Search

Items tagged with: security

european-pirateparty.eu/historโ€ฆ while I always believed that "Chat Control" as it was proposed would be dead on arrival, and unenforceable, it's always great to see common sense prevail. Some win for #privacy and #security of communications. The fight is far from over though.

Historic agreement on #ChatControl: European Parliament wants to safeguard secure encryption | European Pirate Party

This week, the European Parliament's negotiators reached a broad majority agreement on a common position concerning the controversial EU chat control bill.
nriss (European Pirate Party)
#privacy #security

#XSF Announcement

Recently there was an incident via a so called #man_in_the_middle attack happened to an #XMPP #server.

To reduce the risk of such attacks in the future an early stage service called CertWatch has been published by our Community: certwatch.xmpp.net/

Many thanks to Stephen P. Weber (@singpolyma)!

Read two related blog posts:
blog.jmp.chat/b/certwatch/certโ€ฆ

snikket.org/blog/on-the-jabberโ€ฆ

#Jabber #mitm #security #vulnerability #machine_in_the_middle #chat

CertWatch Logo

On the jabber.ru MITM attack

Reports of a possible recent interception of the public XMPP service jabber.ru have raised a lot of questions for people about how the attack happened, and whether it could affect them too. We have some answers.
snikket.org
#xmpp #security #Jabber #server #chat #vulnerability #xsf #mitm #man_in_the_middle #machine_in_the_middle @Stephen Paul Weber

#foss #opensource #privacy #security #Internet

@shawnhooper People believe they are the hero of their own story. So they believe they can solve problems, if only they had access to the data. However, this kind of power is easy to abuse. Instead people need to consider โ€œwhat if my enemy had this power over me?โ€ Would they still believe itโ€™s a good idea? i think not. This applies equally well to software as well as the law. The best thing we could do to protect everyone is build strong encryption into everything
#security #Software
#security #software @Shawn Hooper (he/him)

#privacy #security

New-ish Asus routers seem to enable "Yandex.DNS" by default. This forwards all of your DNS lookups to Yandex, a large Russian search engine. I discovered this on my dad's router when he had troubles accessing his bank from his broadband but not on his phone. (Presumably, the bank geoblocked Russian IPs as a protest to the invasion of Ukraine.)

I get that you need to trust someone with your DNS lookups (your ISP, Google, Cloudfare, etc), but I didn't expect the non-ISP option to be the default...

Check your router!

#security #privacy

Screenshot of the Asus router config web UI, showing a "Use Yandex.DNS" toggle switch.
#privacy #security

Some exciting news: Over the past few months I have been working on founding a new organization: Blodeuwedd Labs (@blodeuweddlabs)

We are now in a position to offer subsidized security assessments (and other services) for open source projects.

(In addition to a whole array of analysis, development, and custom research offerings for everyone else)

Announcement (and more info): blodeuweddlabs.com/news/open-sโ€ฆ

#infosec #security #appsec #canada #opensource


Launching our Open Source Review Scheme | Blodeuwedd Labs

To celebrate the founding of Blodeuwedd Labs we are excited to announce Subsidized Assessments for open source projects as part of our commitment to continually give back to the open source Community.
blodeuweddlabs.com
#opensource #infosec #security #canada #appsec @blodeuweddlabs

#security #vulnerability #curl

#security #ubuntu

We're happy that #Apple has now joined the fight for encryption! ๐Ÿ”’

There is no magic key that allows the police to scan all chat messages, emails, and more for harmful content while not risking the security and privacy of everyone. This is technically not possible.

The more agree to this fact, the higher the chances that legislation is altered to protect everybody's privacy.

bbc.com/news/technology-660287โ€ฆ

#privacy #security #onlinesafetybill #chatkontrolle


Apple joins opposition to encrypted message app scanning

WhatsApp and iMessage could be forced to scan for child abuse images under the Online Safety Bill.
By Chris Vallance (BBC News)
#apple #privacy #security #onlinesafetybill #Chatkontrolle

Mozilla: "In a well-intentioned yet dangerous move to fight online fraud, France is on the verge of forcing browsers to create a dystopian technical capability. It would force browser providers to create the means to mandatorily block websites present on a government provided list. Such a move will overturn decades of established content moderation norms and provide a playbook for authoritarian governments"

blog.mozilla.org/netpolicy/202โ€ฆ
#france #browser #cybersecurity #mozilla #security #surveillance


Franceโ€™s browser-based website blocking proposal will set a disastrous precedent for the open internet - Open Policy & Advocacy

Article 3 (para II and III) of the SREN Bill would force providers to create the means to mandatorily block websites on a government provided list encoded into the browser.
Udbhav Tiwari (Open Policy & Advocacy)
#mozilla #browser #security #france #cybersecurity #surveillance

If you're using #bitwarden, make sure to change the KDF algorithm to Argon2id[^1] which is much more robust against GPU-powered attacks compared to its counterpart.

You can play around with this little calculator to see the impact of each algorithm on cracking cost estimation: passwordbits.com/passphrase-crโ€ฆ

[^1]: bitwarden.com/help/what-encrypโ€ฆ

#security #infosec #password


Encryption | Bitwarden Help Center

Learn how Bitwarden salts and hashes password Vault data before sending it to the Cloud for secure storage.
Bitwarden
#infosec #security #bitwarden #password

#a11y #security #cybersecurity

Interesting: ProtonMail finally admits that Germany "is a good choice given Germanyโ€™s strong privacy laws and culture that make it almost as strong as Switzerland."

For once, we couldn't agree more. ๐Ÿ˜€

We'd even argue Germany is much better as we do not have data retention laws (which would be against the German constitution) - while in Switzerland large tech companies are forced by law to retain data: tutanota.com/blog/posts/data-rโ€ฆ

#germany #privacy #security

Excerpt from Protonmail's Reddit post stating that Germany is a good place for privacy

Germany: Data retention to be abolished once and for all.

According to the German Minister of Justice data retention or "the storage of telecommunications data without any reason" could soon come to an end.
Tutanota
#privacy #security #Germany

#security #physical #isolation #shit

โœ… Staff able to watch customers in the bathroom?
โœ… Obviously shabby infosec?
โœ… Training AI as an excuse for data retention?

๐Ÿ•ต๐Ÿฝ No surprise here: "#Amazon Ring, Alexa accused of every nightmare #IoT #security fail you can imagine" #privacy

theregister.com/2023/06/01/ftcโ€ฆ


Amazon Ring, Alexa accused of every nightmare IoT security fail you can imagine

Staff able to watch customers in the bathroom? Tick! Obviously shabby infosec? Tick! Training AI as an excuse for data retention? Tick!
Simon Sharwood (The Register)
#privacy #security #iot #amazon

#security

Earlier this year we got into a surprising and somewhat annoying struggle with Web browser sandboxing failures related to our "web apps shared in a chat" feature. After much background work we released the hardened Delta Chat 1.36 series, also addressing a dedicated fourth independent security audit, and can finally share more of what was going on behind the scenes delta.chat/en/2023-05-22-webxdโ€ฆ

#chromium #deltachat #security #webxdc


Delta Chat: Bringing E2E privacy to the Web: 4th security audit ๐Ÿ˜…

Delta Chatโ€™s โ€œweb apps shared in a chatโ€ come with a unique privacy promise but in January it was shown to be compromised. We got into a surprising struggle with Web browser sandboxing issues that ...
delta.chat
#security #chromium #deltachat #Webxdc

Journalists, whistleblowers, activists - they all risk their lives to make the truth public.

Let's fight for the right to #privacy and #pressfreedom.

Together with #Threema, #Tor #FightfortheFuture and others we call on policymakers to not undermine #encryption.

We ALL depend on encryption for #security and #privacy! ๐Ÿ’ช๐Ÿ”’

Read more: tutanota.com/blog/posts/press-โ€ฆ

"Every time you use encryption, youโ€™re protecting someone who needs to use it to stay alive." Bruce Schneier

Press Freedom Day: 40+ organizations call on world leaders to uphold encryption & privacy

On Press Freedom Day a coalition of 40+ ogrs have united to defend strong encryption.
Tutanota
#privacy #encryption #security #Tor #threema #pressfreedom #fightforthefuture

#linux #foss #opensource #security #gnu #Flatpak @Oro "it's flatpak time" ๐Ÿณ๏ธโ€๐ŸŒˆ

#security

Google has just updated its 2FA Authenticator app and added a much-needed feature: the ability to sync secrets across devices.

TL;DR: Don't turn it on.

The new update allows users to sign in with their Google Account and sync 2FA secrets across their iOS and Android devices.

We analyzed the network traffic when the app syncs the secrets, and it turns out the traffic is not end-to-end encrypted. As shown in the screenshots, this means that Google can see the secrets, likely even while theyโ€™re stored on their servers. There is no option to add a passphrase to protect the secrets, to make them accessible only by the user.

Why is this bad?

Every 2FA QR code contains a secret, or a seed, thatโ€™s used to generate the one-time codes. If someone else knows the secret, they can generate the same one-time codes and defeat 2FA protections. So, if thereโ€™s ever a data breach or if someone obtains access .... ๐Ÿงต

#Privacy #Cybersecurity #InfoSec #2FA #Google #Security

#google #privacy #infosec #security #cybersecurity #2fa

#android #privacy #datenschutz #security #tracking #sicherheit #backdoor #qualcomm

#email #privacy #encryption #security #data

#privacy #encryption #security

The "Report link destination" command in NVDA 2023.1 is very popular. Press NVDA+k to report exactly where a link goes. This is an important #security feature for users. Do you use it? Read more in our In-Process blog: nvaccess.org/post/in-process-6โ€ฆ #a11y #ScreenReader #NVDA

In-Process 6th April 2023

The big news this time around is the release of NVDA 2023.1! But thereโ€™s plenty more exclusive news below so letโ€™s get into it: NVDA 2023.1 Itโ€™s new release time! NVDA 2023.1 is nโ€ฆ
NV Access
#a11y #security #screenreader #nvda

Security is the major reason why software updates are important. The LastPass breach demonstrates this dramatically.

If you search the web for why software updates are important, you will get loads of results that say there are "3 or 5 reasons why software updates are important". While this may be correct, there is only one major reason why you must keep your software up to date: Security.

Stay secure, update your systems! ๐Ÿ˜Ž๐Ÿ’ช๐Ÿ”’

tutanota.com/blog/posts/why-upโ€ฆ

#LastPass #Security


3 reasons why updates are important: No. 1 is Security!

Tutanota
#security #lastpass

#privacy #blog #security #chatgpt #ki

#security

Microsoft Authenticator prompts the user to accept sharing analytics during the first launch. The prompt only dismisses when the user taps on "Accept." In fact, the app starts sending analytics even before accepting the privacy statement.๐Ÿคฆโ€โ™‚๏ธ

In this video, we downloaded the authenticator app from the App Store and we opened it as we monitored the iPhone network traffic. While the app was showing the permission prompt, we captured at least 3 calls made by the app sending diagnostics to Microsoft. The app sent 14 KB of analytics even before accepting the prompt.

The message on the prompt actually says that Microsoft needs to collect diagnostic data in order to keep Authenticator secure and up to date. ๐Ÿ˜ตโ€๐Ÿ’ซ

#Privacy #Cybersecurity #2FA #InfoSec #Security #Microsoft

youtu.be/r5456XXG6v0


Privacy: Microsoft Authenticator sends analytics even before accepting the privacy statement

When opening Microsoft Authenticator for the first time after downloading it from the App Store, it prompts the user to accept sharing diagnostics with Micro...
YouTube
#privacy #infosec #security #microsoft #cybersecurity #2fa

Today I learned that when you "edit" or "correct" a message in #XMPP, the original message is still technically stored on the server or device. It's the client side that understands that the new message is an edit of the previous message, and "displays" it as such. But, if you send a password or something sensitive, "editing" the message after it has been sent might not remove the actual contents of the original version of the message, so make sure you use #encryption too.

#privacy #security

A screenshot of an edited message being displayed in the conversation view of the Dino XMPP desktop client. The message reads, "Disregard this message", and on the right the message encryption selection box is opened to read Unencrypted, OMEMO and OpenPGP.
This is a screenshot of the database entries for a message sent via Dino. These messages are stored in plain text by Dino, despite the fact they were encrypted in transit by OpenPGP. Message 2363 was the original message, 2364 was the edit made. Only message 2364 is displayed in the conversation view, but both versions of the message are stored in the database.
#xmpp #privacy #encryption #security

Portmaster, eine Art Firewall zur Kontrolle des ausgehenden Datenverkehrs, ist nicht mehr Alpha, sondern in der Version 1.0.7 fรผr Windows, Debian/Ubuntu und Fedora verfรผgbar. Gerade fรผr Windows-Nutzer interessant, die Microsofts Schnรผffelei eindรคmmen wollen.

safing.io/

#security #privacy #firewall #sicherheit #datenschutz #windows


Safing Portmaster - Easy Privacy

Portmaster is a free and open-source application that puts you back in charge over all your computer's network connections. Increase your privacy and security. Get peace of mind.
safing.io
#privacy #Windows #datenschutz #security #sicherheit #firewall

#android #opensource #security #data #backup @F-Droid @IzzyOnDroid โœ…

#privacy #encryption #security #DataProtection #bigtech #dataprivacyday

#privacy #security #cryptowars #goingdark

Have you heard about #ReproducibleBuilds? This is one of the biggest #security benefits of #FOSS. On #Android, this technique ensures that the #FDroid version of an app exactly matches the developer's version.

Read our article below for more details and to see how easy it is for developers to get set up:
f-droid.org/en/2023/01/15/towaโ€ฆ


Towards a reproducible F-Droid | F-Droid - Free and Open Source Android App Repository

A common criticism directed at F-Droid is that F-Droid signs published APKswith its own keys. Using our own keys doesnโ€™t mean insecure โ€” we have a goodtrack ...
f-droid.org
#android #foss #fdroid #security #reproduciblebuilds

I've asked it in a poll in 8/2021 at Mastodon.technology, now it's time for a refresher: To improve #security I finally consider to really drop support for #TLS 1.0/1.1 (see blog.qualys.com/product-tech/2โ€ฆ and e.g. ssllabs.com/ssltest/analyze.htโ€ฆ). This basically would affect devices running Android < 4.4. As I do not want to lock anybody out, I'd like to see how many of you would this effect.

๐Ÿ‡ฉ๐Ÿ‡ช Noch wer mit Android < 4.4 unterwegs und somit auf TLS 1.0/1.1 angewiesen (1. ja, 2. macht nix, 3. nein)?

So:


SSL Labs Grade Change for TLS 1.0 and TLS 1.1 Protocols | Qualys Security Blog

Update 1/31/2020: The grade change is now live on www.ssllabs.com. Servers that support TLS 1.0 or TLS 1.1 are capped to B grade. Update 1/16/2020: The grade change is now live on the developmentโ€ฆ
Qualys Security Blog

  • I still use such a device and need compatibility (1%, 4 votes)
  • I still use such a device but wouldn't mind (6%, 21 votes)
  • I don't care (92%, 320 votes)
345 voters. Poll end: 3 years ago

#security #tls

Do you like security? Do you like privacy? Cryptography? Do you like working for a public benefit non-profit instead of an investor-beholden corporation?

Let's Encrypt is hiring for someone to join our SRE team and help run the largest Certificate Authority in the world! Come work with me and some of the most wonderful folks in tech, to make the web a better place.

abetterinternet.org/careers/leโ€ฆ

#jobs #sre #webPKI #security #privacy #cryptography


Let's Encrypt Software Engineer (SRE)

Posted: September 29, 2022 Start Date: January 2023 Position Status: Open Location: Remote within US Compensation: $140k USD, 100% 401k Match, Excellent Insurance Weโ€™re making HTTPS easier for developers to use, weโ€™re doing it at scale, and we need yโ€ฆ
Internet Security Research Group
#privacy #cryptography #security #jobs #sre #webpki

What do you value the most in your devices?
Privacy, Security and/or Freedom?

At #CES2023, the biggest #tech event, we are asking people their thoughts about where they stand when it comes to #privacy, #security and #freedom when it comes to their #laptops, #phones, IoT devices

#ces

#privacy #security #tech #freedom #laptops #phones #ces2023 #ces

โ‡ง