91
Famous cryptographers’ tombstone cryptogram decrypted
The Sophos Blog
92
Let's Encrypt: Looking Forward to 2019
Let’s Encrypt had a great year in 2018. We’re now serving more than 150 million websites while maintaining a stellar security and compliance track record. Most importantly though, the Web went from 67% encrypted page loads to 77% in 2018, according to statistics from Mozilla. This is an incredible rate of change! We’d…
93
Panerabread.com leaks millions of customer records
Panerabread.com , the Web site for the American chain of bakery-cafe fast casual restaurants by the same name, leaked millions of customer records — including names, email and physical addresses, birthdays and the last four digits of the customer’s credit card number — for at least eight months before it was yanked…
94
A security vulnerability in Git that can lead to arbitrary code execution
The Git community has disclosed an industry-wide security vulnerability in Git that can lead to arbitrary code execution when a user operates in a
95
96
Extracting the private key from a TREZOR with an oscilloscope (2015)
Homepage of Jochen Hoenicke
97
What Spectre and Meltdown Mean for WebKit
Security researchers have recently uncovered security issues known as Meltdown and Spectre.
98
99
Protecting Security Researchers
Dash knows your context, your team, and your work, so your team can stay organized, easily find and share knowledge, and keep projects secure, all from one place.
100
Everything you should know about certificates and PKI but are too afraid to ask
Certificates and public key infrastructure (PKI) are hard. No shit, right? I know a lot of smart people who''ve avoided this particular rabbit hole. Eventually, I was forced to learn this stuff because of what it enables: PKI lets you define a system cryptographically. It''s universal and vendor-neutral yet poorly…
101
LoJax: First UEFI rootkit found in the wild, courtesy of the Sednit group
ESET researchers have discovered the first in-the-wild UEFI rootkit. Dubbed LoJax, the research team has shown that the Sednit operators used different components of the LoJax malware to target a few government organizations in the Balkans as well as in Central and Eastern Europe.
102
AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely
Today we’re launching AWS Secrets Manager which makes it easy to store and retrieve your secrets via API or the AWS Command Line Interface (AWS CLI) and rotate your credentials with built-in or custom AWS Lambda functions. Managing application secrets like database credentials, passwords, or API Keys is easy when…
103
LinkedIn is ignoring user settings
Logged out users are prevented from reaching LinkedIn profiles set to complete public visibility
104
GDPR – A Practical Guide for Developers (2017)
You’ve probably heard about GDPR. The new European data protection regulation that applies practically to everyone. Especially if you are working in a big company, it’s most likely that there’sContinue reading
105
Why Is Location Data No Longer Private?
The past month has seen one blockbuster revelation after another about how our mobile phone and broadband providers have been leaking highly sensitive customer information, including real-time location data and customer account details. In the wake of these consumer privacy debacles, many are left wondering who’s…
106
Moving Fast and Securing Things
For development teams, process can often be antithetical to speed. Ease of deployment and security tend to have an inverse relationship, with some resentment for the security team occasionally mixed in. You may have seen the following tweet: https://twitter.com/petecheslock/status/595617204273618944?lang=en We believe…
107
108
The Secret API of Banks
Interacting with bank data often requires trusting 3rd parties with your credentials. What if there were a more secure way to explore transactions?
109
GoogleMeetRoulette: Joining random meetings
Finding Google Meet phone numbers and bruteforcing PINs to join random meetings
110
111
Mark Felt-Tipped: Uncovering top-secret information by counting pixels
KEMUDITOTO merupakan official Situs Togel 4D & Toto TOGEL ONLINE Terjamin Maxwin dengan akses cepat, pilihan permainan lengkap, layanan responsif, dan nyaman digunakan setiap hari.
112
113
114
New DHS policy on demands for passwords to travelers’ electronic devices
US Customs and Border Protection, a component of the Department of Homeland Security, today posted a revised policy on Border Searches of Electronic Devices and a Privacy Impact Assessment of some of the changes made by the new policy.
115
It is not possible to detect and block Chrome headless
An updated example of techniques to avoid detection.
116
Disable Google Chrome Sign In and Sync
As you might have heard , Chrome 69 automatically logs you into the browser when you log into any Google property . As much as I might like Chrome (and Google), I was quite displeased by this particular change: I assume it was in the release notes (that probably a vanishingly small number of Chrome users read), but…
117
AWS now supports U2F/Yubikeys
April 25, 2023: We’ve updated this blog post to include more security learning resources. Update on October 8, 2018: After we launched support for security devices manufactured by Yubico on September 25, 2018, we received feedback from customers to support other U2F security key providers, as well. Starting October 8…
118
119
First-party isolation in Firefox: what breaks if you enable it?
Firefox’s FPI system keeps websites from tracking your movements across websites. This gives excellent privacy protections but at a cost of web compatibility.
120
Terraforming 1Password
We are excited to finally have all our development, test, staging, and production environments managed with Terraform.