211
212
Privacy Sandbox – Open standards to enhance privacy on the web
Chrome is announcing a new initiative to explore how to evolve the web in a way that advances privacy, while supporting publishers, and free and open content.
213
214
Skype contact lists may have been exposed (2017)
UPDATE: February 14, 2019: Since writing this article in late 2017, Microsoft seems to have made a change that makes it a bit harder to reverse
215
Unencrypted patient medical information is being broadcast across Vancouver
The Open Privacy Research Society is a non-profit Canadian group based in Vancouver, British Columbia. We believe that moral systems enable consent. Our society exists to invent, create, build, test, publish, deploy, promote, and to encourage the development of such systems
216
Biometric YubiKey
Learn more about what's happening within the tech and cybersecurity industry and the developments in our business and security keys within our Yubico Blog.
217
Cname cloaking, a disguise of third-party trackers
An in-depth exploration of a new method used by tracking companies to disguise their third-party trackers as first-party trackers.
218
Drilling open a smart door lock in 4 seconds
The BBC asked us to have a look at some smart locks for a TV show recently. We didn’t have much prep time, but were genuinely shocked by just how easy this one was to compromise. Usually, we spend time looking at Bluetooth/RF, the mobile app, the API and then move on to hardware. This […]
219
Enabling developers and organizations to use differential privacy
Whether you're a city planner, a small business owner, or a software developer, gaining useful insights from data can help make services work better and answer important questions. But, without strong privacy protections, you risk losing the trust of your citizens, customers, and users.
220
Getting 2FA Right in 2019
Since March, Trail of Bits has been working with the Python Software Foundation to add two-factor authentication (2FA) to Warehouse, the codebase that powers PyPI. As of today, PyPI members can enable time-based OTP (TOTP) and WebAuthn (currently in beta). If you have an account on PyPI, go enable your preferred 2FA…
221
222
Tracking my phone's silent connections
FOSS and life. Kushal Das talks here.
223
NPM lockfiles can be a security blindspot for injecting malicious modules in PRs
In this post, we show you how easy it is to introduce back doors that are easily missed by project owners… leaving your code insecure.
224
Spying on HTTPS
When I launched Chrome on Thursday, I saw something unexpected: While most users probably would have no idea what to make of this, I happened to know what it means– Chrome is warning me that …
225
Is true hacking dead? What we lost
Realtime rendering and videogame programming mostly, but I love computer science and visuals in all their forms. This is a notepad of my ideas.
226
QuickBooks Cloud Hosting Firm iNSYNQ Hit in Ransomware Attack
Cloud hosting provider iNSYNQ says it is trying to recover from a ransomware attack that shut down its network and has left customers unable to access their accounting data for the past three days. Unfortunately for iNSYNQ, the company appears to be turning a deaf ear to the increasingly anxious cries from its users…
227
228
Using Let's Encrypt for Internal Servers (2018)
Let’s Encrypt is a revolutionary new certificate authority that provides free certificates in a completely automated process. These certificates are …
229
Google faces first investigation by its European lead authority over GDPR
Today, Ireland’s Data Protection Commission (DPC) has announced a major GDPR probe into “suspected infringement” by Google’s DoubleClick/Authorized Buyers advertising business. The probe was triggered by a formal complaint from Dr Johnny Ryan, Chief Policy Officer at Brave, the private web browser.
230
231
Notifying administrators about unhashed password storage
Google’s policy is to store your passwords with cryptographic hashes that mask those passwords to ensure their security. However, we recently notified a subset of our enterprise G Suite customers that some passwords were stored in our encrypted internal systems unhashed. This is a G Suite issue that affects business…
232
Abuses show Assange case was never about law
It is astonishing how often one still hears well-informed, otherwise reasonable people say about Julian Assange: “But he ran away from Swedish rape charges by hiding in Ecuador’s embassy in London.” That short sentence includes at least three factual errors. In fact, to repeat it, as so many people do, you would
233
234
Adblock Plus filter lists may execute arbitrary code in web pages
A new version of Adblock Plus was released on July 17, 2018. Version 3.2 introduced a new filter option for rewriting requests. A day later AdBlock followed suit and released support for the new filter option. uBlock, being owned by AdBlock, also implemented the feature. Under certain conditions the $rewrite filter…
235
Reasons not to reveal your DNA
With over two decades of global impact, Mozilla Foundation continues to lead the movement for a better technology future—powered by people, open by design, and fueled by imagination.
236
Google’s Nest fiasco harms user trust and invades their privacy
Last month, Google announced that its Nest Secure would be updated to work with Google Assistant software. The problem? Google never told users its product had a microphone to begin with. Simple oversight or invasion of privacy? We break it down.
237
OnionShare 2 adds anonymous dropboxes
After nearly a year of work from a growing community of developers, designers, and translators, I'm excited that OnionShare 2 is finally ready. You can download it from onionshare.org. OnionShare is an open source tool for securely and anonymously sending and receiving files using Tor onion services. It
238
If you care about user privacy, don’t use Facebook JavaScript SDK
With email aliases , you can be anonymous online and protect your inbox against spams and phishing.
239
I exploited TLS-SNI-01 issuing Let's Encrypt SSL-certs for any domain (2018)
The original research reports on security issues found in ACME TLS-SNI-01 which caused Let's Encypt to sunset it.
240
We value your privacy now, but maybe not later
Everybody knows these modal dialogs when visiting a website for the first time that ask you to accept cookies and consent to being tracked by third-party advertising networks. It actually became a habit for me to always click through these things and reject any kind of tracking or use of my personal information except…