Search
Items tagged with: security
Lauschangriff auf russischen Jabber-Server in Deutschland: Wer steckt dahinter?
Rein zufällig flog auf, dass sich Unbekannte mit einem eigenen Zertifikat in Jabber-Chat-Verbindungen einklinkten. Die Betreiber vermuten eine Polizeiaktion.
heise.de/news/Lauschangriff-au…
#Jabber #Let'sEncrypt #ManintheMiddle #Security #XMPP
Historic agreement on #ChatControl: European Parliament wants to safeguard secure encryption | European Pirate Party
This week, the European Parliament's negotiators reached a broad majority agreement on a common position concerning the controversial EU chat control bill.nriss (European Pirate Party)
#XSF Announcement
Recently there was an incident via a so called #man_in_the_middle attack happened to an #XMPP #server.
To reduce the risk of such attacks in the future an early stage service called CertWatch has been published by our Community: certwatch.xmpp.net/
Many thanks to Stephen P. Weber (@singpolyma)!
Read two related blog posts:
blog.jmp.chat/b/certwatch/cert…
snikket.org/blog/on-the-jabber…
#Jabber #mitm #security #vulnerability #machine_in_the_middle #chat
On the jabber.ru MITM attack
Reports of a possible recent interception of the public XMPP service jabber.ru have raised a lot of questions for people about how the attack happened, and whether it could affect them too. We have some answers.snikket.org
Free and Open Source Software is the backbone of the internet. 💪 That's why we are offering 100% free premium subscriptions to open source projects. 🎉
It's our gift from one open source project to another. 🎁
tutanota.com/blog/tutanota-for…
#FOSS #opensource #privacy #security #internet
Tutanota for Open Source Projects.
Giving back to open source teams with free Tutanota accounts.Tutanota
#security #Software
New-ish Asus routers seem to enable "Yandex.DNS" by default. This forwards all of your DNS lookups to Yandex, a large Russian search engine. I discovered this on my dad's router when he had troubles accessing his bank from his broadband but not on his phone. (Presumably, the bank geoblocked Russian IPs as a protest to the invasion of Ukraine.)
I get that you need to trust someone with your DNS lookups (your ISP, Google, Cloudfare, etc), but I didn't expect the non-ISP option to be the default...
Check your router!
Some exciting news: Over the past few months I have been working on founding a new organization: Blodeuwedd Labs (@blodeuweddlabs)
We are now in a position to offer subsidized security assessments (and other services) for open source projects.
(In addition to a whole array of analysis, development, and custom research offerings for everyone else)
Announcement (and more info): blodeuweddlabs.com/news/open-s…
#infosec #security #appsec #canada #opensource
Launching our Open Source Review Scheme | Blodeuwedd Labs
To celebrate the founding of Blodeuwedd Labs we are excited to announce Subsidized Assessments for open source projects as part of our commitment to continually give back to the open source Community.blodeuweddlabs.com
We're happy that #Apple has now joined the fight for encryption! 🔒
There is no magic key that allows the police to scan all chat messages, emails, and more for harmful content while not risking the security and privacy of everyone. This is technically not possible.
The more agree to this fact, the higher the chances that legislation is altered to protect everybody's privacy.
bbc.com/news/technology-660287…
#privacy #security #onlinesafetybill #chatkontrolle
Apple joins opposition to encrypted message app scanning
WhatsApp and iMessage could be forced to scan for child abuse images under the Online Safety Bill.By Chris Vallance (BBC News)
Mozilla: "In a well-intentioned yet dangerous move to fight online fraud, France is on the verge of forcing browsers to create a dystopian technical capability. It would force browser providers to create the means to mandatorily block websites present on a government provided list. Such a move will overturn decades of established content moderation norms and provide a playbook for authoritarian governments"
blog.mozilla.org/netpolicy/202…
#france #browser #cybersecurity #mozilla #security #surveillance
France’s browser-based website blocking proposal will set a disastrous precedent for the open internet - Open Policy & Advocacy
Article 3 (para II and III) of the SREN Bill would force providers to create the means to mandatorily block websites on a government provided list encoded into the browser.Udbhav Tiwari (Open Policy & Advocacy)
If you're using #bitwarden, make sure to change the KDF algorithm to Argon2id[^1] which is much more robust against GPU-powered attacks compared to its counterpart.
You can play around with this little calculator to see the impact of each algorithm on cracking cost estimation: passwordbits.com/passphrase-cr…
[^1]: bitwarden.com/help/what-encryp…
Encryption | Bitwarden Help Center
Learn how Bitwarden salts and hashes password Vault data before sending it to the Cloud for secure storage.Bitwarden
Interesting: ProtonMail finally admits that Germany "is a good choice given Germany’s strong privacy laws and culture that make it almost as strong as Switzerland."
For once, we couldn't agree more. 😀
We'd even argue Germany is much better as we do not have data retention laws (which would be against the German constitution) - while in Switzerland large tech companies are forced by law to retain data: tutanota.com/blog/posts/data-r…
Germany: Data retention to be abolished once and for all.
According to the German Minister of Justice data retention or "the storage of telecommunications data without any reason" could soon come to an end.Tutanota
✅ Staff able to watch customers in the bathroom?
✅ Obviously shabby infosec?
✅ Training AI as an excuse for data retention?
🕵🏽 No surprise here: "#Amazon Ring, Alexa accused of every nightmare #IoT #security fail you can imagine" #privacy
theregister.com/2023/06/01/ftc…
Amazon Ring, Alexa accused of every nightmare IoT security fail you can imagine
Staff able to watch customers in the bathroom? Tick! Obviously shabby infosec? Tick! Training AI as an excuse for data retention? Tick!Simon Sharwood (The Register)
Earlier this year we got into a surprising and somewhat annoying struggle with Web browser sandboxing failures related to our "web apps shared in a chat" feature. After much background work we released the hardened Delta Chat 1.36 series, also addressing a dedicated fourth independent security audit, and can finally share more of what was going on behind the scenes delta.chat/en/2023-05-22-webxd…
#chromium #deltachat #security #webxdc
Delta Chat: Bringing E2E privacy to the Web: 4th security audit 😅
Delta Chat’s “web apps shared in a chat” come with a unique privacy promise but in January it was shown to be compromised. We got into a surprising struggle with Web browser sandboxing issues that ...delta.chat
Journalists, whistleblowers, activists - they all risk their lives to make the truth public.
Let's fight for the right to #privacy and #pressfreedom.
Together with #Threema, #Tor #FightfortheFuture and others we call on policymakers to not undermine #encryption.
We ALL depend on encryption for #security and #privacy! 💪🔒
Read more: tutanota.com/blog/posts/press-…
Press Freedom Day: 40+ organizations call on world leaders to uphold encryption & privacy
On Press Freedom Day a coalition of 40+ ogrs have united to defend strong encryption.Tutanota
New article: "Overview of Flatpak's Permission Models"
theevilskeleton.gitlab.io/2023…
Huge thanks to @orowith2os for proofreading the article :)
#Flatpak #Linux #GNU #Security #FOSS #OpenSource
Overview of Flatpak’s Permission Models
Flatpak’s permissions can be confusing. Some are technical and need knowledge on how they work, and others are self-explanatory.TheEvilSkeleton
2FA-Secrets offengelegt: Google Authenticator bläst geheime Daten in den Äther
tarnkappe.info/artikel/it-sich…
Wer den also mit Account Sync verwendet (hat), sollte dringend handeln.
2FA-Secrets geleakt: Google Authenticator ist nicht ganz dicht
2FA, eine der wichtigsten Apps für die Sicherheit der eigenen Online-Welt hat offenbar Probleme den zweiten Faktor geheim zu halten.Moritz Poldrack (Tarnkappe.info)
Google has just updated its 2FA Authenticator app and added a much-needed feature: the ability to sync secrets across devices.
TL;DR: Don't turn it on.
The new update allows users to sign in with their Google Account and sync 2FA secrets across their iOS and Android devices.
We analyzed the network traffic when the app syncs the secrets, and it turns out the traffic is not end-to-end encrypted. As shown in the screenshots, this means that Google can see the secrets, likely even while they’re stored on their servers. There is no option to add a passphrase to protect the secrets, to make them accessible only by the user.
Why is this bad?
Every 2FA QR code contains a secret, or a seed, that’s used to generate the one-time codes. If someone else knows the secret, they can generate the same one-time codes and defeat 2FA protections. So, if there’s ever a data breach or if someone obtains access .... 🧵
#Privacy #Cybersecurity #InfoSec #2FA #Google #Security
Passt ja zu meiner Custom-ROM-Serie: "Smartphones mit verbreitetem Qualcomm-Chip senden heimlich private Informationen an US-Chiphersteller" 👇🤦
#android #security #qualcomm #backdoor #tracking #privacy #sicherheit #datenschutz
Did you ever wonder how Tutanota's encryption is able to protect all your data? Check out our new encryption page with lots of interesting facts! 🔒😍
We ♥️ #encryption!
#security #privacy #email #data
Everything you need to know about Tutanota's encryption.
Details on how the encrypted email & calendar service Tutanota encrypts all data.Tutanota
The encrypted Tutanota mailbox makes sure your data belongs to you, and to you alone! 😎🔒
Make sure your friends enjoy the same level of privacy. Invite them to Tutanota! 🤩
👉 tutanota.com/blog/posts/refer-…
#privacy #security #Encryption
Security for all: Recommend Tutanota to your friends! 🎉
Tutanota has launched a refer-a-friend program so that you can both benefit.Tutanota
In-Process 6th April 2023
The big news this time around is the release of NVDA 2023.1! But there’s plenty more exclusive news below so let’s get into it: NVDA 2023.1 It’s new release time! NVDA 2023.1 is n…NV Access
Whole Foods, owned by Amazon, now has biometric handprint scanning to pay for your groceries.
When I expressed my concern, the feller behind the counter said, “It’s just like the biometric scanner on your phone…”
“Um, no, it’s not,” I replied. “Because THAT biometric data is on MY device, not yours.”
He shrugged in response.
I don’t advise you to go this route, friends. Not until there are more legal standards and protections in place to protect consumers.
Security is the major reason why software updates are important. The LastPass breach demonstrates this dramatically.
If you search the web for why software updates are important, you will get loads of results that say there are "3 or 5 reasons why software updates are important". While this may be correct, there is only one major reason why you must keep your software up to date: Security.
Stay secure, update your systems! 😎💪🔒
bleepingcomputer.com/news/secu…
Critical Microsoft Outlook bug PoC shows how easy it is to exploit
Security researchers have shared technical details for exploiting a critical Microsoft Outlook vulnerability for Windows (CVE-2023-23397) that allows hackers to remotely steal hashed passwords by simply receiving an email.Ionut Ilascu (BleepingComputer)
Microsoft Authenticator prompts the user to accept sharing analytics during the first launch. The prompt only dismisses when the user taps on "Accept." In fact, the app starts sending analytics even before accepting the privacy statement.🤦♂️
In this video, we downloaded the authenticator app from the App Store and we opened it as we monitored the iPhone network traffic. While the app was showing the permission prompt, we captured at least 3 calls made by the app sending diagnostics to Microsoft. The app sent 14 KB of analytics even before accepting the prompt.
The message on the prompt actually says that Microsoft needs to collect diagnostic data in order to keep Authenticator secure and up to date. 😵💫
#Privacy #Cybersecurity #2FA #InfoSec #Security #Microsoft
Privacy: Microsoft Authenticator sends analytics even before accepting the privacy statement
When opening Microsoft Authenticator for the first time after downloading it from the App Store, it prompts the user to accept sharing diagnostics with Micro...YouTube
Der Werbe- und Trackingblocker #Blokada entwickelt sich immer mehr zu einer kommerziellen Lösung. Von einer weiteren Verwendung ist abzuraten. Nutzt besser die Alternative #AdAway. 👇
kuketz-blog.de/adaway-werbe-un…
Hinweis: Habe Blokada aus der Empfehlungsecke entfernt.
#tracking #datenschutz #dsgvo #ttdsg #sicherheit #security #privacy
AdAway: Werbe- und trackingfrei im Android-Universum
AdAway kann der Auslieferung von (schädlicher) Werbung und dem Abfluss von persönlichen Daten an zweifelhafte Anbieter einen Riegel vorschieben.Kuketz IT-Security Blog
Today I learned that when you "edit" or "correct" a message in #XMPP, the original message is still technically stored on the server or device. It's the client side that understands that the new message is an edit of the previous message, and "displays" it as such. But, if you send a password or something sensitive, "editing" the message after it has been sent might not remove the actual contents of the original version of the message, so make sure you use #encryption too.
Portmaster, eine Art Firewall zur Kontrolle des ausgehenden Datenverkehrs, ist nicht mehr Alpha, sondern in der Version 1.0.7 für Windows, Debian/Ubuntu und Fedora verfügbar. Gerade für Windows-Nutzer interessant, die Microsofts Schnüffelei eindämmen wollen.
#security #privacy #firewall #sicherheit #datenschutz #windows
Safing Portmaster - Easy Privacy
Portmaster is a free and open-source application that puts you back in charge over all your computer's network connections. Increase your privacy and security. Get peace of mind.safing.io
A #opensource #backup solution on your #Android device for your #data #security, distributet over @IzzyOnDroid on @fdroidorg:
📱 Android-DataBackup
github.com/XayahSuSuSu/Android…
Android-DataBackup/README_EN.md at main · XayahSuSuSu/Android-DataBackup
数据备份 DataBackup for Android. Contribute to XayahSuSuSu/Android-DataBackup development by creating an account on GitHub.GitHub
Happy #DataPrivacyDay! 🥳
Here are some privacy-first apps frequently recommended by the Tutanota community.
What are your favorite apps to quit #BigTech?
#DataProtection #Encryption #Security #Privacy
Going dark: Is encryption a threat to our security? The Swedish EU Council says yes.
But we say: Stop the #CryptoWars. Destroying everybody's #privacy will not increase #security.
Read here why: 👇
tutanota.com/blog/posts/going-…
Going dark: Is encryption a threat to our security? The Swedish EU Council says yes.
Politicians often warn that criminals are 'going dark'. This warning is used like the argument to 'protect the children': to undermine encryption.Tutanota
Have you heard about #ReproducibleBuilds? This is one of the biggest #security benefits of #FOSS. On #Android, this technique ensures that the #FDroid version of an app exactly matches the developer's version.
Read our article below for more details and to see how easy it is for developers to get set up:
f-droid.org/en/2023/01/15/towa…
Towards a reproducible F-Droid | F-Droid - Free and Open Source Android App Repository
A common criticism directed at F-Droid is that F-Droid signs published APKswith its own keys. Using our own keys doesn’t mean insecure — we have a goodtrack ...f-droid.org