331
Limiting Private API Availability in Chromium
During a recent audit, we discovered that some third-party Chromium based browsers were able to integrate Google features, such as Chrome sy...
332
A new Cloudflare Web Application Firewall
Today we are announcing a new Cloudflare Web Application Firewall for all Cloudflare paid zone customers.
333
The search for a perfect access control system
Making sense of authorization, policy and access management systems.
334
SLSA, an End-to-End Framework for Supply Chain Integrity
Posted Kim Lewandowski, Google Open Source Security Team & Mark Lodato, Binary Authorization for Borg Team Supply chain integrity attacks—u...
335
336
337
AuthZ: Scalable permissions system
How we built an authorization system based on Google Zanzibar
338
Encrypting Postgres Data at Rest in Kubernetes
An example of how you can encrypt Postgres data at rest using PGO, the open source Postgres Operator from Crunchy Data using AWS EBS gp2 volumes.
339
Cloudflare's Handling of an RCE Vulnerability in Cdnjs
Recently, a RCE vulnerability in the way cdnjs’ backend is automatically keeping web resources up to date has been disclosed. Read about how Cloudflare handled the security incident and what will prevent similar exploits in the future.
340
Arti, a pure-Rust Tor implementation
Greetings! Today I'm happy to announce a new era in Tor implementation. Over the past year or so, we've been working on "Arti", a project to rewrite Tor in Rust. Thanks to funding from Zcash Open Major Grants (ZOMG), we can finally put the Arti project up in our priorities list, and devote more time to it. Below I'll…
341
342
Defeating Cookie Banners
How Transcend solved the core technical problem of user tracking consent and built an alternative to pop-up cookie banners.
343
Kraken Security Labs Identifies Vulnerabilities in Commonly Used Bitcoin ATM
Bitcoin ATMs offer a convenient and friendly way for consumers to purchase cryptocurrencies. That ease of use can sometimes come at the expense of security. Kraken Security Labs has uncovered multiple hardware and software vulnerabilities in a commonly used cryptocurrency ATM: The General Bytes BATMtwo (GBBATM2)…
344
Hex-rays is moving to a subscription model
Hex-Rays is moving to a subscription model In 2022, we will update the catalogue of products available under our subscription model. Our new bundles are
345
346
OAuth Attack Vectors
Intro The OAuth2 authorization protocol has been under fire for the past ten years. You've probably already heard about plenty of "return_uri" tricks, token leakages, CSRF-style attacks on clients, an
347
A future without passwords
On World Password Day, we’re providing a sneak peek at a future in which, one day, you won’t need a password at all.
348
Database containing personal info of 106M visitors to Thailand exposed online
Just how safe is your personal information? With more than thousand reported data breaches since 2004, the odds are not in your favor.
349
When Myanmar needs ProtonVPN the most, Apple stands in the way of human rights
Myanmar citizens have used Proton tools to communicate securely and access the truth. But Apple has blocked us from sending out important app updates.
350
Is Apple Banning Free Analytics SDKs?
This story has moved a lot since it was published – our update from March 3 tells the latest. Apple...
351
TPM Sniffing
TL;DR : we reproduced Denis Andzakovic’s proof-of-concept showing that it is possible to read and write data from a BitLocker-protected device (for instance, a stolen laptop) by sniffing the TPM key from the LCP bus.
352
Privilege escalation with polkit: How to get root on Linux with a seven-year-ol
polkit is a system service installed by default on many Linux distributions. It’s used by systemd, so any Linux distribution that uses systemd also uses polkit.
353
Google banned almost 120k spam developer accounts in 2020 for the play store
Posted by Krish Vitaldevara, Director of Product Management Trust & Safety, Google Play Providing safe experiences to billions of users a...
354
AWS Identity service handles 400M API calls every second
Amazon S3 turned 15 earlier this year, and Amazon EC2 will do the same in a couple of months. Today we are celebrating the tenth birthday of AWS Identity and Access Management (IAM). The First Decade Let’s take a walk through the last decade and revisit some of the most significant IAM launches: May 2011 […]
355
Inline and Sideline Approaches for Low-Cost Memory Safety in C
This technical report is based on a dissertation submitted November 2020 by the author for the degree of Doctor of Philosophy to the University of Cambridge, Selwyn College.
356
New and improved Linux Random Number Generator ready for testing
We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.
357
Protecting reserved roles with PostgreSQL Hooks
Using Postgres Hooks to protect functionality in your Postgres database.
358
Study reveals scale of data-sharing from Android mobile phones
These vendor-customised Android variants transmit substantial amounts of information to the OS developer and to third parties such as Google, Microsoft, LinkedIn, and Facebook that have pre-installed system apps.
359
Chrome phasing out Manifest v2 support from Jan 2022
Details of the Manifest V2 phase-out and end of life.
360
New [July 2, 2021] Audacity Data Collection Policy
Audacity is the world's most popular audio editing and recording app. Edit, mix, and enhance your audio tracks with the power of Audacity. Download now!