301
A Yubico FAQ about passkeys
Delve into Yubico's comprehensive guide about passkeys, a term encapsulating FIDO/WebAuthn credentials that offer a secure, passwordless experience.
302
A New Life for Certificate Revocation Lists
This month, Let’s Encrypt is turning on new infrastructure to support revoking certificates via Certificate Revocation Lists. Despite having been largely supplanted by the Online Certificate Status Protocol for over a decade now, CRLs are gaining new life with recent browser updates. By collecting and summarizing CRLs…
303
Security experts declare all Proton apps secure after security audit
All our apps (Proton Mail, Proton Drive, etc) are open source and independently audited. Anyone can inspect our software and confirm our encryption works.
304
EFF about EU: EIDAS 2.0 Sets a Dangerous Precedent for Web Security
The Council of the European Union this week adopted new language for regulations governing internet systems that may put the security of your browser at greater risk.The new language affects the EU’s electronic identification, authentication and trust services (eIDAS) rules, which are supposed to...
305
Introducing passkeys in Chrome
We announced in October that passkey support was available in Chrome Canary. Today, we are pleased to announce that passkey support is now ...
306
MongoDB Releases Queryable Encryption Preview
Today we are announcing the preview release of Queryable Encryption which allows customers to encrypt sensitive data from the client side, store it as fully randomized encrypted data on the database server side, and run expressive queries on the encrypted data. Learn more.
307
Google Zanzibar Through Our Eyes
Understanding Google's Zanzibar paper the way the Authzed team does.
308
Peter Eckersley, co-creator of Let’s Encrypt, dies at just 43
The Sophos Blog
309
Anti-Interdiction on the Librem 5 USA
Purism makes premium phones, laptops, mini PCs and servers running free software on PureOS. Purism products respect people's privacy and freedom while protecting their security.
310
The quantum state of Linux kernel garbage collection
A deep dive into an in-the-wild Android exploit Guest Post by Xingyu Jin, Android Security Resea...
311
Aserto: Developer API for permissions and RBAC
No one should build permissions and RBAC on their own. Aserto's authorization-as-a-service platform is here to make sure of it!
312
But You Told Me You Were Safe: Attacking the Mozilla Firefox Renderer (Part 1)
Vulnerabilities and exploits in common targets like browsers are often associated with memory safety issues. Typically this involves either a direct error in memory management or a way to corrupt internal object state in the JavaScript engine. One way to eliminate such memory safety issues is to use
313
The end of Roe will bring about a sea change in the encryption debate
With the Supreme Court poised to rip away a constitutional right that’s been the law of the land for nearly half a century by overturning Roe v. Wade, it’s time for the gloves to come off in the encryption debate. For a quarter of a century, it has
314
Anatomy of a JWT
Technical article explains JSON Web Tokens (JWT), their component parts, and how they are used for authentication.
315
The Mitto AG surveillanve case – or why we must never backdoor encryption
A single employee leaked sensitive data to secret services, potentially also to Russia.
316
Mozilla patches two use-after-free vulnerabilities (ab)used in the wild
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw.
317
A Quick Look at QUIC Censorship
An introduction to QUIC and its potential for censorship resistance, as well as a survey of current QUIC blocking in China, India, Russia and Uganda.
318
Google Chrome U2F API decommission: What the change means
Understand Chrome's deprecation of U2F API and its effects, while exploring how to migrate to the WebAuthn API for continued YubiKey support.
319
Nine-year-old kids are launching DDoS attacks against schools
Britain's computer crime cops are targeting youngsters as young as nine years old in an attempt to dissuade them from embarking on a life of cybercrime.
320
We must protect our ability to transact privately online (2019)
Without cryptocurrency, a cashless society is a surveillance society
321
Apple is becoming an ad company despite privacy claims
Apple’s ad business is growing fast. It tracks you in its apps and uses that data to sell ads despite its privacy claims.
322
323
Memory safety for the world’s largest software project
Rust for Linux and Prossimo The Rust for Linux project aims to bring a new system programming language into the Linux kernel. Rust has a key property that makes it very interesting to consider as the second language in the kernel: it guarantees no undefined behavior takes place (as long as unsafe code is sound)…
324
How Underground Groups Use Stolen Identities and Deepfakes
The growing appearance of deepfake attacks is significantly reshaping the threat landscape. These fakes brings attacks such as business email compromise (BEC) and identity verification bypassing to new levels.
325
LTrack: Stealthy Tracking of Mobile Phones in LTE
Martin Kotuliak, Simon Erni, Patrick Leu, Marc Röschlin, and Srdjan Čapkun, ETH Zurich
326
Automating cookie consent and GDPR violation detection
The European Union's General Data Protection Regulation (GDPR) requires websites to inform users about personal data collection and request consent for cookies. Yet the majority of websites do not give users any choices, and others attempt to deceive them into accepting all cookies. We document the severity of this…
327
Private profiles are now generally available on GitHub
Private profiles (now generally available) enables users to turn their GitHub profile "private", which gives users control over features that share user data across the GitHub platform. When a profile…
328
329
An AWS account just for getting into other AWS accounts
“An AWS account just for getting into other AWS accounts” has moved to https://src-bin.com/substrate/blog/an-aws-account-just-for-getting-into-other-aws-accounts/ .
330
Cannoli: The Fast QEMU Tracer
Cannoli Cannoli is a high-performance tracing engine for qemu-user. It can record a trace of both PCs executed as well as memory operations. It consists of a small patch to QEMU to expose locations to inject some code directly into the JIT, a shared library which is loaded