31
Apple and Google deliver support for unwanted tracking alerts in iOS and Android
Apple and Google have teamed up to deliver support for unwanted Bluetooth tracking alerts in iOS and Android.
32
OAuth from First Principles
I've wanted to write a blog post for everyone who learns things the same way that I do; by trying to break them. I'll start off with an awfully flawed implementation that authorizes a user with a 3...
33
Review of Mullvad VPN
X41 releases the audit report of Mullvad VPN
34
USPS text scammers duped his wife, so he hacked their operation
How someone I don't know hacked the scammers back
35
Over the edge: The use of design tactics to undermine browser choice
In order to be able to choose their own browser, people must be free to download it, easily set it to default and to continue using it - all without ...
36
Attackers can decloak routing-based VPNs
We discovered a fundamental design problem in VPNs and we're calling it TunnelVision. This problem lets someone see what you're doing online, even if you think you're safely using a VPN.
37
Winding down Google Sync and Less Secure Apps support
MDM push of password based IMAP, CalDAV, CardDAV, STMP, POP and Exchange ActiveSync (Google Sync) will no longer work for customers who try to connect to an LSA for the first time.
38
39
Going Dark: The war on encryption is on the rise
After Snowden’s whistleblowing in 2013, large parts of the internet became encrypted, enabling private and secure communication. Not everyone has welcomed this change. Most notably, the FBI and other U.S. government agencies have fought what is often called the “crypto wars”, the war on encryption. In recent years…
40
Meta unlawfully ignores the users' right to easily withdraw consent: complaint
If Instagram and Facebook users want to withdraw their consent, they have to buy an expensive subscription
41
OpenAI o1 system card
This report outlines the safety work carried out prior to releasing OpenAI o1 and o1-mini, including external red teaming and frontier risk evaluations according to our Preparedness Framework.
42
Microsoft technical breakdown of CrowdStrike incident
We examine the recent CrowdStrike outage and provide a technical overview of the root cause.
43
Intent to end OCSP service
Today we are announcing our intent to end Online Certificate Status Protocol (OCSP) support in favor of Certificate Revocation Lists (CRLs) as soon as possible. OCSP and CRLs are both mechanisms by which CAs can communicate certificate revocation information, but CRLs have significant advantages over OCSP. Let’s…
44
XZ backdoor story – Initial analysis
Kaspersky analysis of the backdoor recently found in XZ, which is used in many popular Linux distributions and in OpenSSH server process.
45
MacOS sometimes leaks traffic after system updates
We have found that you could be leaking traffic on macOS after system updates. To our current knowledge a reboot resolves it. We are currently investigating this and will follow up with more information.
46
Mitmproxy 11: Full HTTP/3 Support
We are excited to announce the release of mitmproxy 11, which introduces full support for HTTP/3 in both transparent and reverse proxy modes. We’re also bringing in a ton of DNS improvements that we’ll cover in this blog post.
47
Exploring Podman: A More Secure Docker Alternative
This article explore Podman's features and benefits, comparing it to Docker and describing a step-by-step migration guide
48
EFF’s concerns about the UN Cybercrime Convention
Update: This post has been updated to clarify the scope of the compelled assistance provisions and the broad nature of criminalization and electronic evidence gathering. The final version of the draft convention can still be used to expand the reach of repression under the pretext of combating...
49
Notepad++: Help us to take down the parasite website
I’ve received numerous complaints via email, social media, and forums regarding a website that poses a significant threat to our community. The copycat site in question is https://notepad.plus/ which appears prominently when users google for “download Notepad++”.
50
More Memory Safety for Let's Encrypt: Deploying ntpd-rs
When we look at the general security posture of Let’s Encrypt, one of the things that worries us most is how much of the operating system and network infrastructure is written in unsafe languages like C and C++. The CA software itself is written in memory safe Golang, but from our server operating systems to our…
51
Second factor SMS: Worse than its reputation
One-time passwords are often sent via SMS. Security researchers from the CCC recently had live access to over 200 million such SMS messages from more than 200 affected companies.
52
Kobold letters: HTML emails are a risk
Anyone who has had to deal with HTML emails on a technical level has probably reached the point where they wanted to quit their job or just set fire to all the mail clients due to their inconsistent implementations. But HTML emails are not just a source of frustration, they can also be a serious security risk.
53
Anonymous Source Shared Leaked Google Search API Documents
Update: We are diving deep into the Google API leak and what it means for marketers in our next episode of SparkToro Office Hours on June 27. Join Michael
54
FTC Report Confirms: Commercial Surveillance Is Out of Control
A new Federal Trade Commission (FTC) report confirms what EFF has been warning about for years: tech giants are widely harvesting and sharing your personal information to fuel their online behavioral advertising businesses.
55
Eliminating Memory Safety Vulnerabilities at the Source
Posted by Jeff Vander Stoep - Android team, and Alex Rebert - Security Foundations Memory safety vulnerabilities remain a pervasive threa...
56
ZenHammer: Rowhammer attacks on AMD Zen-based platforms
Our work shows that it is possible to trigger Rowhammer bit flips on DDR4 devices on AMD Zen 2 and Zen 3 systems despite deployed TRR mitigations. This result proves that AMD systems are equally vulnerable to Rowhammer as Intel systems , which greatly increases the attack surface, considering today’s AMD market share…
57
United States discloses nuclear warhead numbers; restores nuclear transparency
The Federation of American Scientists applauds the United States for declassifying the number of nuclear warheads in its military stockpile and the number of retired and dismantled warheads.
58
Bitwarden Heist – How to break into password vaults without using passwords
Sometimes, making particular security design decisions can have unexpected consequences. For security-critical software, such as password managers, this can easily lead to catastrophic failure: In this blog post, we show how Bitwarden’s Windows Hello …
59
Swift Homomorphic Encryption
We’re excited to announce a new open source Swift package for homomorphic encryption in Swift: swift-homomorphic-encryption.
60
Someone has been attempting to DDoS us for weeks and we do nothing
Someone has been attempting to DDoS us for weeks now. They have flooded our server with hundreds of millions of requests and attempted to download our setup…