331
NodeJS security cheat sheet
Website with the collection of all the cheat sheets of the project.
332
Protected Content, Delete by Date, Device Management and more
Today's update brings tools to prevent others from saving content from groups and channels, the ability to delete messages for specific periods of time, new ways to manage your connected devices, post anonymously in public groups on behalf of your channel and more.
333
Simple Linux kernel memory corruption bug can lead to complete system compromise
An analysis of current and potential kernel security mitigations Posted by Jann Horn, Project ...
334
Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea
Disclaimer: Thoughts expressed here are my own, and not of my employers.
335
Building a Curve25519 Hardware Accelerator
Note: this post uses a $\LaTeX$ plugin to render math symbols. It may require a desktop browser for the full experience…
336
Tracking the WhatsApp habits of random smartphones
Scaling the WhatsApp online-status hack from a single contact to 5000 random phone numbers — what the data says about phone usage habits.
337
macOS Zero-Day Used Against Hong-Kong Activists
Google researchers discovered a MacOS zero-day exploit being used against Hong Kong activists. It was a “watering hole” attack, which means the malware was hidden in a legitimate website. Users visiting that website would get infected. From an article: Google’s researchers were able to trigger the exploits and study…
338
(Very) Basic Intro to Elliptic Curve Cryptography
Learn cryptography in Go by building ciphers, hashes, password security, and encryption tools. Understand security beneath the library call.
339
Can We Stop Pretending SMS Is Secure Now?
SMS text messages were already the weakest link securing just about anything online, mainly because there are tens of thousands of employees at mobile stores who can be tricked or bribed into swapping control over a mobile phone number to someone else. Now we’re learning about an entire ecosystem of companies that…
340
Container security best practices: Ultimate guide
Container security is critical as companies use them more often for AI workloads and cloud workloads. Learn about 17 container security best practices here.
341
Intent to issue €2.5M fine to Disqus over GDPR breaches
The Norwegian Data Protection Authority has notified Disqus Inc. (Disqus) that we intend to issue an administrative fine of NOK 25 000 000 for not complying with the GDPR rules on accountability, lawfulness, and transparency.
342
343
Remote Code Execution Found in CocoaPods
tl;dr CocoaPods is a popular package manager used by lots of iOS apps (among other Swift and Objective-C Cocoa applications). I found a remote code execution...
344
345
346
Gab Has Been Breached
I've investigated hundreds of data breaches over the years (there are 514 of them in Have I Been Pwned [https://haveibeenpwned.com/] as I write this), and for the most part, the situation with Gab is just another day on the internet. But Gab is also different, having grown
347
The reason Okta spent $6.5B on Auth0
Explore the business drivers behind Okta's acquisition of Auth0, including market positioning, strategic goals, and the future of authentication providers.
348
Do not use redirection characters in your shell prompt
Over the years of troubleshooting performance problems in the Unix/Linux world, I have seen multiple cases where a regularly used command line tool in a customer server just stops working for some reason. The tool just returns immediately, doing absolutely nothing. No output printed, no coredumps and the exit code is…
349
The Patriot Act Has Threatened Freedom for 20 Years
In passing the PATRIOT Act, Congress enacted a “solution” to preventing another 9/11-like debacle without having any evidence that a lack of surveillance powers was what allowed Osama bin Laden’s suicide hijackers to succeed in killing nearly 3,000 Americans.
350
Briar 1.4 – Offline sharing, message transfer via SD cards and USB sticks
Press release The Briar Project released version 1.4 of its Android app today. This release adds a couple of new features, highlighted below. First of all, users can now share the app offline. Prior to this release, the only way to get the app was to to download it from the internet, which requires an internet…
351
Security keys are now supported for SSH Git operations
You can now use FIDO2 security keys to authenticate over SSH for remote Git operations, providing a higher level of account security.
352
Preparing to Issue 200M Certificates in 24 Hours
On a normal day Let’s Encrypt issues nearly two million certificates. When we think about what essential infrastructure for the Internet needs to be prepared for though, we’re not thinking about normal days. We want to be prepared to respond as best we can to the most difficult situations that might arise. In some of…
353
A bug related to handling of authenticated sessions
On the evening of March 8, we invalidated all authenticated sessions on GitHub.com created prior to 12:03 UTC on March 8 out of an abundance of caution.
354
355
Abusing the Chromium Devtools Scope Pane
tl;dr — Abusing the Chromium Devtools Scope Pane to track debugging of specific javascript functions
356
YouTube ads in Safari: you see them now, will you see them in the future?
Content blocking in Safari is a thing in and of itself, and it's not good. One of the consequences is ads appearing in YouTube. Why does it happen and can it be prevented?
357
Privacy for Students: Surveillance Self-Defense
Schools are increasingly adopting surveillance technology to spy on students while they’re at school, at home, or even on their social media. The companies that make these surveillance products and services advertise them to schools as a way to keep students safe–but there’s no evidence so far that they actually...
358
359
Encrypted Backup Shootout
Recently I have been spending time on improving the performance of bupstash (my encrypted backup tool), and wanted to compare it to some existing tools to try and find its relative performance in the backup tool landscape.
360
Google introducing tool for under-18s to remove images of them from search
Today we’re announcing a variety of new policies and updates to help keep kids and teens safe as they spend more time online.