We, along with the security industry and our partners, continue to investigate the extent of the Solorigate attack. While investigations are underway, we want to provide the defender community with intel to understand the scope and impact, remediation guidance, and detections and protections we have built as a result.
The COVID-19 pandemic is a global public health emergency that requires a coordinated and large-scale response by governments worldwide. However, States’ efforts to contain the virus must not be...
KeePassXC Password Manager
We’re excited to announce that starting next week Zoom’s E2EE offering will be available as a technical preview! Learn more
Starting today, July 8th, the Tor Project is running a one month campaign called #MoreOnionsPorfavor to raise awareness about onion sites, that is, websites available over onion services. We recently released a feature called Onion-Location in Tor Browser that announces to users if a website has an onion site…
On January 15, a Norweigian Consumer Council (NCC) investigative report exposed the ways that Grindr, OKCupid, and eight other apps are collecting and sharing extremely sensitive personal data. Grindr in particular was sharing users’ age and location tied to a device ID that would allow trackers to...
Check out our progress in end-to-end encryption calls in Jitsi. Give us your crypto knowledge feedback with the code and learn how to demo it here.
Android is one of Google’s most important tools for collecting data on users. This guide will help you improve your privacy on Android devices.
Protecting the security and privacy of individuals is a central tenet of Mozilla’s mission. While we continue to make extensive use of both sandboxing and Rust in Firefox to address ...
Chrome engineers are experimenting with Rust. For the foreseeable future, C++ is the reigning monarch in our codebase, and any use of Rust will need to fit in with C++ — not the other way around. This seems to present some C++/ Rust interoperability challenges which nobody else has faced.
Evergreen privacy guides, threat modeling, encryption, practical tutorials.
I’m thrilled to announce a new open-source project for the Swift ecosystem, Swift Crypto. Swift Crypto is a new Swift package that brings the fantastic APIs of Apple CryptoKit to the wider Swift community. This will allow Swift developers, regardless of the platform on which they deploy their applications, to access…
We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.
Trellix XDR, get the latest cybersecurity trends, best practices, security vulnerabilities, and more from industry leaders.
Today, we are sharing details about Pysa, an open source static analysis tool we’ve built to detect and prevent security and privacy issues in Python code. Last year, we shared how we built Zoncola…
Today, Firefox began the rollout of encrypted DNS over HTTPS (DoH) by default for US-based users. The rollout will continue over the next few weeks to conf
At the start of November, someone decided that they would try to attack and destroy our company. Here’s how we stopped them.
Browsers are changing the default value of the SameSite attribute for cookies from None to Lax. This will greatly improve security for users. However, some web sites may depend (even ...
Civil society across Europe launches the “Reclaim Your Face” campaign, demanding that local and national authorities listen to their communities about the serious risks of using facial recognition and other biometric technologies in public spaces. The newly formed coalition calls to ban biometric mass surveillance, in…
Tor Browser 10.0 for Desktop is now available from the Tor Browser download page and also from our distribution directory.
Our Bridge app is now open source for macOS, Windows, and Linux. Find links to the code and an independent security audit report.
At Signal, our goal is to build a reliable, secure, and private communication experience that is broadly accessible and simple to use. From the beginning, we’ve designed Signal so that your information is in your hands rather than ours.
How malicious environment variables can trick scripting language interpreters into executing arbitrary commands, a Linux exploitation technique.
According to a solicitation to potential contractors published last week, the Transportation Security Administration (TSA) wants to outsource its current questioning of airline passengers without ID , and its decisions about which travelers without ID to allow to travel and which to prevent from flying , to a…
We have identified three independently exploitable vulnerabilities in Go's encoding/xml. Read more about their impact to Mattermost users.
Matrix, the open protocol for secure decentralised communications
Arnis Parsovs, Software Technology and Applications Competence Center and University of Tartu
With recent chipsets, Intel offers a mechanism called Active Management Technology (Intel AMT, part of the “vPro”* featureset, specifically the Intel Management Engine) which, Intel says,“allows IT or managed service providers to better discover, repair, and protect their networked computing assets”. This means…
Our team, DeisLabs , recently released a new piece of software called Krustlet , which is a tool for running WebAssembly modules on the popular, open-source container management tool called Kubernetes . Kubernetes is used quite extensively to run cloud software across many vendors and companies and is primarily…
