31
32
Google’s FLoC Is a Terrible Idea
Update, April 9, 2021 : We've launched Am I FLoCed, a new site that will tell you whether your Chrome browser has been turned into a guinea pig for Federated Learning of Cohorts or FLoC, Google’s latest targeted advertising experiment. The third-party cookie is dying, and Google is trying to create...
33
Police can’t demand you reveal your phone passcode then tell a jury you refused
The Utah Supreme Court is the latest stop in EFF’s roving campaign to establish your Fifth Amendment right to refuse to provide your password to law enforcement. Yesterday, along with the ACLU, we filed an amicus brief in State v. Valdez, arguing that the constitutional privilege against self-...
34
We found and fixed a rare race condition in our session handling
On March 8, out of an abundance of caution, we logged all users out of GitHub.com. In this post we share technical details of the vulnerability and steps we're taking to ensure it doesn't happen again.
35
Luca App: CCC calls for a moratorium
Dubious business model, defective software, irregularities in the awarding of contracts: The Chaos Computer Club (CCC) demands an immediate end to states' alimentation of Smudo's million-dollar tax...
36
The Invisible JavaScript Backdoor
A few months ago we saw a post on the r/programminghorror subreddit: A developer describes the struggle of identifying a syntax error resulting from an invisible Unicode character hidden in JavaScript source code. This post inspired an idea: What if a backdoor literally cannot be seen and thus evades detection even…
37
BitLocker Lockscreen Bypass
BitLocker is a modern data protection feature that is deeply integrated in the Windows kernel. It is used by many corporations as a means of protecting company secrets in case of theft. Microsoft recommends that you have a Trusted Platform Module which can do some of the heavy cryptographic lifting for you.
38
The S in IoT is for Security
Purism makes premium phones, laptops, mini PCs and servers running free software on PureOS. Purism products respect people's privacy and freedom while protecting their security.
39
Proposal: Treat FLoC as a security concern
Google is rolling out Federated Learning of Cohorts (FLoC) for the Chrome browser. TL;DR: FLoC places people in groups based on their browsing habits to target advertising. Why is this bad? As the …
40
GitHub blocks FLoC across all of GitHub Pages
All GitHub Pages sites served from the github.io domain will now have a Permissions-Policy: interest-cohort=() header set. Pages sites using a custom domain will not be impacted. Learn more about…
41
A Docker footgun led to a vandal deleting NewsBlur's MongoDB database
tl;dr: A vandal deleted NewsBlur’s MongoDB database during a migration. No data was stolen or lost.
42
DuckDuckGo Extension to Block FLoC, Google’s New Tracking Method in Chrome
Google has created a new tracking mechanism called FLoC, put it in Chrome, and automatically turned it on for millions of users. It's bad for privacy, which is why we're now blocking it in the DuckDuckGo extension.
43
I mailed an AirTag and tracked its progress
I sent an AirTag by mail to a friend and tracked it across the UK.
44
EFF Joins Global Coalition Asking Apple CEO Tim Cook to Stop Phone-Scanning
EFF has joined the Center for Democracy and Technology (CDT) and more than 90 other organizations to send a letter urging Apple CEO Tim Cook to stop the company’s plans to weaken privacy and security on Apple’s iPhones and other products. Have you signed the petition?
45
Six Palestinian organizations hacked with NSO Group’s Pegasus Spyware
On 19 October 2021, Israeli Minister of Defense, Benny Gantz, announced the designation of six leading Palestinian civil society organizations in the Occupied Palestinian Territory as “terrorist organizations” under Israel’s Anti-Terrorism Law 2016. The groups named are Addameer; Al-Haq; Defense for Children …
46
Grand jury subpoena for Signal user data, Central District of California
It’s the first half of 2021 – nearly five years since the “first half of 2016” – but in many ways not much has changed. The United Kingdom is still trying to figure out Brexit, another Justin Bieber song hit #1 on the charts (is it too late now to say sorry?), and Signal still doesn’t really know...
47
The ownership and future of Mullvad VPN
This article is by our founders and sole shareholders, Daniel Berntsson and Fredrik Strömberg. Mullvad VPN is here to stay, and we are not interested in ever selling it.
48
The database servers powering Let's Encrypt
Let’s Encrypt helps to protect a huge portion of the Web by providing TLS certificates to more than 235 million websites. A database is at the heart of how Let’s Encrypt manages certificate issuance. If this database isn’t performing well enough, it can cause API errors and timeouts for our subscribers. Database…
49
A Look at iMessage in iOS 14
Posted By Samuel Groß, Project Zero On December 20, Citizenlab published “The Great...
50
Web Scrapers Claim to Sell Personal Data on Facebook Users on a Hacker Forum
Data on over 1.5 billion Facebook users is being sold on a hacking-related forum, enabling cybercriminals advertisers to target users.
51
Zoom zero-day discovery
White hat hackers demonstrated a Zoom vulnerability allowing a Remote Code Execution attack at the Pwn2Own event.
52
Trump’s new social media platform found using Mastodon code
From media reports and individual findings that various people have presented to us, it seems that the new social media platform owned by the former president of the United States, Donald J. Trump, so-called Truth Social, is using Mastodon’s source code with various visual adjustments. The platform has not formally…
53
Surveilance bill rushed through Australian parliament in 24 hours
New Australian surveillance bill enables police to hack your device, collect or delete your data, and take over your social media accounts.
54
Uncovering a 24-year-old bug in the Linux Kernel
How a failing rsync run led to the discovery of a long-standing bug in the Linux TCP implementation.
55
Emulating AirTags to upload arbitrary data via Apple's FindMy network
Apple AirTags: Arbitrary data can be uploaded from non-internet-connected devices by sending Find My BLE broadcasts to nearby Apple devices. We're releasing an ESP32 firmware that turns the microcontroller into an (upload only) modem, and a macOS application to retrieve, decode and display the uploaded data.
56
Malicious PyPI packages stealing credit cards and injecting code
JFrog finds a new supply chain attack targeting python developers using the PyPI repository
57
Site Isolation in Firefox
With Site Isolation enabled on Firefox for Desktop, Mozilla takes its security guarantees to the next level.
58
Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
Unveiling a scheme flooding vulnerability across major browsers. Learn how it threatens anonymous browsing.
59
Git password authentication is shutting down
As previously announced, starting on August 13, 2021, at 09:00 PST, we will no longer accept account passwords when authenticating Git operations on GitHub.com. Instead, token-based authentication (for example, personal…
60
The FBI Should Stop Attacking Encryption
Federal law enforcement has been asking for a backdoor to read Americans’ encrypted communications for years now. FBI Director Christopher Wray did it again last week in testimony to the Senate Judiciary Committee. As usual, the FBI’s complaints involved end-to-end encryption employed by popular...