Persuasion is as old as our species. Both democracy and the market economy depend on it. Politicians persuade citizens to vote for them, or to support different policy positions. Businesses persuade consumers to buy their products or services. We all persuade our friends to accept our choice of restaurant, movie, and…
Trellix XDR, get the latest cybersecurity trends, best practices, security vulnerabilities, and more from industry leaders.
Starting with the release of the Pixel 3, all of Google's Pixel Android smartphones come with the Titan M security chip on board. When I realized the Pixel 3a XL I purchased also had it, I decided to try to take advantage of it in an app I work on. It turned out that using the Titan M chip through the Android Keystore…
A little over a year ago, my employer threw away our VPNs in production and production-like server environments and moved towards a set of new, cutting-edge technologies that make remote access sim…
Siguza’s Blog
Today, we are sharing details about Pysa, an open source static analysis tool we’ve built to detect and prevent security and privacy issues in Python code. Last year, we shared how we built Zoncola…
astrocamel, Blog, Portfolio, George Skouroupathis
Today, Firefox began the rollout of encrypted DNS over HTTPS (DoH) by default for US-based users. The rollout will continue over the next few weeks to conf
Regular readers will know that I'm very active in the CA / PKI space and even deliver a 2-day advanced training course [https://www.feistyduck.com/training/the-best-ssl-and-tls-training-in-the-world] on the topic. Over the last year or so I've been watching
At the start of November, someone decided that they would try to attack and destroy our company. Here’s how we stopped them.
Stripe has made several significant, positive changes to its user tracking and privacy policies in the last week.
Browsers are changing the default value of the SameSite attribute for cookies from None to Lax. This will greatly improve security for users. However, some web sites may depend (even ...
Civil society across Europe launches the “Reclaim Your Face” campaign, demanding that local and national authorities listen to their communities about the serious risks of using facial recognition and other biometric technologies in public spaces. The newly formed coalition calls to ban biometric mass surveillance, in…
Letsencrypt is a pretty neat concept: free secure certificates for web servers, in order to increase the adoption of HTTPS across the web. The basic idea is that certificates should be free, that the barrier to install them should be as low as possible and that updating certificates should be automated. It protects…
Musings on Information Security and Privacy Risk Management - Thierry Zoller.
Tor Browser 10.0 for Desktop is now available from the Tor Browser download page and also from our distribution directory.
Sources tell KrebsOnSecurity that Microsoft Corp. is slated to release a software update on Tuesday to fix an extraordinarily serious security vulnerability in a core cryptographic component present in all versions of Windows . Those sources say Microsoft has quietly shipped a patch for the bug to branches of the U.S…
I wrote a critical piece about the Google Apple Contact Tracing (GACT) platform a few days ago . This resulted in quite some discussion, which brought some more arguments to the fore, that I would like to address and clarify here. Here I focus on my area of expertise: privacy. My colleague Tamar Sharon wrote an…
Our Bridge app is now open source for macOS, Windows, and Linux. Find links to the code and an independent security audit report.
At Signal, our goal is to build a reliable, secure, and private communication experience that is broadly accessible and simple to use. From the beginning, we’ve designed Signal so that your information is in your hands rather than ours.
Let’s talk about that thing nobody’s talking about. Let’s talk about a vulnerability that’s exposing 2018-2020 Macs while most are declining to act nor report about the matter. Oh, and did I mention it’s unpatchable?
I really like Secure by Design. The key idea is that there is a big overlap between secure code and good software design. Code that is strict, clear and focused will be easier to reason about, and …
How malicious environment variables can trick scripting language interpreters into executing arbitrary commands, a Linux exploitation technique.
According to a solicitation to potential contractors published last week, the Transportation Security Administration (TSA) wants to outsource its current questioning of airline passengers without ID , and its decisions about which travelers without ID to allow to travel and which to prevent from flying , to a…
Hundreds of popular websites now offer some form of multi-factor authentication (MFA), which can help users safeguard access to accounts when their password is breached or stolen. But people who don’t take advantage of these added safeguards may find it far more difficult to regain access when their account gets…
We have identified three independently exploitable vulnerabilities in Go's encoding/xml. Read more about their impact to Mattermost users.
