Trail of Bits recently completed a security assessment of Kubernetes, including its interaction with Docker. Felix Wilhelm’s recent tweet of a Proof of Concept (PoC) “container escape” sparked our interest, since we performed similar research and were curious how this PoC could impact Kubernetes. Quick and dirty way…
Gmail's end-to-end encryption project seemed dead in 2017. Now it's back, but only for key account customers.
In the past few years, a technique called browser fingerprinting has received a lot of attention because of the risks it can pose to privacy. What is it? How is it used? What is Tor Browser doing against it? In this blog post, I’m here to answer these questions.
Cryptography code could be understandable if only we commented it. This Poly1305 implementation is an attempt to prove it. It should be readable with just an idea of what MACs are for, a beginner level of Go, and high school math.
By Connor Gilbert, product manager at StackRox Last month, the Kubernetes ecosystem was shaken by the discovery of the first major security flaw in Kubernetes, the world’s most popular container…
Announcing a cloud storage solution where you are in control of all your data with client-side encryption and no data or vendor lock-in.
Free Software is a great thing, because it allows users to check that apps are doing what they pretend to do. But almost nobody compiles apps themselves.
Announcing and explaining our intention to support DNS over HTTPS in future versions of Windows
Phones are so full of ads that you don’t even notice them anymore. Suggestions and notifications you didn’t ask for, tracking mechanisms you don’t even know are there, services over which you have no control. It’s absurd how much smartphones, a large extension of our private and social lives, are controlled and…
A federal district court in San Francisco has ruled strongly in favor of our Freedom of Information Act lawsuit seeking records of how and when the FBI lifts gag orders issued with National Security Letters (NSLs). These records will provide a window into the FBI’s use of a highly secretive...
Part 1 - The Pitch
Google Forcing Nest Cameras Visual Indicator Light To Be On
I interned with Microsoft as a Software Engineering Intern in the MSRC UK team in Cheltenham this past summer. I worked in the Safe Systems Programming Language (SSPL) group, which explores safe programming languages as a proactive measure against memory-safety related vulnerabilities.
I’m not a huge fan of stories about stories, or those that explore the ins and outs of reporting a breach. But occasionally I feel obligated to publish such accounts when companies respond to a breach report in such a way that it’s crystal clear they wouldn’t know what to do with a data breach if it bit them in the…
A walkthrough of a couple of Google Cloud Platform (GCP) features with security recommendations and advice on how to configure your GCP environments.
Allow me to be controversial for a moment: arbitrary password restrictions on banks such as short max lengths and disallowed characters don't matter. Also, allow me to argue with myself for a moment: banks shouldn't have these restrictions in place anyway. I want to put forward cases for
Matrix, the open protocol for secure decentralised communications
TL;DR New update for Kamerka allows to map Industrial Control Systems of whole country. As in previous version, interactive map is created…
When it comes to composition and length, your password (mostly) doesn’t matter.
DKIM is a way to secure your email, increasing deliverability and avoiding fraud. A 20i Senior Systems Administrator explains DKIM in depth.
Do you ever hear those stories from your parents along the lines of "when I was young..." and then there's a tale of how risky life was back then compared to today. You know, stuff like having to walk themselves to school without adult supervision, crazy stuff like that
Evergreen privacy guides, threat modeling, encryption, practical tutorials.
