Supply chain security is a hot topic today, but it is a very old problem. In October 1983, 40 years ago this week, Ken Thompson chose supply chain security as the topic for his Turing award lecture, although the specific term wasn’t used back then. (The field of computer science was still young and small enough that…
Elliptic curves are standardized, instead of being generated like Diffie-Hellman parameters. There's good reasons!
ESET researchers are the first to publish an analysis of BlackLotus, the first in-the-wild UEFI bootkit capable of bypassing UEFI Secure Boot.
Unfortunately, in the tech sector, just like many other sectors, there are scammers around. When you are dealing with electronics this is typically in the form of chips that have had their markings…
The first in a series of posts on the Post Office Horizon prosecutions scandal
Online privacy isn't just about a VPN. That’s why we have developed the Mullvad Browser.
How to modernize C arrays for greater memory safety: a case-study in refactoring the Linux kernel and a look to the future Kees Cook C i...
Standard-class Gen5 navigation
Editor’s note: based on industry research (from Chrome and others), and the ubiquity of HTTPS, we will be replacing the lock icon in Chrome’...
Let me tell you a story about how Windows users are deleting files from their installation and as a consequence end up in tears. Background The real and actual curl tool has been shipped as part of Windows 10 and Windows 11 for many years already. It is called curl.exe and is located in the … Continue reading deleting…
Poll: the 80% would not feel comfortable being politically active or exploring their sexuality if authorities can monitor their communication.
This paper reflects work done in late 2022 and 2023 to audit for vulnerabilities in terminal emulators, with a focus on open source software. The results of this work were 10 CVEs against terminal emulators that could result in Remote Code Execution (RCE), in addition various other bugs and hardening opportunities…
Read about the latest performance boosts, disabling Intel ME, Windows 11 support, and more!
This is a mirror of the original about:intel post, since the about:intel server is sadly sometimes overloaded. Also do read the opposing view from Jan-Jaap Oerlemans and the reflection by Lotte Houwing The Dutch government is proposing adding a lex specialis to its existing intelligence and security services act. This…
I received 3 DMCA takedown emails today, covering 7350 URLs on my hardbin.com IPFS gateway. The URLs were allegedly serving infringing copies of books. The strange part is that of those 7350 URLs, during the time for which I have nginx logs, none of them have ever been accessed , and of the ones that I checked, none…
A weblog about Signals Intelligence, Communications Security and top level telecommunications equipment
Today we seem to be living through a war on passwords. This is manifested in various ways; in its most passive form, it takes the form of people blogging about how passwords are bad. The more material changes are the general trend towards no longer treating passwords as a sufficient condition for access in favour of…
CVE-2023-38408 is a remote code execution flaw in OpenSSH’s forwarded ssh-agent. Get full exploit details, impact analysis, and Qualys detection guidance.
Websites in South Korea often require installation of “security applications.” Not only do these mandatory applications not help security, way too often they introduce issues.
Tailscale ditches passwords for passkeys, offering a secure, phishing-resistant, and convenient way to authenticate. Learn how passkeys work, why they’re better than passwords, and how to set them up on your tailnet.
My personal site has zero pages indexed by DuckDuckGo and Bing and even searches for my URL return zero results. This post is a description of the problem and the start of my journey to fix it.
I found myself going down a previously unexplored rabbit hole recently, or more specifically, what I thought was "a" rabbit hole but in actual fact was an ever-expanding series of them that led me to what I refer to in the title of this post as "6 rabbits deep"
While we were visiting the University of Maryland, we came across a fleet of electric scooters scattered across the campus and couldn't resist poking at the scooter's mobile app. To our surprise, our actions caused the horns and headlights on all of the scooters to turn on and stay on for 15 minutes straight.
Police are already using self-driving car footage as video evidence: While security cameras are commonplace in American cities, self-driving cars represent a new level of access for law enforcement and a new method for encroachment on privacy, advocates say. Crisscrossing the city on their routes, self-driving cars…
ARLINGTON, Va.—A new cert petition before the United States Supreme Court asks the Justices to strike down an immunity recognized by a lower court for […]
By: Arnar Birgisson and Diana K Smetters, Identity Ecosystems and Google Account Security and Safety teams Starting today , you can create a...
Assured AB were contracted to perform a security assessment of our account and payment services between 2022-11-07 and 2022-11-29.
Update: Open source OSes might be saved from being covered depending on the interpretation of EU regulation 2019/1150 2.2.c.
