Search

Items tagged with: security

Another one back-to-back! Accrescent 0.22.0 is released to ensure Accrescent can always update itself, add a theme option to settings, and fix a bug related to preferred languages: github.com/accrescent/accresce…

#security #android #appstore #privacy #accrescent


Release 0.22.0 · accrescent/accrescent

This release ensures Accrescent can always update itself, adds a setting to manually change the app theme (light, dark, or system), and fixes an issue where app's wouldn't be installed in the user'...
GitHub
#android #privacy #security #AppStore #accrescent

🎉 Wohoo! We have officially reached 90K followers on X - and we already have more then 26K here! 🎉

A BIG thank you to all our loyal Tuta users. You make our fight for #privacy and #security worth it ❤️

If you're new here, get your #FREE Tuta Mail account now: app.tuta.com/signup

Screenshot of Tuta's X profile showing 90.1 K followers.
#free #privacy #security

Blind writer tries the Gandalf | Lakera prompt injection game for the first time.

Upon recommendations, I tried this AI prompt injection game for the first time. I made it to level 7 with no help from the internet!

If you want to donate to me, donate to me on this page.

My website is here where I usually blog. I'm not much of a video person, so I blog and write more than I do video!

Gandalf | Lakera – Test your AI hacking skills

Trick Gandalf into revealing information and experience the limitations of large language models firsthand.
gandalf.lakera.ai
#security #AI #computers #llm #Prompt Injection

#android #privacy #security #AppStore #accrescent

#foss #security #testing #nvda #alpha #prerelease #certificate

2/3 When the warning appears, press tab to "More info", then press enter. Reading through the dialog, note that the publisher is listed as:

"AU, Queensland, Camp Mountain, NV Access Limited, NV Access Limited"

To allow NVDA to run, press tab to "Run anyway", and press enter to run the snapshot. This will help us get through this period until Windows considers our certificate "trusted":

#NVDA #FOSS #Alpha #testing #Prerelease #Certificate #Security

Turquoise screen with the right half of the message from the previous post, after activating "More info". Text reads: ...ur PC ...an unrecognised app from starting. Running this app ...05f9bfa.exe ...ain, NV Access Limited, NV Access Limited. Buttons below read "Run anyway" (Focussed) and "Don't run"
#foss #security #testing #nvda #alpha #prerelease #certificate

ID Verification Service for #TikTok, #Uber, X Exposed Driver Licenses

In this case, the ID verification vendor leaked admin credentials and exposed people’s information (sensitive documents and status of verification) for over a year.

All for “age verification” we introduce another EZ mode way for people’s real life identities to be compromised. Companies want you to provide sensitive documents to prove you’re real/your age but can’t be bothered to invest money/time/effort in basic #security to secure what you give them.

#cybersecurity #privacy

404media.co/id-verification-se…


ID Verification Service for TikTok, Uber, X Exposed Driver Licenses

As social networks and porn sites move towards a verified identity model, the actions of one cybersecurity researcher show that ID verification services themselves could get hacked too.
Joseph Cox (404 Media)
#privacy #security #cybersecurity #tiktok #uber

#Windows 11 is now automatically enabling #OneDrive folder backup without asking permission

"Quietly and without any announcement, the company [#Microsoft] changed Windows 11's initial setup so that it could turn on the automatic folder backup without asking for it."

Imagine your operating system forcing all your desktop files to sync to the cloud, without letting you know it would do that. Users should be aware of when their files are synced to any cloud.

Oh wait, I forgot... Microsoft has zero regard for user choice, #privacy, and #security.

#privacymatters

neowin.net/news/windows-11-is-…


Windows 11 is now automatically enabling OneDrive folder backup without asking permission

Microsoft quietly changed how folder backup works in the OneDrive app on Windows 11. Now, the OS enables it by default during the initial setup without asking the user for permission.
Taras Buria (Neowin)
#onedrive #privacy #Windows #security #microsoft #privacymatters

"for the first time, Commissioner Jourova publicly admitted at yesterday's EDPS summit that encryption would need to be broken for Chat Control to become effective."
— tuta.com/blog/interview-patric…

#ChatControl #EuropeanCommission #Surveillance #EU #Privacy #HumanRights #Encryption #Security


Europe and Australia will both not break encryption! We’ve interviewed Patrick Breyer – the guy who coined the term Chat Control.

Action taken by privacy activists and citizens stops the push for mass surveillance.
Tutanota
#privacy #encryption #security #EU #HumanRights #surveillance #europeancommission #chatcontrol

Privacy is a marathon, not a sprint. 🏃

What are the next steps you will be taking in your #privacy and #security journey?

Let us know in the comments!

A question mark painted onto a brick wall. (Photo by Matt Walsh on Unsplash)
#privacy #security

Patrick Breyer fordert zum Widerstand gegen die Chatkontrolle auf und gibt Tipps, wie sich jeder Einzelne aktiv beteiligen kann. Werdet JETZT aktiv, sonst kann es sein, dass die Unvernunft siegt. 👇

patrick-breyer.de/rat-soll-cha…

#chatkontrolle #ChatkontrolleStoppen #sicherheit #security #datenschutz #privacy


Rat soll Chatkontrolle durchwinken - Werde jetzt aktiv!

Der belgische Vorsitz im Rat der EU will die Chatkontrolle am Mittwoch den 19. Juni abstimmen lassen. Damit bestätigen sich die Befürchtungen: die Verfechter der Chatkontrolle wollen ausnutzen, dass es nach den Wahlen weniger öffentliche Aufmerksamke…
Patrick Breyer
#privacy #datenschutz #security #Chatkontrolle #sicherheit #ChatkontrolleStoppen

#security #dns #Internet #dnssec

This episode of the Security, Cryptography, Whatever podcast offers insight into the history of Transport Layer Security (TLS), and critical discussion of certificate transparency, DNSSec, and other protocols. Post-quantum cryptography is also considered.
securitycryptographywhatever.c…
#Security #CryptographicProtocols

ekr

iykyk Links: https://hovav.net/ucsd/dist/draft-shacham-tls-fasttrack-00.txt https://crypto.stanford.edu/~dabo/pubs/papers/fasttrack.pdf https://datat...
securitycryptographywhatever.com
#security #cryptographicprotocols

Is it just me, or has Microsoft gone completely crazy? They are implementing spyware that takes screenshots every second and forcing AI integration. Why would anyone willingly purchase this? Anyone with experience in computer or information security knows that it is a bad idea, even if it is locally done. Just don't do it. Yet, here we are, and they are doubling down on this idea. arstechnica.com/gadgets/2024/0… #privacy #security
Literal definition of spyware: New Windows AI feature records everything you’ve done on your PC. Recall uses AI features "to take images of your active screen every few seconds. https://arstechnica.com/gadgets/2024/05/microsofts-new-recall-feature-will-record-everything-you-do-on-your-pc/

New Windows AI feature records everything you’ve done on your PC

Recall uses AI features "to take images of your active screen every few seconds."
Ars Technica
#privacy #security

#security #dns

#Android is getting an AI-powered #scam call detection feature

Will be powered by Gemini Nano, which #Google says can be run locally and offline to process "fraudulent language and other conversation patterns typically associated with scams" and push real-time alerts during calls where detected red flags are present.

It will be opt-in, but Gemini Nano is currently only supported on Google Pixel 8 Pro and Samsung S24 series devices.

#cybersecurity #security

theverge.com/2024/5/14/2415621…


Android is getting an AI-powered scam call detection feature

Google is testing a new call monitoring feature that warns users if the person they’re talking to is likely attempting to scam them and encourages them to end such calls.
Jess Weatherbed (The Verge)
#android #google #security #cybersecurity #scam

Der Messenger #Telegram ist für eine sichere Kommunikation nicht geeignet - standardmäßig sind die Nachrichten nicht einmal Ende-zu-Ende verschlüsselt. Besser geeignet sind #Signal oder #Threema. Übrigens: Elon Musk ist das Paradebeispiel eines Trolls. Einfach ignorieren. 😉

Wer eine Entscheidungshilfe für einen Messenger sucht: messenger-matrix.de/messenger-…

#sicherheit #security #schwachstelle #e2ee #vulnerabilty #musk #durow

Messenger-Matrix • Kuketz IT-Security Blog

Gegenüberstellung sicherheits- und datenschutzrelevanter Eigenschaften von Messengern
www.messenger-matrix.de
#signal #telegram #security #threema #musk #sicherheit #e2ee #schwachstelle #vulnerabilty #durow

TPM2-measured boot with bus protection is pretty nice actually for Linux installations where secure boot is not enabled, like the default Arch Linux installation for instance.

For the sake of "defence in depth", I'd enable both if it is out-of-the-box feature but would not probably bother with secure boot if it requires extra work.

So, the takeaway from this is that it would make a lot of sense to make measured boot happen in arch-install installation as opt-in feature. No Microsoft key required.

Still so far the most informative overview for the shenanigans is microos.opensuse.org/blog/2023… but I'd also look for more recent references.

Policy hash calculation per kernel package update for LUKS2 is what needs to happen over time whenever a new kernel package is installed with hooks/scripts.

So the thing that was hyped to DRM the world into a locked down hellhole rendered out the Microsoft key hard binding instead 🤷

#tpm #linux #archlinux #opensuse #secureboot #security


Systemd-boot and Full Disk Encryption with TPM and FIDO2

Systemd-boot and Full Disk Encryption in Tumbleweed and MicroOS
openSUSE MicroOS
#linux #security #opensuse #archlinux #secureBoot #tpm

#android #linux #privacy #Windows #ios #security #MACOS #sneakpeek #teaser

Those changes are currently only applied to the master branch and didn't yet go to any release or distribution packages. They were supposed to fix a #security issue, but not to break some binary repos, which is what the applied patches might do. Find the originally proposed and recommended patches at github.com/obfusk/fdroid-fakes… – and also see e.g. tech.lgbt/@obfusk/112306314357… for some additional background.

Fay 🏳️‍🌈

2024-04-21 00:12:41


I just posted an update to my "PoC for fdroidserver AllowedAPKSigningKeys certificate pinning bypass" post to oss-security:

openwall.com/lists/oss-securit…

Original post:

openwall.com/lists/oss-securit…

GitHub repo with patches, PoCs, and a script to scan for potentially affected APKs:

github.com/obfusk/fdroid-fakes…



GitHub - obfusk/fdroid-fakesigner-poc: F-Droid Fake Signer PoC

F-Droid Fake Signer PoC. Contribute to obfusk/fdroid-fakesigner-poc development by creating an account on GitHub.
GitHub

#security

#foss #opensource #technology #security

#security #glib @Philip Withnall

#linux #debian #security

#security #toegankelijkheid #digitaleoverheid #digitaleinclusie

#security #web #indieWeb

#android #privacy #security #AppStore #accrescent

Should you have noticed a short "absence" of the #IzzyOnDroid primary web server, that was probably the reboot…

A CVE was published to oss-sec 5 days ago and got its fixes available today (security-tracker.debian.org/tr…), so it was applied immediately as the vuln would have affected some components here.

My thanks here once more goes to @obfusk for bringing it to my attention – and to my service provider who swiftly applied the updates within just minutes 🤩

#security

CVE-2024-2961

security-tracker.debian.org
#security #izzyondroid @Fay 🏳️‍🌈

#matrix #element #encryption #security #IT #decentralized #federated #un

#security #IzzySoftRepo #izzyondroid

#security #MACOS #curl

T-Mobile Employees Across The Country Receive Cash Offers To Illegally Swap SIMs

I still stand by this: if #sms #mfa wasn’t still massively used (especially by the financial sector), sim swaps would be less attractive to sim swappers.

It’s also crazy so much trust is placed in telecoms guarding your phone number and MFA factor for your bank. 🫨

#security #cybersecurity #simswap

tmo.report/2024/04/t-mobile-em…


T-Mobile Employees Across The Country Receive Cash Offers To Illegally Swap SIMs

T-Mobile employees, both third-party and corporate, are receiving cash offers via text to complete SIM swaps for criminals.
Jman100 (The Mobile Report)
#security #sms #cybersecurity #mfa #simswap

#curl sometimes fails to access some servers. In most situations the problem is not in curl itself but on the server side. Example:

1. Fails: curl radissonhotels.com

2. Works: curl -A 'Mozilla/5.0 xx Chrome/119' radissonhotels.com

3. Fails: curl -A 'Mozilla/5.0 xx Chrome/118' radissonhotels.com

4. Fails, too: curl -A 'Mozilla/5.0 xx Chrome/1189' radissonhotels.com

Perhaps they perform #filtering to obtain improved #security? It's hard to tell, but any serious attacker surely knows how to spoof the user agent string and bypass such simple #regex

#security #RegEx #curl #filtering

#security @Bart Busschots

Time for another release... Accrescent 0.19.0 is out! While not much has changed on the surface, Accrescent now uses our new server infrastructure which brings faster downloads to everyone!

Read the release notes or download below 👇

github.com/accrescent/accresce…

#accrescent #security #privacy #appstore #android


Release 0.19.0 · accrescent/accrescent

This release marks the migration of Accrescent's servers to a more scalable setup. From this version on, Accrescent will connect to the new servers. Earlier versions of Accrescent will automaticall...
GitHub
#android #privacy #security #AppStore #accrescent

Hey! Let's talk about #SSH and #security!

If you've ever looked at SSH server logs you know what I'm about to say: Any SSH server connected to the public Internet is getting bombarded by constant attempts to log in. Not just a few of them. A *lot* of them. Sometimes even dozens per second. And this problem is not going away; it is, in fact, getting worse. And attackers' behavior is changing.

The graph attached to this post shows the number of attempted SSH logins per day to one of @cloudlab s clusters over a four-year period. It peaks at about 3.4 million login attempts per day.

This is part of a study we did on our production system, using logs of more than 640 million login attempts, covering more than 1,500 hosts on our side and observing more than 840 thousand incoming IP addresses.

A paper presenting our analysis and a new, highly effective means to block SSH brute force attacks ("Where The Wild Things Are: Brute-Force SSH Attacks In The Wild And How To Stop Them") will be presented next week at #NSDI24 by @sachindhke . The full paper is at flux.utah.edu/paper/singh-nsdi…

Let's dive in. 🧵

A graph of SSH login attempts per day, in millions. On the Y axis, the graph starts in October 2017 at around 0.25M attempts per day. The day-to-day numbers are very noisy, but a trend line shows that the average number of attacks per day rises to around 1.0M around January 2021, with a slight fall-off before the graph ends in August 2021.

Where The Wild Things Are: Brute-Force SSH Attacks In The Wild And How To Stop Them : Flux Research Group

www.flux.utah.edu
#security #ssh #nsdi24 @CloudLab @Sachin Kumar Singh

2 days ago I reported about a #security patch having been applied to the IzzyOnDroid F-Droid repo aka #IzzySoftRepo – but I didn't give much details. After it was tested now at the IoD test & staging area, and running smoothly for two days for the public one, I reported back to its author @obfusk that all seems smooth, and she decided to make POC & patch public. You can find the full details at github.com/obfusk/fdroid-fakes… & openwall.com/lists/oss-securit… now. @fdroidorg @eighthave be welcome using it!

1/2


GitHub - obfusk/fdroid-fakesigner-poc: F-Droid Fake Signer PoC

F-Droid Fake Signer PoC. Contribute to obfusk/fdroid-fakesigner-poc development by creating an account on GitHub.
GitHub
#security #IzzySoftRepo @Hans-Christoph Steiner @F-Droid @Fay 🏳️‍🌈

FreeBSD Foundation and Digital Security by Design (DSbD)

<globenewswire.com/news-release…>

❝… CHERI and CheriBSD, developed to revolutionize hardware-based protection against memory safety vulnerabilities, were developed by a collaboration from researchers from the University of Cambridge, alongside corporate partners such as Google, Microsoft, Arm, and SRI International, and with support from the UK government. …❞

#FreeBSD #ARM #security


FreeBSD Foundation and Digital Security by Design (DSbD) Announce Beacon Award Winners for Innovations and Improvements to CheriBSD

Winning Projects Highlight CheriBSD's Role in Advancing Digital Security...
FreeBSD Foundation
#security #arm #freebsd

I am getting tired of reading about the #xz #security issue as if it is all about issues within #opensource. It is much bigger than that, and those takes conflate the problem with the solution.

So I wrote "The xz issue isn't about Open Source" here: changelog.complete.org/archive…


The xz Issue Isn’t About Open Source

You’ve probably heard of the recent backdoor in xz. There have been a lot of takes on this, most of them boiling down to some version of: The problem here is with Open Source Software. I want…
The Changelog
#opensource #security #xz

#security #AI #machinelearning

#linux #security #xz

⇧