Let’s encrypt: an automated certificate authority to encrypt the entire web, Aas et al., CCS’19 This paper tells the story of Let’s Encrypt, from it’s early beginnings in 20…
As of today, Windows trusts 322 root certificates issued by 122 different organizations from 47 countries. This number is quite high, and has been steadily growing over the last few years. And it turns out many of those certificates are not needed at all by the vast majority of Windows users, can be distrusted with no…
Australian Strategic Policy Institute2020255 points106 commentscited by 11Society, Policy & Culture details
‘Re-education’, forced labour and surveillance beyond Xinjiang. What’s the problem? The Chinese government has facilitated the mass transfer of Uyghur and other ethnic minority1 citizens from the far west region of Xinjiang to factories across the country. Under conditions that strongly suggest forced labour, Uyghurs…
We can't let the FBI keep the public in the dark about its ability to gain access to information stored on our personal mobile devices.
Before adding a dependency to one of my software projects, I do some basic vetting of the dependency. Among the things I check are:
We, along with the security industry and our partners, continue to investigate the extent of the Solorigate attack. While investigations are underway, we want to provide the defender community with intel to understand the scope and impact, remediation guidance, and detections and protections we have built as a result.
Personal Blog of Christian Haschek
Earlier this year, when I went from having only Facebook-login on Wishy.gift to allow registrations with email address and password, one of my concerns was how to implement this is a way that protects the data and privacy of my users. I don’t have any ads or analytics on the site, the users can select whatever display…
The COVID-19 pandemic is a global public health emergency that requires a coordinated and large-scale response by governments worldwide. However, States’ efforts to contain the virus must not be...
This article aims to subdue the rumors that Safari 14 will block Google Analytics (and other similar libraries) by default. It will not.
KeePassXC Password Manager
We’re excited to announce that starting next week Zoom’s E2EE offering will be available as a technical preview! Learn more
Starting today, July 8th, the Tor Project is running a one month campaign called #MoreOnionsPorfavor to raise awareness about onion sites, that is, websites available over onion services. We recently released a feature called Onion-Location in Tor Browser that announces to users if a website has an onion site…
On January 15, a Norweigian Consumer Council (NCC) investigative report exposed the ways that Grindr, OKCupid, and eight other apps are collecting and sharing extremely sensitive personal data. Grindr in particular was sharing users’ age and location tied to a device ID that would allow trackers to...
Analysis of various approaches to monetizing the Twitter hack
Check out our progress in end-to-end encryption calls in Jitsi. Give us your crypto knowledge feedback with the code and learn how to demo it here.
Android is one of Google’s most important tools for collecting data on users. This guide will help you improve your privacy on Android devices.
Sounds great! But what does it mean? seL4 seL4 (pronounced ess-e-ell-four) is arguably the world’s most secure operating system (OS) kernel. The OS kernel is the lowest level of software runn…
Protecting the security and privacy of individuals is a central tenet of Mozilla’s mission. While we continue to make extensive use of both sandboxing and Rust in Firefox to address ...
It has been over a year since I cancelled my Cloudflare account. They keep emailing me and haven't taken me off their marketing lists despite repeated requests. Their CTO told me he would investigate, but nothing changed. Their Data Protection Office hasn't respond to my requests. Cloudflare do not appear to respect…
Chrome engineers are experimenting with Rust. For the foreseeable future, C++ is the reigning monarch in our codebase, and any use of Rust will need to fit in with C++ — not the other way around. This seems to present some C++/ Rust interoperability challenges which nobody else has faced.
Evergreen privacy guides, threat modeling, encryption, practical tutorials.
I’m thrilled to announce a new open-source project for the Swift ecosystem, Swift Crypto. Swift Crypto is a new Swift package that brings the fantastic APIs of Apple CryptoKit to the wider Swift community. This will allow Swift developers, regardless of the platform on which they deploy their applications, to access…
Patrick Wardle highlighted a tweet by Maxwell (" Some Apple apps bypass some network extensions and VPN Apps. Maps for example can directly access the internet bypassing any NEFilterDataProvider or NEAppProxyProviders you have running "), sparking an extensive HN discussion on Apple's ham-fisted tactics (not unlike…
We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.
When I was 5, I saw the Karate Kid. I saw that bad guys could beat me up, and I had no recourse if I didn't know karate. I promptly signed up for martial arts classes.
