security team and the external product security ecosystem, including security researchers, industry peers, government organizations…
284
Protecting Against HSTS Abuse
HTTP Strict Transport Security (HSTS) is a security standard that provides a mechanism for web sites to declare themselves accessible only via secure connections, and to tell web browsers where to go to get that secure version.
285
NetBSD Network Security Audit
Over the last five months, hundreds of patches were committed to the source tree as a result of this work. Dozens of bugs were fixed, among which a good number of actual, remotely-triggerable vulnerabilities.
286
Finding and exploiting hidden features of Animal Crossing's NES emulator
While looking for ways to activate the developer menus left over in Animal Crossing, including the NES emulator game selection menu, I found an interesting feature that exists in the original game that was always active, but never used by Nintendo. In addition to the NES/Famicom games that can be obtained in-game, it…
287
Pwned Passwords in Practice: Real World Examples of Blocking the Worst Passwords
Back in August, I pushed out a service as part of Have I Been Pwned [https://haveibeenpwned.com/] (HIBP) to help organisations block bad passwords from their online things. I called it "Pwned Passwords" and released 320M of them from real-world data breaches [https://www.troyhunt.com/introducing-306-
288
KeePassXC 2.3.0 released
KeePassXC Password Manager
289
Shedding Too Much Light on a Microcontroller's Firmware Protection (2017)
Proceedings of the 11th USENIX Workshop on Offensive Technologies (WOOT '17) - Vancouver, BC, Canada CVE number 2017-18347
290
Microsoft disables Windows Update when Meltdown/Spectre registry key isn't set
Last week, Microsoft issued January’s cumulative security fixes for January 2018. Although the media focus has been around “Meltdown” and…
291
The 600+ Companies PayPal Shares Your Data With
One of the effects of GDPR—the new EU General Data Protection Regulation—is that we’re all going to be learning a lot more about who collects our data and what they do with it. Consider PayPal, that just released a list of over 600 companies they share customer data with. Here’s a good visualization of that data. Is…
292
How a Political Engineering Firm Exposed Their Code Base
Political data firm AggregateIQ exposed IT assets that raise questions for society about how technology is being used in recent US political history.
293
294
Finding Pwned Passwords with 1Password
1Password integrates with Pwned Passwords, a feature of Have I Been Pwned that allows you to check if your passwords have been leaked on the Internet.
295
Extended Validation Certificates Are Dead
That's it - I'm calling it - extended validation certificates are dead. Sure, you can still buy them (and there are companies out there that would just love to sell them to you!), but their usefulness has now descended from "barely there" to "as good as non-existent". This change
296
How Ethereum can be stolen through DNS rebinding
The Post has been moved here
297
OkCupid's “Removed” Visitor API
A blog about programming, the tech industry, and tech education.
298
299
Qubes Air: Generalizing the Qubes Architecture
The Qubes OS project has been around for nearly 8 years now, since its original announcement back in April 2010 (and the actual origin date can be traced back to November 11th, 2009, when an initial email introducing this project was sent within ITL internally). Over these years Qubes h...
300