We want everyone in the world to be able to enjoy the privacy and freedom online Tor provides, and that's why over the past couple years, we've been working hard to boost our UX and localization efforts, with the biggest gains first visible in Tor Browser 8.0. In Tor Browser 9.0, we continue to build upon those…
Civil Rights, Criminal Justice and Homeland Security
You can now use U2F-compatible security keys as a second factor for your 1Password account.
Recently, we expanded Heroku’s industry-shaping primitives, adding support for client-side browser apps, composed of HTML, CSS, and JavaScript. This built-in support for static web apps joins the existing Heroku Buildpacks: Ruby, Python, Go, Java, Clojure, Scala, Node.js, PHP, and .NET.
Update (May 23, 2019) : The affected 184 public network users have been notified via email.
Posted by Ian Beer, Google Project ZeroTL;DRA locking bug in the XNU virtual memory subsystem all...
On macOS, an app can register to handle URL schemes. Web browsers such as Safari, Chrome, and Firefox register to handle the schemes for web pages, http or https . Non-browser apps may register to handle other URL schemes; for example, an email client may register to handle the well known mailto scheme. When a URL is…
Google is planning changes in Chrome impacting ad blocker extensions and people are wondering whether those changes are motivated by self-interest or whether there are plausible, benign explanations.
The world's largest social network believes it has found a way to bypass Europe’s strict privacy laws.
We have released the Proton Mail iOS app as open source software as part of our commitment to transparency and supporting the developer community.
Telegram, the encrypted messaging app loved by terrorists, has been in the news lately. Terrorists have long used existing commercial and…
The Trail of Bits Assurance practice has received an influx of Go projects, following the success of our Kubernetes assessment this summer. As a result, we’ve been adapting for Go projects some of the security assessment techniques and tactics we’ve used with other compiled languages. We started by understanding the…
Back in July last year, Scott Helme and I shipped a little pet project that tracked the world's largest websites not implementing HTTPS by default [https://www.troyhunt.com/why-no-https-heres-the-worlds-largest-websites-not-redirecting-insecure-requests/] . We called it Why No HTTPS? [https://whynohttps.
The good news: TLS 1.3 is available, and the protocol, which powers HTTPS and many other encrypted communications, is better and more secure than its predecessors (including SSL). The bad news: Thanks to a financial industry group called BITS, there’s a look-alike protocol brewing called ETS (or...
The Department of Justice wants access to encrypted consumer devices but promises not to infiltrate business products or affect critical infrastructure. Yet that’s not possible, because there is no longer any difference between those categories of devices. Consumer devices are critical infrastructure. They affect…
Googlebot is based on Google Chrome version 41 (2015), and therefore it has no XSS Auditor, which later versions of Chrome use to protect the user from XSS attacks…
News and announcements from Namebase.
One year ago, we received a contract as a PDF file. It was digitally signed. We looked at the document - ignoring the "certificate is not tr...
telegra.ph/why-openbsd-is-marginally-less-horrible-12-052019220 points127 commentsSystems & Performance details
The following document is an attempt to consolidate down a number of threads spanning separate discussions from around the 'net I have been having on the subject of operating system development models and OpenBSD. I will break up this document into several sections each of which will handle separate pillars of my…
I discovered a Facebook bug which allows me to identify whether a visitor is logged in to a specific Facebook account. It can check hundreds of identities per second.
The Sophos Blog
A few years ago, before the GDPR era, I was involved in a stealth marketing startup. We went out of
Here's an interesting user-hostile pattern which could easily be avoided if programmers and business-people thought like regular humans. I have a Pioneer / Onkyo sound system. It's pretty nice and comes with a (not too crappy) Android app to let me remote control it. One day, the app updated itself. The changelog was…
Updated August 4, 2019: Added link to “A.C.L.U. Says F.B.I. Funded ‘Army’ To Terrorize Young War Dissidents” The unsealing of an application for a search warrant by the federal governme…
At its core, Security Assertion Markup Language (SAML) 2.0 is a means to exchange authorization and authentication information between services. Learn how saml works.
