601
Chrome client “variations” can be used to identify you (2020)
Until now I used Chrome with a few settings tweak like disabling sending usage statistics, uBlock origin, no crash reports and so on.
602
603
A Spectre proof-of-concept for a Spectre-proof web
Posted by Stephen Röttger and Artur Janc, Information Security Engineers Three years ago, Spectre changed the way we think about security b...
604
605
What security does a default OpenBSD installation offer?
In this text I will explain what makes OpenBSD secure by default when you install it. Do not take this for a security analysis, but more like a guide to help you understand what is done by OpenBSD to have a secure environment. The purpose of this text is not to compare OpenBSD to other OSes but to say what you can…
606
607
Helping to secure internet routing
The internet works reliably, in large part, on the basis of a key technology called Border Gateway Protocol (BGP). BGP is a means by which all junction points on the internet (routers) communicate with each other to dynamically establish the correct (and correctly weighted) paths that network packets should follow to…
608
Android emulator abused to introduce malware onto PCs
Attackers have compromised the software distribution system of BigNox, developer of a popular Android emulator for PCs and Macs.
609
ChaosDB Explained: Azure's Cosmos DB Vulnerability Walkthrough
This is the full story of the Azure ChaosDB Vulnerability that was discovered and disclosed by the Wiz Research Team, where we were able to gain complete unrestricted access to the databases of several thousand Microsoft Azure customers.
610
Google is testing its new ad targeting tech in millions of browsers
Update, April 9, 2021 : We've launched Am I FLoCed, a new site that will tell you whether your Chrome browser has been turned into a guinea pig for Federated Learning of Cohorts or FLoC, Google’s latest targeted advertising experiment. Today, Google launched an “origin trial” of Federated Learning...
611
DPA blocks facial recognition system in Italy and MP proposes moratorium
Italian DPA argues the SARI Real Time facial recognition system lacks a legal basis and, as designed, it would implement a form of mass surveillance. On 14 April, a member of the Italian Parliament, Filippo Sensi, proposed a moratorium on the use of video surveillance tools that use Facial Recognition.
612
Fuzzing Java in OSS-Fuzz
Posted by Jonathan Metzman, Google Open Source Security Team OSS-Fuzz , Google’s open source fuzzing service, now supports fuzzing applicat...
613
Valid Signal privacy issues shrugged off while patches quietly rolled out
kelly kaoudis: application security, hacking, software engineering blog
614
Preventing Pool-Party Attacks
Brave has identified a new category of tracking vulnerability, forms of which are present in all browsers. We call this category of attack “pool-party” attacks because the attack uses collections (or “pools”) of limited-but-shared resources to create side channels.
615
Ending CAPTCHAs: Introducing Cryptographic Attestation of Personhood
We want to remove CAPTCHAs completely. The idea is rather simple: a real human should be able to touch or look at their device to prove they are human, without revealing their identity. Let's explore!
616
64-Bit Linux Return-Oriented Programming
Update : Dongli Zhang reports that newer Linux versions organize the stack differently . The code below will need to be modified accordingly.
617
Distributing unnotarized Mac apps in a text file
This isn't a late April Fools joke. (My April Fools joke that I got hired by Apple as a Swift Evangelist backfired with a profusion of congratulations.) This blog post is a kind of follow-up to some previous blog posts. Last month I wondered what's the best way to distribute Mac apps without notarization , and I…
618
Sequoia PGP is now LGPL 2.0
Sequoia is a modular OpenPGP implementation in Rust.
619
620
621
Security Best Practices for Fintech Application Development
Learn how to build and manage your card program using Marqeta's guides and API reference documentation.
622
How Not to Redact a Warhead
How the wrong settings on a photocopier has let us have a glimpse at a forbidden image of a modern thermonuclear warhead.
623
624
Pegasus vs. Predator
Two Egyptians—exiled politician Ayman Nour and the host of a popular news program (who wishes to remain anonymous)—were hacked with Predator spyware, built and sold by the previously little-known mercenary spyware developer Cytrox. The phone of Ayman Nour was simultaneously infected with both Cytrox’s Predator and NSO…
625
Sq, Sequoia PGP's CLI, Released
Sequoia is a modular OpenPGP implementation in Rust.
626
Isolating Xwayland in a VM
In my last post, Qubes-lite with KVM and Wayland, I described setting up a Qubes-inspired Linux system that runs applications in virtual machines. A …
627
The NPM registry is deprecating TLS 1.0 and TLS 1.1
Beginning October 4, 2021, all connections to npm websites and the npm registry, including for package installation, must use TLS 1.2 or higher.
628
Private Home Directories for Ubuntu 21.04
Ubuntu has evolved a lot since its early beginnings as an easier-to-use derivative of Debian that catered primarily to the nascent Linux desktop market. Today Ubuntu is deployed beyond just your laptops at home and in the office. Nowadays you are more likely to find Ubuntu in the cloud, powering some of the world’s…
629
Limiting Private API Availability in Chromium
During a recent audit, we discovered that some third-party Chromium based browsers were able to integrate Google features, such as Chrome sy...
630
A new Cloudflare Web Application Firewall
Today we are announcing a new Cloudflare Web Application Firewall for all Cloudflare paid zone customers.