361
So you want to roll your own crypto?
A coworker of mine asked: How are people supposed to learn (from mistakes) if they don't roll their own crypto? The short answer is do roll ...
362
California agency blocks release of police use of force, surveillance training
Under a California law that went into effect on January 1, 2020, all law enforcement training materials must be “conspicuously” published on the California Commission on Peace Officer Standards and Training (POST) website. However, if you visit POST’s Open Data hub and try to download the officer...
363
Urgent and Important – Rotate Your Amazon RDS, Aurora, and DocumentDB Certs
Feb 5th, 2020: We’ve made an edit to this post. Previously, we had communicated that between February 5 and March 5, 2020, RDS would automatically stage the new certificates on RDS database instances without a restart. Based on customer feedback and to give customers as much time as possible to complete updates, RDS…
364
A hands-on introduction to static code analysis
An example-rich description of the architecture of static code analysis systems along with a hands-on tutorial on how to implement it.
365
366
Stop the Apple and Google contact tracing platform
Apple and Google released a joint specification that allows both iPhones and Android devices to do contact tracing on a global scale. Even though "privacy, transparency, and consent are of utmost importance", this is a game changing event that has grave consequences. We must stop Apple and Google in their tracks. Or…
367
Lies, damn lies, and front-end tracking
I’m here to warn you about the dangers of front-end user tracking. Not because Google is tracking you, but because it doesn’t track you quite well enough.
368
369
GoDaddy employees used in attacks on multiple cryptocurrency services
Fraudsters redirected email and web traffic destined for several cryptocurrency trading platforms over the past week. The attacks were facilitated by scams targeting employees at GoDaddy , the world’s largest domain name registrar, KrebsOnSecurity has learned.
370
The Rise of Synthetic Audio Deepfakes
Nisos Resources Library is full of interesting case studies, client success stories, infographics, videos and more. Click to see what we do.
371
Open Source Security Tools
Explore open source cloud security tools that help teams improve visibility, automate detections, and strengthen modern cloud-native security operations workflows.
372
ProtonDrive Security Model
Learn how Proton Drive uses end-to-end encryption to protect your photos, documents, and other sensitive data.
373
Confidential VMs
Google Cloud will now offer the ability to encrypt data in use, while it’s being processed in a Google data center
374
Web Authentication Methods Compared
This article looks at the most commonly used web authentication methods.
375
376
377
Hunting for Malicious Packages on PyPI
I installed every package on PyPI to look for malicious content. This is what I found.
378
Police in Mississippi to Pilot a Program to Live-Stream Amazon Ring Cameras
The police surveillance center in Jackson, Mississippi, will be conducting a 45-day pilot program to live stream the security cameras, including Amazon Ring cameras, of participating residents.
379
380
Fast open-source intrusion detection
The system, developed by Carnegie Mellon University CyLab researchers, achieves speeds of 100 gigabits per second using a single server.
381
Guessing smart phone PINs by monitoring the accelerometer
“Practicality of Accelerometer Side Channels on Smartphones,” by Adam J. Aviv. Benjamin Sapp, Matt Blaze, and Jonathan M. Smith. Abstract: Modern smartphones are equipped with a plethora of sensors that enable a wide range of interactions, but some of these sensors can be employed as a side channel to surreptitiously…
382
Microsoft Edge (Chromium) – Elevation of Privilege to Potential RCE
With some luck and a couple of XSS bugs I was able to break the new Edge
383
Arduino FIDO2 Authenticator
Introducing URU Card: an open-source, wallet-sized FIDO2 BLE authenticator based on ESP32, ATECC508A, OLED screen, and MPR121 touch keyboard. Join the project and start building your own secure authenticator.
384
I accidentally built a spying app
A personal story about creating new products and their unintended consequences
385
WeChat Surveillance Explained
This document provides a summary of the Citizen Lab's WeChat surveillance research findings, as well as questions and answers from the resesearch team.
386
WebBundles harmful to content blocking, security tools, and the open web
Google is proposing a new standard called WebBundles. This standard allows websites to “bundle” resources together, and will make it impossible for browsers to reason about sub-resources by URL. While we appreciate the problems the WebBundles and related proposals aim to solve, we believe there are other, better ways…
387
388
End-to-end encryption in the browser
Excalidraw introduces browser-based end-to-end encryption using Web Cryptography APIs for secure, private drawing storage.
389
On the Twitter Hack
Twitter was hacked this week. Not a few people’s Twitter accounts, but all of Twitter. Someone compromised the entire Twitter network, probably by stealing the log-in credentials of one of Twitter’s system administrators. Those are the people trusted to ensure that Twitter functions smoothly. The hacker used that…
390
How Shopify implemented its secure authentication service
We created a centralized authentication service, called Identity, by building upon functionality from the OpenID Connect (OIDC) specification.