Search
Items tagged with: security
theguardian.com/technology/202…
This article discusses how to protect privacy, amidst concerns of increased government surveillance.
The article is aimed at Asylum seekers & immigrants to the US, but it's solid advice for anyone, really.
Recommendations include using encrypted messaging apps like Signal, Apple iMessage, and WhatsApp, and setting messages to disappear.
It also recommends minimizing data sharing and deleting data when possible, particularly from Google.
Opt out: how to stop tech companies spying on your phone as Trump promises mass deportations
There are no federal privacy regulations to protect your information – here’s how you can do it yourselfJohana Bhuiyan (The Guardian)
Urgent Warning for Fedi Admins
We've discovered an ongoing Denial-of-Service attack against Misskey-based instances. The attacks exploit a zero-day vulnerability impacting Misskey, Sharkey, IceShrimp, and other related software. Patches are in progress and will be released ASAP. We encourage all admins to update immediately!
Oha, das ist provokativ: Dieser Blogartikel sagt:
- Nutzt kein #PGP / #GPG
- Nutzt kein #XMPP + OMEMO
- Nutzt kein #Matrix (im Sinne: verlasst euch nicht auf die Verschlüsselung)
- E-Mails verschlüsseln ist sinnlos
Ich kenne den Autor nicht und würde ihn nicht erwähnen, würde der Artikel nicht in ernstzunehmenden ITSec-Newslettern zitiert
soatok.blog/2024/11/15/what-to…
What To Use Instead of PGP - Dhole Moments
It’s been more than five years since The PGP Problem was published, and I still hear from people who believe that using PGP (whether GnuPG or another OpenPGP implementation) is a thing they s…Dhole Moments
I've seen a number of toots today advising people against scanning random #QRCodes because they can be used in a number of malicious ways.
There are a number of legitimate ways people can use such codes to trick others, and it can require some deeper understanding of how systems work to avoid them. For that reason, I'm not going to contradict that recommendation, but I will add to it.
QR codes are usually just URLs encoded in a visual, machine-readable form, so they aren't necessarily more dangerous than a link. The danger comes from the fact that most scanner apps will directly open whatever URL you scan without giving you the opportunity to consider whether that's a good idea.
You can reduce the risk of scanning such codes by installing a better app which requires manual interaction to open URLs after decoding them.
For android users I recommend "BinaryEye", since it's open-source, ad-free, and has a bunch of other useful features.
Its github page links to both F-Droid and the play store:
github.com/markusfisch/BinaryE…
GitHub - markusfisch/BinaryEye: Yet another barcode scanner for Android
Yet another barcode scanner for Android. Contribute to markusfisch/BinaryEye development by creating an account on GitHub.GitHub
With the release of Parcelo 0.11.0, we've made some significant changes to our server infrastructure. App developers can now find the developer console at console.accrescent.app.
If you encounter any issues, please let us know ASAP through our socials or contacts on our site.
Great to see you're adopting some of the #security features we've implemented earlier this year at #IzzyOnDroid @fdroidorg! Maybe you want to check our documentation on them?
android.izzysoft.de/articles/n…
* it's SIGNING blocks, not FROSTING blocks
* MEITUAN is about payload, not metadata
* there's no fixed number of blocks as your code assumes (gitlab.com/fdroid/fdroidserver…)
The article you link to (bi-zone.medium.com/easter-egg-…) tells you the same :wink:
Easter Egg in APK Files: What Is Frosting - BI.ZONE - Medium
A file structure is a whole fascinating world with its own history, mysteries and a home-grown circus of freaks, where workarounds are applied liberally. If you dig deeper into it, you can discover…BI.ZONE (Medium)
That's why we publish all our apps on @fdroidorg ❤️
🔒 Get the new calendar app now! 🔒
👉 tuta.com/blog/tuta-calendar-fd…
#FOSS #OpenSource #Encryption #Security #Calendar
New Tuta Calendar app is now on F-Droid! | Tuta
Encrypted, open source, zero strings to Google – introducing the Tuta Calendar.Tuta
"Okta has revealed that its system had a vulnerability that allowed people to log into an account without having to provide the correct password. Okta bypassed password authentication if the account had a username that had 52 or more characters. Further, its system had to detect a "stored cache key" of a previous successful authentication, which means the account's owner had to have previous history of logging in using that browser"
engadget.com/apps/okta-vulnera…
🔐 Sending a password-protected email to anyone is easy with Tuta Mail! 🔐
Check out our latest guide on how to send encrypted, password-protected emails here 👇👇👇
tuta.com/blog/how-to-password-…
#encryption #security #privacy #email
The easiest way to send password-protected emails | Tuta
Unsure of how to send a password-protected email? Find out how easy it is in this quick guide.Tuta
@Tutanota I just realised that all the comments I have added to my contacts over the years, including family-related and medical important information, are gone...
github.com/tutao/tutanota/issu…
Bugs are becoming more common recently, and this one made me lose data. I'm quite disappointed.
#Email #OpenSource #FOSS #Security #Privacy
Lost all my contact comments on Android · Issue #7818 · tutao/tutanota
This is not a feature request (existing functionality does not work, not missing functionality). I will request features on forum or via support. I've searched and did not find a similar issue. Bug...GitHub
🦾6 AI Tos Used by Hackers
🔹Poisongpt
🔹Wormgpt
🔹Speechif.ai
🔹Deepl.ai
🔹Freedom.ai
🔹Passgan.ai
🔖#infosec #cybersecurity #hacking #pentesting #security
There Is Just One Way To Do Open Source Security: Together: thenewstack.io/there-is-just-o… via @TheNewStack & @sjvn
When we work together, said HackerOne CEO Mårten Mickos, we can secure #opensource software. #security
There Is Just One Way To Do Open Source Security: Together - The New Stack
HackerOne CEO Mårten Mickos highlights how open source can address security issues.Steven J. Vaughan-Nichols (The New Stack)
Accrescent 0.25.0 is out with Android 15 app archiving support, Private Space support, and settings UI improvements!
We also forgot to announce that since 0.24.0, Accrescent supports in-app predictive back!
Check out the release notes below 👇
github.com/accrescent/accresce…
#privacy #security #appstore #android #accrescent #opensource
Release 0.25.0 · accrescent/accrescent
This release adds initial app archiving support on Android 15, makes Accrescent show up as an installer in Private Space, and improves the settings UI! We also forgot to mention that since 0.24.0, ...GitHub
Accrescent recently surpassed 1,000 stars on GitHub 🥳! Thank you to everyone for your continued support!
If you'd like to help us grow, check out accrescent.app/faq#contributin…. There are lots of ways to contribute even if you can't code!
github.com/accrescent/accresce…
#security #privacy #appstore #accrescent #android
Accrescent Frequently Asked Questions
Answers to frequently asked questions about Accrescent.Accrescent
ICYMI: Internet Archive hacked, data breach impacts 31 million users
1. Nobody is safe.
2. A non-profit is using bcrypt to hash passwords, no reason why your for-profit company can't do the same.
Hungary keeps pushing for Chat Control. Here’s why they must be stopped:
👉 tuta.com/blog/opposition-again…
#chatcontrol #Fight4privacy #encryption #security
American Water shuts down online services after #cyberattack
American Water is the largest water and wastewater treatment utility in the US…
OT systems not affected - so appears this only affects their IT systems. Suspected nation state activity (Russia).
(I encourage everyone sharing this with their friends because cyber attacks absolutely can have direct “real world” consequences.)
#AIagent promotes itself to #sysadmin , trashes #boot sequence
Fun experiment, but yeah, don't pipe an #LLM raw into /bin/bash
Buck #Shlegeris, CEO at #RedwoodResearch, a nonprofit that explores the risks posed by #AI , recently learned an amusing but hard lesson in automation when he asked his LLM-powered agent to open a secure connection from his laptop to his desktop machine.
#security #unintendedconsequences
theregister.com/2024/10/02/ai_…
AI agent promotes itself to sysadmin, trashes boot sequence
Fun experiment, but yeah, don't pipe an LLM raw into /bin/bashThomas Claburn (The Register)
#Linux #security
I hope to hear from @Tutanota very soon. Lack of key verification is a major flaw in the technical design of the platform, allowing a malicious Tuta server to read end-to-end encrypted exchanges (both emails and shared calendars).
github.com/tutao/tutanota/issu…
The issue has been opened 6 years ago.
#Security #Privacy #Crypto #Cryptography #Email #FOSS
![Message posted on the GitHub issue titled "Manual key verification":
"This issue has been opened for more than 6 years now, with no clear roadmap or even real consideration from the Tuta team. I have to say, I am disappointed.
You keep saying that "[...] Tuta [is] the most secure email service on the market.", but without key verification, a malicious Tuta server can read the end-to-end encrypted emails and shared calendars exchanged on the platform as there is no way to verify the recipients' public key. As explained by @llebout, "all users of Tutanota must trust Tutanota to not provide forged keys and perform an MITM attack". This is a significant flaw in the technical design of the platform, and it does not seem to bother you.
In #198, it can be read that:
> We are aware of the issues with verification, new protocol will support verification, the work is underway
However, your post-quantum implementation has now landed but still no word on the key verification issue.
Could you please stand by what you have said from day 1, that you prioritise security and privacy, and establish a clear roadmap of the work already undertaken or to be done to fix the situation?
Thank you"](https://fedi.ml/photo/preview/640/595249 "Message posted on the GitHub issue titled \"Manual key verification\":
\"This issue has been opened for more than 6 years now, with no clear roadmap or even real consideration from the Tuta team. I have to say, I am disappointed.
You keep saying that \"[...] Tuta [is] the most secure email service on the market.\", but without key verification, a malicious Tuta server can read the end-to-end encrypted emails and shared calendars exchanged on the platform as there is no way to verify the recipients' public key. As explained by @llebout, \"all users of Tutanota must trust Tutanota to not provide forged keys and perform an MITM attack\". This is a significant flaw in the technical design of the platform, and it does not seem to bother you.
In #198, it can be read that:
> We are aware of the issues with verification, new protocol will support verification, the work is underway
However, your post-quantum implementation has now landed but still no word on the key verification issue.
Could you please stand by what you have said from day 1, that you prioritise security and privacy, and establish a clear roadmap of the work already undertaken or to be done to fix the situation?
Thank you\"")
Accrescent 0.24.0 is out with settings menu accessibility improvements, target SDK 35 (Android 15), and LOTS of translation and dependency updates! 🎉
Download it from our website at accrescent.app or read the changelog below 👇
New blog post: Post-OCSP certificate revocation in the Web PKI.
With OCSP in all forms going away, I decided to look at the history and possible futures of certificate revocation in the Web PKI. I also threw in some of my own proposals to work alongside existing ones.
I think this is the most comprehensive current look at certificate revocation right now.
#security #WebPKI #LetsEncrypt #TLS #OCSP
fyi to linux users, the unofficial signal desktop flatpak doesnt use the freedesktop Secrets API no matter what you do and leaves your keys completely unencrypted
you can just dump ~/.var/apps/org.signal.Signal and read everything stored
if you're concerned, you should probably use the native package
Was ist euer größter Security-Fail? Meiner war, als ich mit ca. 15 Jahren eine Software auf einen Windows-95-Rechner geladen habe, ohne die Quelle ausreichend zu überprüfen. Das Ende vom Lied: Die komplette Festplatte wurde gelöscht. Seitdem interessiere ich mich für IT-Sicherheit. 🧙♂️
NGI Assure, the program aimed at improving trust in our digital society, successfully concluded after its 4 year run.
[1]152 teams contributed to a more trustworthy & secure internet with their Free and Open Source projects. Thank you all!
We've made a book showcasing all the projects which you can download from the link below. There are also paper copies, so ask for those when you see us IRL.
[2][1] nlnet.nl/news/2024/20240919-NG…
[2] nlnet.nl/media/NGIAssure-bookl…
(1/2)
Tor insists its #network is safe after German cops convict CSAM dark-web admin
Kind of boils down to opsec fail here. Using outdated software, which in this case didn’t properly secure Tor connections.
Timing attacks are still viable (especially with hostile nodes), but this reads as an #opsec fail to me.
Remember: a major part of anonymity is maintaining great opsec.
Obligatory: Tor is not “just for criminals,” despite one getting caught in this case (glad he did tbh). Regular people use Tor everyday.
#cybersecurity #security #privacy
theregister.com/2024/09/19/tor…
Tor insists its network is safe after German cops convict CSAM dark-web admin
Outdated software blamed for cracks in the armorIain Thomson (The Register)
In opsec, duress (“rubber-hose”) attacks are famously hard to address. Cryptographic keys that cannot be lost have poor protections against duress.
Travelers can leave key fobs at home should they be accosted. A victim of a break-in can conveniently “lose” or smash a hardware key, erasing any encrypted data. Yes, I know about cold-boot attacks; I don’t recommend at-risk people to leave things decrypted for long durations. I like the idea of spring-loaded key fobs that can’t be left plugged in.
People talking about key fob body implants don’t usually plan for removing them in seconds with plausible deniability.
Originally posted on seirdy.one: See Original (POSSE). #Security #OpSec
Authentication is almost always the most frustrating step of interacting with a service. Matrix is no different, but Quentin is about to dramatically improve the situation.
Get a glimpse of all the goodness awaiting to be unlocked once his project lands!
Замедление YouTube с технической стороны
#network #security #infosec #proxy #vless #vmess #youtube #roscompozor #ntc_party
Готовые средства обхода. Waujito написал своё решение под линукс (github.com/Waujito/youtubeUnbl…), которое направлено только на ютуб.
Также для Windows существует GoodbyeDPI от ValdikSS (github.com/ValdikSS/GoodbyeDPI), под линукс еще есть zapret (github.com/bol-van/zapret).
Существует ByeDPI (github.com/hufrea/byedpi), который работает как прокси (Windows/Linux). Также есть версия ByeDPI под андроид (github.com/dovecoteescapee/Bye…), работает как "фейковый впн".
Советую прочитать подробный комментарий от ValdikSS о том, как использовать эти средства. (github.com/yt-dlp/yt-dlp/issue…)
Если есть желание погрузиться глубже в эту тему, вот тут можно посмотреть подробнее: https://ntc.party/t/замедление-youtube-в-россии/8055/ and https://ntc.party/t/обсуждение-замедление-youtube-в-россии/8074/
Комменты как обычно бурлят.
Замедление YouTube с технической стороны: ограничение и обход
Привет, Хабр!В последнее время замечаю огромное количество информации по поводу замедления Великого, но очень мало где видел конкретику о том, как именно это раб...Vadim Vetrov (Habr)
As dating goes digital, concerns for online privacy are more relevant than ever. ❤️
Is it possible to meet someone and still keep your privacy intact? 🤔
💘 Let’s find out 👉 tuta.com/blog/private-dating-a…
#privacy #dating #safety #security
Ultimate guide to be private and secure on dating apps | Tuta
As romance goes digital, extra steps are needed to avoid a privacy heartbreak. Here are our tips for protecting yourself and your data from overexposure.Tuta
AI ❤️ Tuta!
Which makes sense as we're already using quantum-safe encryption. 🔒
We might not like AI, but it sure likes us. 😊
#ai #privacy #security #encryption #quantumworld
