391
New macOS malware steals info, including a user's entire Keychain database
ThreatDown detects new macOS malware like MacStealer that targets Keychain databases and steals sensitive user information. Talk to our security team.
392
Removing PGP from PyPI
PyPI has removed support for uploading PGP signatures with new releases.
393
What every IT person needs to know about OpenBSD (2021)
How to have fun with the world’s most important free software project "Functional, free and secure by default", OpenBSD remains a crucial yet largely unacknowledged player in the open source field. This talk aims to highlight the project's signature security features and development practices -- razor sharp focus on…
394
PostgreSQL Encryption: The Available Options
On an episode of Postgres FM , the hosts had a (very brief) discussion of data encryption in PostgreSQL. While Postgres FM is a podcast well worth a subscribe, the hosts aren’t data security experts, and so as someone who builds a queryable database encryption system , I found the coverage to be somewhat… lacking. I…
395
What's next for Tor and privacy online?
Ten years ago, Edward Snowden shared documents with the press that exposed the extent of the U.S. government’s mass surveillance program – and used Tor to protect himself while doing so. How has the perception of privacy changed since then, and what are the Tor Project’s challenges for the year to come?
396
Appeals court denies judicial immunity to judge who personally searched home
FOR IMMEDIATE RELEASE: 10/30/2023 CONTACT: Phillip Suderman, psuderman@ij.org, (850) 376-4110 ARLINGTON, VA.—Today, the 4th U.S. Circuit Court of Appeals unanimously ruled in favor of Matthew Gibson […]
397
Apple Has Begun Scanning Your Local Image Files Without Consent
Preface: I don’t use iCloud. I don’t use an Apple ID. I don’t use the Mac App Store. I don’t store photos in the macOS “Photos” application, even locally. I…
398
What happens when your phone is spying on you
Smartphone spyware apps that allow people to spy on each other are not only hard to notice and detect, they also will easily leak the sensitive personal information they collect, says a team of computer scientists from New York and San Diego.
399
OpenSSH versus SSH
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
400
Supabase Auth: SSO, Mobile, and Server-Side Support
Supacharging Supabase Auth with Sign in with Apple on iOS, Single-Sign-On support with SAML 2.0, and PKCE for server-side rendering and mobile auth.
401
Kubernetes Exposed: One YAML Away from Disaster
We found two main misconfigurations in Kubernetes clusters belonging to more than 350 organizations openly accessible and largely unprotected.
402
“Web Environment Integrity”: Locking Down the Web
Brave strongly opposes Google's "Web Environment Integrity" proposal, the latest in Google's efforts to prevent users from being in control of how they use the Web.
403
404
Introducing 'Trusted Publishers'
Announcing a new, more secure way to publish to PyPI
405
A Critique on “A Critique on the OpenPGP Updates”
An occasional blog about OpenPGP keyservers and related issues
406
An Example of a Sad Google Account Recovery Failure and Its Effects
UPDATE: 24 May 2023: A Proposal for “Enhanced Recovery Services” for Locked Out Google Accounts
407
Maybe you should store passwords in plaintext
“Never, ever, think about something else when you should be thinking about the power of incentives.” – Charlie Munger, American billionaire investor.
408
409
Update: The Swedish authorities answered our protocol request
Since the events of the search warrant by the Swedish police at Mullvad’s office in Gothenburg, we have tried to get hold of documents and protocols tied to the operation. This is what the authorities came back with.
410
Compromising Garmin Sport Watches: A Deep Dive into GarminOS and Its MonkeyC VM
13 vulnerabilities in GarminOS and the MonkeyC VM, 9 with CVEs, that let Connect IQ apps escape the VM and bypass permissions on 100+ Garmin watches.
411
Put an io_uring on it – Exploiting the Linux Kernel (2022)
Put an io_uring on it - Exploiting the Linux Kernel - chompie at the bits
412
How do you know when macOS detects and remediates malware?
macOS may alert you when you’re trying to open or run a file, with an alert informing you that malware was detected. But what about in scans?
413
Unix shells are generally not viable access control mechanisms any more
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
414
Official Warning: Zero3K
You are seeing this because the administrator of this website has set up Anubis to protect the server against the scourge of AI companies aggressively scraping websites . This can and does cause downtime for the websites, which makes their resources inaccessible for everyone.
415
Was there a U.S. nuclear weapons accident at a Dutch air base?
A photo in a Los Alamos National Laboratory (LANL) student briefing from 2022 shows four people inspecting what appears to be a damaged B61 nuclear bomb.
416
KeePassXC Audit Report
KeePassXC Password Manager
417
418
Yes, Android 14 still allows modification of system certificates
Tim Perry recently claimed in an article that “Android 14 blocks all modification of system certificates, even as root”. This sparked significant discussion on Hacker News. Thankfully my tests show that it is still possible to adjust the system certificate store in Android 14.
419
420
How to date a recording using background electrical noise
Three men were accused of selling firearms to South London gangs. At their 2012 trial in Croydon Crown Court, the prosecution played the jury a recording, taken undercover, of the trio allegedly arranging a sale. But the men’s lawyers claimed that the recording was a fake, and that the police had fabricated it by…