The situation in Minneapolis at the moment (and many other places in the US) following George Floyd's death [https://en.wikipedia.org/wiki/Death_of_George_Floyd] is, I think it's fair to say, extremely volatile. I wouldn't even know where to begin commentary on that, but
Here’s my take on JWT* and why I think it’s amazing, after having migrated hundreds of applications in JP Morgan from a legacy authentication solution. *JWT = JSON Web Token 1) Pro: JWT…
Let’s encrypt: an automated certificate authority to encrypt the entire web, Aas et al., CCS’19 This paper tells the story of Let’s Encrypt, from it’s early beginnings in 20…
As of today, Windows trusts 322 root certificates issued by 122 different organizations from 47 countries. This number is quite high, and has been steadily growing over the last few years. And it turns out many of those certificates are not needed at all by the vast majority of Windows users, can be distrusted with no…
Before adding a dependency to one of my software projects, I do some basic vetting of the dependency. Among the things I check are:
Personal Blog of Christian Haschek
Earlier this year, when I went from having only Facebook-login on Wishy.gift to allow registrations with email address and password, one of my concerns was how to implement this is a way that protects the data and privacy of my users. I don’t have any ads or analytics on the site, the users can select whatever display…
This article aims to subdue the rumors that Safari 14 will block Google Analytics (and other similar libraries) by default. It will not.
Analysis of various approaches to monetizing the Twitter hack
Sounds great! But what does it mean? seL4 seL4 (pronounced ess-e-ell-four) is arguably the world’s most secure operating system (OS) kernel. The OS kernel is the lowest level of software runn…
It has been over a year since I cancelled my Cloudflare account. They keep emailing me and haven't taken me off their marketing lists despite repeated requests. Their CTO told me he would investigate, but nothing changed. Their Data Protection Office hasn't respond to my requests. Cloudflare do not appear to respect…
Patrick Wardle highlighted a tweet by Maxwell (" Some Apple apps bypass some network extensions and VPN Apps. Maps for example can directly access the internet bypassing any NEFilterDataProvider or NEAppProxyProviders you have running "), sparking an extensive HN discussion on Apple's ham-fisted tactics (not unlike…
When I was 5, I saw the Karate Kid. I saw that bad guys could beat me up, and I had no recourse if I didn't know karate. I promptly signed up for martial arts classes.
Persuasion is as old as our species. Both democracy and the market economy depend on it. Politicians persuade citizens to vote for them, or to support different policy positions. Businesses persuade consumers to buy their products or services. We all persuade our friends to accept our choice of restaurant, movie, and…
Starting with the release of the Pixel 3, all of Google's Pixel Android smartphones come with the Titan M security chip on board. When I realized the Pixel 3a XL I purchased also had it, I decided to try to take advantage of it in an app I work on. It turned out that using the Titan M chip through the Android Keystore…
A little over a year ago, my employer threw away our VPNs in production and production-like server environments and moved towards a set of new, cutting-edge technologies that make remote access sim…
Siguza’s Blog
astrocamel, Blog, Portfolio, George Skouroupathis
Regular readers will know that I'm very active in the CA / PKI space and even deliver a 2-day advanced training course [https://www.feistyduck.com/training/the-best-ssl-and-tls-training-in-the-world] on the topic. Over the last year or so I've been watching
Stripe has made several significant, positive changes to its user tracking and privacy policies in the last week.
Letsencrypt is a pretty neat concept: free secure certificates for web servers, in order to increase the adoption of HTTPS across the web. The basic idea is that certificates should be free, that the barrier to install them should be as low as possible and that updating certificates should be automated. It protects…
Musings on Information Security and Privacy Risk Management - Thierry Zoller.
Sources tell KrebsOnSecurity that Microsoft Corp. is slated to release a software update on Tuesday to fix an extraordinarily serious security vulnerability in a core cryptographic component present in all versions of Windows . Those sources say Microsoft has quietly shipped a patch for the bug to branches of the U.S…
I wrote a critical piece about the Google Apple Contact Tracing (GACT) platform a few days ago . This resulted in quite some discussion, which brought some more arguments to the fore, that I would like to address and clarify here. Here I focus on my area of expertise: privacy. My colleague Tamar Sharon wrote an…
