121
The Modern Guide to OAuth
Learn how OAuth 2.0 works with this simplified explanation and guide. Learn what it is, why it's essential for secure authorization, and best practices for implementation.
122
Bahraini Government Hacks Activists with NSO Group Zero-Click iPhone Exploits
We identified nine Bahraini activists whose iPhones were successfully hacked with NSO Group’s Pegasus spyware between June 2020 and February 2021. The hacked activists included three members of Waad (a secular Bahraini political society), three members of the Bahrain Center for Human Rights, two exiled Bahraini…
123
Private censorship is not the best way to fight hate or defend democracy (2018)
From Cloudflare’s headline-making takedown of the Daily Stormer last autumn to YouTube’s summer restrictions on LGBTQ content, there's been a surge in “voluntary” platform censorship. Companies—under pressure from lawmakers, shareholders, and the public alike—have ramped up restrictions on speech,...
124
How often should I rotate my SSH keys?
Learn why rotating your SSH keys is essential for preventing credential theft. Discover best practices for SSH key rotation and how to protect your systems from potential breaches.
125
Mimicking a device is becoming almost impossible
From User-Agent tricks to canvas hashes, see how modern device detection—Picasso, fonts, emojis, touch—makes spoofing fail. Learn how to blend in safely.
126
Privacy Analysis of FLoC
In a previous post, I wrote about a new set of technologies “Privacy Preserving Advertising”, which are intended to allow for advertising without compr
127
How we protect our most sensitive secrets from the most determined attackers
As a bank, we have a lot of secrets we need to protect to keep our customers and ourselves safe. These include private keys that only we know, which we use to digitally sign requests as coming from us (sort of like a private password). These private keys are super important and are used all over Monzo and when…
128
SHA-1 'fully and practically broken' by new collision (2020)
Independent security journalism: news and analysis on intrusions, vulnerabilities, AI, policy and the software supply chain, plus video and podcasts.
129
Dumping and extracting the SpaceX Starlink user terminal firmware
COSIC - Dumping and extracting the SpaceX Starlink User Terminal firmware ( )
130
Tor Browser 11.0
Tor Browser 11.0 is now available from the Tor Browser download page and our distribution directory. This is the first stable release based on Firefox ESR 91, and includes an important update to Tor 0.4.6.8.
131
132
Log4j 2.15.0 – Previously suggested mitigations may not be enough
Log4j 2.15.0 and previously suggested mitigations may not be enough, Author: Renato Marinho
133
Germany: Data retention to be abolished
According to the German Minister of Justice data retention or "the storage of telecommunications data without any reason" could soon come to an end.
134
uBlock, I exfiltrate: exploiting ad blockers with CSS
Ad blockers like uBlock Origin are extremely popular, and typically have access to every page a user visits. Behind the scenes, they're powered by community-provided filter lists - CSS selectors that
135
Lawsuit against TSA and DEA over airport seizures achieves first victory
PITTSBURGH—When travelers go online to find out whether it is legal to fly with cash, the government tells them that there are no restrictions on […]
136
137
138
139
Rust in the Android Platform
Posted by Jeff Vander Stoep and Stephen Hines, Android Team Correctness of code in the Android platform is a top priority for the securit...
140
China issues new encryption import control
On November 2, 2021, Ministry of Commerce of China (“MOFCOM”) officially released the revised Catalogue of Technologies Subject to Import Prohibition and Restriction (“Technology Catalogue”), effective immediately, which identifies, among others, foreign “data encryption technology employing a key length greater than…
141
Firefox 90 supports Fetch Metadata Request Headers
We are pleased to announce that Firefox 90 will support Fetch Metadata Request Headers which allows web applications to protect themselves and their users against various cross-origin threats like ...
142
Mitmproxy 7.0
We’re delighted to announce the release of mitmproxy 7, a free and open source interactive HTTPS proxy. This release is all about our new proxy core, which bring substantial improvements across the board and represents a massive milestone for the project.
143
Why not “Why not WireGuard?” (2020)
An article by Michael Tremer titled Why not WireGuard is sometimes shared in VPN discussions. Unfortunately that article contains several misconceptions and some out-of-date information that deserves to be addressed.
144
Facebook's GDPR consent bypass reaches Austrian Supreme Court
Austrian Supreme Court may refer case to Court of Justice, questioning the basis of Facebook's business model in Europe.
145
Microsoft ruined passwords, now aims for a passwordless future
Purism makes premium phones, laptops, mini PCs and servers running free software on PureOS. Purism products respect people's privacy and freedom while protecting their security.
146
Behind GitHub’s new authentication token formats
We’re excited to share a deep dive into how our new authentication token formats are built and how these improvements are keeping your tokens more secure. As we continue to…
147
Latest Mozilla VPN features
It’s been less than a year since we launched Mozilla VPN, our fast and easy-to-use Virtual Private Network service brought to you by a trusted name in on
148
Look Up Unknown Phone Numbers Using Facebook Reset Password
This tutorial is meant to help find clues as to who is calling you when you're receiving calls from an unknown phone number (a number that is displayed on
149
Update on campaign targeting security researchers
An update on a hacking campaign targeting security researchers.
150
An EPYC escape: Case-study of a KVM breakout
Posted by Felix Wilhelm, Project ZeroIntroduction KVM (for Kernel-based Virtual Machine) is the ...