#security

Here's your semi-regular reminder that if you work in open source, you and your team can get a 1Password Teams account for free.

https://github.com/1Password/for-open-source

#FOSS #Security #Passwords

Want do do a PhD in Computer Science in the heart of Europe? We are hiring!

10 FWF-funded positions at TU Wien for doctoral students in our newly founded doctoral college on

Automated Reasoning (https://forsyte.at/docfunds/)

Come to Vienna (repeatedly ranked the world's most livable city) to work with an amazing team on on exciting topics at the intersection of security and artificial intelligence with Automated Reasoning at the core!

Deadline: May 18, 2025
Start: October 2025 (or soon after)
Details: https://forsyte.at/docfunds/

#phdposition #phd #hiring #automatedreasoning #security #artificial_intelligence #FWF

I'm creating a list of #european #hardware and #software 🇪🇺, all of them with #security and #privacy in mind.

#Qubes_OS 🇵🇱 #poland https://www.qubes-os.org/
#novacustom 🇳🇱 #netherlands https://novacustom.com/
#yubico 🇸🇪 #sweden https://www.yubico.com/
#ledger 🇫🇷 #france https://www.ledger.com/
#nextcloud 🇩🇪 #germany https://nextcloud.com/
#linux kernel 🇫🇮 #finland, because its creator, Linus Torvalds, is Finnish.

Please help to expand the list

#buyeuropean #europeanalternatives #unplugtrump

I'm creating a list of #european #hardware and #software 🇪🇺, all of them with #security and #privacy in mind.

#Qubes_OS 🇵🇱 #poland https://www.qubes-os.org/
#novacustom 🇳🇱 #netherlands https://novacustom.com/
#yubico 🇸🇪 #sweden https://www.yubico.com/
#ledger 🇫🇷 #france https://www.ledger.com/
#nextcloud 🇩🇪 #germany https://nextcloud.com/
#linux kernel 🇫🇮 #finland, because its creator, Linus Torvalds, is Finnish.

Please help to expand the list

#buyeuropean #europeanalternatives #unplugtrump

A tool to anonymise those little yellow dots your colour laser printer is probably adding to every page it prints:

https://github.com/dfd-tud/deda

#infosec #security #anonymity #privacy

Like the Bluesky team wrote a tonne of code to prevent common node.js fetch() security bugs, including:
- SSRF attacks
- Disabling automatic following of redirects
- malicious protocols
- timeouts
- response size attacks

But somehow none of this is really ever considered by most folks when using fetch() in node.js

https://github.com/bluesky-social/atproto/blob/main/packages/internal/fetch-node/src/safe.ts

#nodejs #security

Something I've never seen documented is how to actually do SSRF prevention with Node.js's fetch implementation.

Like you could resolve DNS before making the request, and assert the IP addresses are public IP addresses, but afaict, fetch() will do that too so you could theoretically get two different results (although unlikely)

Feels like Node.js should just ship an SSRF safe fetch implementation.

#nodejs #security

A tool to anonymise those little yellow dots your colour laser printer is probably adding to every page it prints:

https://github.com/dfd-tud/deda

#infosec #security #anonymity #privacy

Are you on Bluesky? Ads are coming for your feed: https://techcrunch.com/2025/04/16/bluesky-feed-builder-graze-raises-1m-rolls-out-ads/

Want an ad-free experience? Use Mastodon instead.

#mastodon #twitter #bluesky #fediverse #social #socialmedia #facebook #threads #ads #surveillance #surveillancecapitalism #privacy #security

The European Union Agency for Cybersecurity (ENISA) launched the European Union Vulnerability Database (EUVD) website https://euvd.enisa.europa.eu/

#ENISA #EUVD #CVE #Security #Europe #EuropeanAlternatives

The European Union Agency for Cybersecurity (ENISA) launched the European Union Vulnerability Database (EUVD) website https://euvd.enisa.europa.eu/

#ENISA #EUVD #CVE #Security #Europe #EuropeanAlternatives

The European Union Agency for Cybersecurity (ENISA) launched the European Union Vulnerability Database (EUVD) website https://euvd.enisa.europa.eu/

#ENISA #EUVD #CVE #Security #Europe #EuropeanAlternatives

The European Union Agency for Cybersecurity (ENISA) launched the European Union Vulnerability Database (EUVD) website https://euvd.enisa.europa.eu/

#ENISA #EUVD #CVE #Security #Europe #EuropeanAlternatives

Sadly, this is only the beginning of a domino effect should it go into law.

https://techcrunch.com/2025/04/17/florida-draft-law-mandating-encryption-backdoors-for-social-media-accounts-billed-dangerous-and-dumb/

#encryption #backdoors #privacy #security

Sadly, this is only the beginning of a domino effect should it go into law.

https://techcrunch.com/2025/04/17/florida-draft-law-mandating-encryption-backdoors-for-social-media-accounts-billed-dangerous-and-dumb/

#encryption #backdoors #privacy #security

Are you on Bluesky? Ads are coming for your feed: https://techcrunch.com/2025/04/16/bluesky-feed-builder-graze-raises-1m-rolls-out-ads/

Want an ad-free experience? Use Mastodon instead.

#mastodon #twitter #bluesky #fediverse #social #socialmedia #facebook #threads #ads #surveillance #surveillancecapitalism #privacy #security

The European Union Agency for Cybersecurity (ENISA) launched the European Union Vulnerability Database (EUVD) website https://euvd.enisa.europa.eu/

#ENISA #EUVD #CVE #Security #Europe #EuropeanAlternatives

The European Union Agency for Cybersecurity (ENISA) launched the European Union Vulnerability Database (EUVD) website https://euvd.enisa.europa.eu/

#ENISA #EUVD #CVE #Security #Europe #EuropeanAlternatives

The European Union Agency for Cybersecurity (ENISA) launched the European Union Vulnerability Database (EUVD) website https://euvd.enisa.europa.eu/

#ENISA #EUVD #CVE #Security #Europe #EuropeanAlternatives

The European Union Agency for Cybersecurity (ENISA) launched the European Union Vulnerability Database (EUVD) website https://euvd.enisa.europa.eu/

#ENISA #EUVD #CVE #Security #Europe #EuropeanAlternatives

🚨 Explosive allegations are hitting Elon Musk’s DOGE team.

A whistleblower says:
📂 10GB of NLRB data was exfiltrated
🔓 Security settings were disabled
📸 Photos of staff were used to intimidate
⚖️ Claims involve surveillance, union suppression, and cyber intrusion

Musk called it “insane,” but the NLRB is reportedly cooperating with federal investigations. Whether true or not — this underscores the growing overlap of cybersecurity, labor rights, and executive power.

#CyberSecurity #Whistleblower #ElonMusk #NLRB #DigitalEthics #security #privacy #cloud #infosec

https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-musk-spacex-security

The employees grew concerned that the #NLRB's confidential #data could be exposed, particularly after they started detecting suspicious log-in attempts from an IP address in #Russia [wtf?], acc/to the disclosure. Eventually, the disclosure continued, the IT department launched a formal review of what it deemed a serious, ongoing #security #breach or potentially #illegal removal of personally identifiable information.

#criminal #law #Trump #Musk #InfoSec #NationalSecurity

🚨 Explosive allegations are hitting Elon Musk’s DOGE team.

A whistleblower says:
📂 10GB of NLRB data was exfiltrated
🔓 Security settings were disabled
📸 Photos of staff were used to intimidate
⚖️ Claims involve surveillance, union suppression, and cyber intrusion

Musk called it “insane,” but the NLRB is reportedly cooperating with federal investigations. Whether true or not — this underscores the growing overlap of cybersecurity, labor rights, and executive power.

#CyberSecurity #Whistleblower #ElonMusk #NLRB #DigitalEthics #security #privacy #cloud #infosec

https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-musk-spacex-security

Blogged: NetEscapades.​AspNetCore.​SecurityHeaders 1.0.0 has been released

https://andrewlock.net/netescapades-aspnetcore-securityheaders-1-0-0-released/

In this post I describe the recent major changes to NetEscapades.AspNetCore.SecurityHeaders, a NuGet package for adding security headers to your apps

#dotnet #aspnetcore #security

The employees grew concerned that the #NLRB's confidential #data could be exposed, particularly after they started detecting suspicious log-in attempts from an IP address in #Russia [wtf?], acc/to the disclosure. Eventually, the disclosure continued, the IT department launched a formal review of what it deemed a serious, ongoing #security #breach or potentially #illegal removal of personally identifiable information.

#criminal #law #Trump #Musk #InfoSec #NationalSecurity

Whistleblower details how DOGE may have taken sensitive NLRB data

https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-musk-spacex-security

#security #whistleblower

Whistleblower details how DOGE may have taken sensitive NLRB data

https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-musk-spacex-security

#security #whistleblower

LLMs can't stop making up software dependencies and sabotaging everything

Hallucinated package names fuel 'slopsquatting'

https://www.theregister.com/AMP/2025/04/12/ai_code_suggestions_sabotage_supply_chain/

#security #ai

TIL: slopsquatting #llm #coding #security https://www.theregister.com/2025/04/12/ai_code_suggestions_sabotage_supply_chain/

LLMs can't stop making up software dependencies and sabotaging everything

Hallucinated package names fuel 'slopsquatting'

https://www.theregister.com/AMP/2025/04/12/ai_code_suggestions_sabotage_supply_chain/

#security #ai

TIL: slopsquatting #llm #coding #security https://www.theregister.com/2025/04/12/ai_code_suggestions_sabotage_supply_chain/

I want to know the backstory of how long the hacker knew about this security vulnerability and their waiting for a moment of meaningful protest and civil disobedience

https://www.paloaltoonline.com/technology/2025/04/12/silicon-valley-crosswalk-buttons-apparently-hacked-to-imitate-musk-zuckerberg-voices/?ref=activitypub

#security

On the topic of 2FA (2nd factor authentication), I really do need to find an alternative that:

1) Is cloud based sync service, but can also run locally
2) Does not require you to set up on your own server
3) Can be used on multiple devices
4) Is not limited to specific hardware.
5) Can export and import if needed.
6) Outside Us Jurisdiction

If I seem to be repeating my requirements, it is because there are so many unhelpful people, who believe they are being helpful, by ignoring all those requirements. - I said, what I said.

#2FA #2ndFactorAuthentication #Security #InfoSec #InformationSecurity

On the topic of 2FA (2nd factor authentication), I really do need to find an alternative that:

1) Is cloud based sync service, but can also run locally
2) Does not require you to set up on your own server
3) Can be used on multiple devices
4) Is not limited to specific hardware.
5) Can export and import if needed.
6) Outside Us Jurisdiction

If I seem to be repeating my requirements, it is because there are so many unhelpful people, who believe they are being helpful, by ignoring all those requirements. - I said, what I said.

#2FA #2ndFactorAuthentication #Security #InfoSec #InformationSecurity

Lately I've been doing more #SelfHosting again due to the current situation. Of course, I'm paying particular attention to power consumption and noise. After good experiences with the #ARM64 architecture, even with power-hungry applications such as Mastodon, I'm now using the smartphone technology for my homeservers, too.

There are #SBCs with more open hardware, but the #RaspberryPi is widely available, well documented, powerful and inexpensive. And it is available with up to 16 GB of RAM.

Anyone operating a server on the Internet must install #security updates quickly. However, many people forget to restart running software so that the new version runs instead of the old one. The #needrestart tool helps with this on Debian-based Linux systems, which unfortunately is usually not pre-installed.

On my Raspberry Pi 4, needrestart always runs correctly (automatically after apt upgrade). On my Raspberry Pi 5, however, I first had to create a configuration file as described by the main developer here:
https://github.com/liske/needrestart/blob/master/README.raspberry.md
Previously, the tool always claimed that a reboot was necessary because it thought an outdated Linux kernel was running.

Next, I want to activate #LUKS hard drive encryption on both raspis. Unfortunately, this is not as easy under #Raspbian or #RaspberryPiOS as on other Debian systems. If you have managed this: Please let me know how you did it!

#rpi #rpi5 #raspi #raspberrypi5 #homeserver #encryption #selfhost #selfhosted

Still anticipating a major spring or autumn event, "You Have Installed OpenBSD. Now For The Daily Tasks." https://nxdomain.no/~peter/openbsd_installed_now_for_the_daily_tasks.html now also points the user to rcctl for services housekeeping.

#openbsd #rcctl #unixlike #newrelease #devops #development #sysadmin #networking #security #sanity #qualitysoftware

ToddyCat: Malware nutzt Sicherheitsleck in Antivirensoftware

Statt Systeme vor Malware zu schützen, hat eine Lücke in Eset-Verenschutz zur Ausführung von Schadsoftware geführt.

https://www.heise.de/news/ToddyCat-Malware-nutzt-Sicherheitsleck-in-Antivirensoftware-10344279.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#Malware #IT #Kaspersky #Security #Sicherheitslücken #news

ToddyCat: Malware nutzt Sicherheitsleck in Antivirensoftware

Statt Systeme vor Malware zu schützen, hat eine Lücke in Eset-Verenschutz zur Ausführung von Schadsoftware geführt.

https://www.heise.de/news/ToddyCat-Malware-nutzt-Sicherheitsleck-in-Antivirensoftware-10344279.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#Malware #IT #Kaspersky #Security #Sicherheitslücken #news

If you're using #GMail and you've learned about their latest claim to introduce real end-to-end #encryption: it's a lie.

Google has the control and/or you can't do anything against that Google takes control any time.

Real #E2EE works differently: only the sender and receiver are able to access the protected content.

https://arstechnica.com/security/2025/04/are-new-google-e2ee-emails-really-end-to-end-encrypted-kinda-but-not-really/

https://michal.sapka.pl/2025/gmail-e2e-is-as-terrible-as-expected/

#Meta also defined E2EE such that the message is encrypted from the sender to them, processed in clear text and re-encrypted for the transmission to the receiver.

Don't let them fool you with false claims and wrong definitions.

#Google #security #privacy #PIM #email

If you're using #GMail and you've learned about their latest claim to introduce real end-to-end #encryption: it's a lie.

Google has the control and/or you can't do anything against that Google takes control any time.

Real #E2EE works differently: only the sender and receiver are able to access the protected content.

https://arstechnica.com/security/2025/04/are-new-google-e2ee-emails-really-end-to-end-encrypted-kinda-but-not-really/

https://michal.sapka.pl/2025/gmail-e2e-is-as-terrible-as-expected/

#Meta also defined E2EE such that the message is encrypted from the sender to them, processed in clear text and re-encrypted for the transmission to the receiver.

Don't let them fool you with false claims and wrong definitions.

#Google #security #privacy #PIM #email

This is a program that I've been championing within @nivenly over the past year, after we noticed that security vulnerabilities weren't being disclosed responsibly, and not enough research was going into the security of Fediverse software.

You might remember my Pixelfed vulnerability from last year, where OAuth scopes weren't checked allowing for privilege escalation via the API (CVE-2024-25108), that was our very first test-case of this program.

I'm incredibly proud to be involved in launching the Fediverse Security Fund from Nivenly Foundation (a 501(c)4 not-for-profit cooperative)

#fediverse #security #nivenly #FediverseSecurityFund

RE: https://hachyderm.io/@nivenly/114268491892140498

#Trump calling the #trade deficit a “national emergency” that threatens US #security, lays out his *legal* argument for his actions.

“They rip us off,”Trump says of the #EU, announcing a 20% #tariff on the 27-nation bloc.

Trump holds a chart showing reciprocal tariff rates for US trading partners & says he will charge half of that much? There is no explanation for the calculations that he is using to justify the #tariffs. Likely because they’re arbitrary revenge tactics.

#economy #geopolitics

This is a program that I've been championing within @nivenly over the past year, after we noticed that security vulnerabilities weren't being disclosed responsibly, and not enough research was going into the security of Fediverse software.

You might remember my Pixelfed vulnerability from last year, where OAuth scopes weren't checked allowing for privilege escalation via the API (CVE-2024-25108), that was our very first test-case of this program.

I'm incredibly proud to be involved in launching the Fediverse Security Fund from Nivenly Foundation (a 501(c)4 not-for-profit cooperative)

#fediverse #security #nivenly #FediverseSecurityFund

RE: https://hachyderm.io/@nivenly/114268491892140498

The use of #Gmail, a FAR LESS secure method of communication than the encrypted messaging app #Signal [which isn’t secure enough for these kinds of comms either], is the latest example of questionable #security practices by top #NationalSecurity ofcls already under fire for the mistaken inclusion of a journalist in a group chat about high-level planning for #military ops in Yemen.

#Signalgate #Signal #OpSec #InfoSec #military #Trump #idiocracy #kakistocracy

This is a program that I've been championing within @nivenly over the past year, after we noticed that security vulnerabilities weren't being disclosed responsibly, and not enough research was going into the security of Fediverse software.

You might remember my Pixelfed vulnerability from last year, where OAuth scopes weren't checked allowing for privilege escalation via the API (CVE-2024-25108), that was our very first test-case of this program.

I'm incredibly proud to be involved in launching the Fediverse Security Fund from Nivenly Foundation (a 501(c)4 not-for-profit cooperative)

#fediverse #security #nivenly #FediverseSecurityFund

RE: https://hachyderm.io/@nivenly/114268491892140498

This is a program that I've been championing within @nivenly over the past year, after we noticed that security vulnerabilities weren't being disclosed responsibly, and not enough research was going into the security of Fediverse software.

You might remember my Pixelfed vulnerability from last year, where OAuth scopes weren't checked allowing for privilege escalation via the API (CVE-2024-25108), that was our very first test-case of this program.

I'm incredibly proud to be involved in launching the Fediverse Security Fund from Nivenly Foundation (a 501(c)4 not-for-profit cooperative)

#fediverse #security #nivenly #FediverseSecurityFund

RE: https://hachyderm.io/@nivenly/114268491892140498

This is a program that I've been championing within @nivenly over the past year, after we noticed that security vulnerabilities weren't being disclosed responsibly, and not enough research was going into the security of Fediverse software.

You might remember my Pixelfed vulnerability from last year, where OAuth scopes weren't checked allowing for privilege escalation via the API (CVE-2024-25108), that was our very first test-case of this program.

I'm incredibly proud to be involved in launching the Fediverse Security Fund from Nivenly Foundation (a 501(c)4 not-for-profit cooperative)

#fediverse #security #nivenly #FediverseSecurityFund

RE: https://hachyderm.io/@nivenly/114268491892140498

This is a program that I've been championing within @nivenly over the past year, after we noticed that security vulnerabilities weren't being disclosed responsibly, and not enough research was going into the security of Fediverse software.

You might remember my Pixelfed vulnerability from last year, where OAuth scopes weren't checked allowing for privilege escalation via the API (CVE-2024-25108), that was our very first test-case of this program.

I'm incredibly proud to be involved in launching the Fediverse Security Fund from Nivenly Foundation (a 501(c)4 not-for-profit cooperative)

#fediverse #security #nivenly #FediverseSecurityFund

RE: https://hachyderm.io/@nivenly/114268491892140498

This is a program that I've been championing within @nivenly over the past year, after we noticed that security vulnerabilities weren't being disclosed responsibly, and not enough research was going into the security of Fediverse software.

You might remember my Pixelfed vulnerability from last year, where OAuth scopes weren't checked allowing for privilege escalation via the API (CVE-2024-25108), that was our very first test-case of this program.

I'm incredibly proud to be involved in launching the Fediverse Security Fund from Nivenly Foundation (a 501(c)4 not-for-profit cooperative)

#fediverse #security #nivenly #FediverseSecurityFund

RE: https://hachyderm.io/@nivenly/114268491892140498

hey, fediverse friends - i'm excited that we're finally announcing our Fediverse Security Fund over at @nivenly to help make fedi software more secure.

we're starting off super small to see if the Fund is a thing that can help. along the way we'll learn and improve our intake/payout process. and if there's solid interest and we see good impact, we'll hold a member vote near the end of the experiment to decide if we'll renew/expand the program.

thanks to @thisismissem for her contributions and being the first disclosure to validate the process.

let's close some vulns!

#fediverse #security #devops #sre

hey, fediverse friends - i'm excited that we're finally announcing our Fediverse Security Fund over at @nivenly to help make fedi software more secure.

we're starting off super small to see if the Fund is a thing that can help. along the way we'll learn and improve our intake/payout process. and if there's solid interest and we see good impact, we'll hold a member vote near the end of the experiment to decide if we'll renew/expand the program.

thanks to @thisismissem for her contributions and being the first disclosure to validate the process.

let's close some vulns!

#fediverse #security #devops #sre

This is a program that I've been championing within @nivenly over the past year, after we noticed that security vulnerabilities weren't being disclosed responsibly, and not enough research was going into the security of Fediverse software.

You might remember my Pixelfed vulnerability from last year, where OAuth scopes weren't checked allowing for privilege escalation via the API (CVE-2024-25108), that was our very first test-case of this program.

I'm incredibly proud to be involved in launching the Fediverse Security Fund from Nivenly Foundation (a 501(c)4 not-for-profit cooperative)

#fediverse #security #nivenly #FediverseSecurityFund

RE: https://hachyderm.io/@nivenly/114268491892140498

this makes me really happy: over 1/6th of the top (by download) Python projects are producing attestations!

that's a meteoric adoption rate, given that we only enabled attestation upload support on PyPI ~5 months ago!

tracker here: https://trailofbits.github.io/are-we-pep740-yet/

#python #opensource #security

The use of #Gmail, a FAR LESS secure method of communication than the encrypted messaging app #Signal [which isn’t secure enough for these kinds of comms either], is the latest example of questionable #security practices by top #NationalSecurity ofcls already under fire for the mistaken inclusion of a journalist in a group chat about high-level planning for #military ops in Yemen.

#Signalgate #Signal #OpSec #InfoSec #military #Trump #idiocracy #kakistocracy

Blogged: Creating SBOM attestations in GitHub Actions

https://andrewlock.net/creating-sbom-attestations-in-github-actions/

In this post I show how you can create attestations for SBOM documents that you have created for your application or Nuget package

#dotnet #security #github

#Oracle Cloud is hacked. Another reason why I do not use the #cloud :)

https://techcrunch.com/2025/03/31/oracle-under-fire-for-its-handling-of-separate-security-incidents/

#oraclecloud #security #secdevops

Encryption is essential for cybersecurity 🔐

The lack of protections for it in the UK Cyber Security Bill, coupled with the UK's encryption-breaching order against Apple, shows a lack of seriousness about the threats we face.

Sign and share our petition to send a message ⬇️

https://you.38degrees.org.uk/petitions/keep-our-apple-data-encrypted

#e2ee #encryption #cybersecurity #cybersecuritybill #security #ukpolitics #ukpol

Encryption is essential for cybersecurity 🔐

The lack of protections for it in the UK Cyber Security Bill, coupled with the UK's encryption-breaching order against Apple, shows a lack of seriousness about the threats we face.

Sign and share our petition to send a message ⬇️

https://you.38degrees.org.uk/petitions/keep-our-apple-data-encrypted

#e2ee #encryption #cybersecurity #cybersecuritybill #security #ukpolitics #ukpol

The UK Cyber Security and Resilience Bill is an opportunity to assess and reduce the UK’s dependence on large US corporations for vital government infrastructure.

Other countries, such as France and the Netherlands, are already debating how to do this, through open source software for example.

https://arstechnica.com/information-technology/2025/03/europe-is-looking-for-alternatives-to-us-cloud-providers/

#cybersecurity #cybersecuritybill #ukpolitics #ukpol #security #OpenSource

“The UK cannot claim to be strengthening the country’s cyber defences while at the same time issuing notices to companies like Apple and demanding that they reduce the security of the services they offer."

🗣️ @JamesBaker – ORG Programme Manager.

https://www.computerweekly.com/news/366619260/Top-cryptography-experts-join-calls-for-UK-to-drop-plans-to-snoop-on-Apples-encrypted-data

#encryption #cybersecurity #cybersecuritybill #security #ukpolitics #ukpol #e2ee #apple

NEW: The UK government has published its Cyber Security Bill and there are glaring holes.

Missing:

🔴 Protections for encryption.
🔴 Reduction of our dependence on US corporations for vital UK government infrastructure, such as through open source software.

Read our response ⬇️

https://www.openrightsgroup.org/press-releases/org-response-to-cyber-security-bill/

#cybersecurity #cybersecuritybill #security #encryption #opensource #ukpolitics #ukpol

After about a month of researching, documenting, and writing, this piece is out. Out of my brain, out of my soul.

Knowledge hurts sometimes. Acting consciously is so empowering though, and liberating.

Thanks @Ullilust and @Xeniax for allowing me to include your images and words.

My and @davidrevoy's illustrations in the article are CC-BY 4.0.

https://www.illugination.com/not-in-my-name/

#degoogle #notinmyname #surveillance #surveillancecapitalism #privacy #security #opensource #fediverse #movetothefediverse

After about a month of researching, documenting, and writing, this piece is out. Out of my brain, out of my soul.

Knowledge hurts sometimes. Acting consciously is so empowering though, and liberating.

Thanks @Ullilust and @Xeniax for allowing me to include your images and words.

My and @davidrevoy's illustrations in the article are CC-BY 4.0.

https://www.illugination.com/not-in-my-name/

#degoogle #notinmyname #surveillance #surveillancecapitalism #privacy #security #opensource #fediverse #movetothefediverse

After about a month of researching, documenting, and writing, this piece is out. Out of my brain, out of my soul.

Knowledge hurts sometimes. Acting consciously is so empowering though, and liberating.

Thanks @Ullilust and @Xeniax for allowing me to include your images and words.

My and @davidrevoy's illustrations in the article are CC-BY 4.0.

https://www.illugination.com/not-in-my-name/

#degoogle #notinmyname #surveillance #surveillancecapitalism #privacy #security #opensource #fediverse #movetothefediverse

🖥️ Today is World Backup Day – a reminder to secure your data! At @mailbox_org you benefit from automatic server backups, encrypted storage, and high security standards in German data centers. Stay in control of your e-mails and files!

#WorldBackupDay #Privacy #Security #DigitalSovereignty #mailboxorg

In case you missed it: #ProtonVPN integrates with #Vivaldi browser for enhanced #privacy and #security.

Hide your IP address, access global content, and block malicious scripts with #opensource encryption standards.

🧵 👇 #vpn #browser

In case you missed it: #ProtonVPN integrates with #Vivaldi browser for enhanced #privacy and #security.

Hide your IP address, access global content, and block malicious scripts with #opensource encryption standards.

🧵 👇 #vpn #browser

🖥️ Today is World Backup Day – a reminder to secure your data! At @mailbox_org you benefit from automatic server backups, encrypted storage, and high security standards in German data centers. Stay in control of your e-mails and files!

#WorldBackupDay #Privacy #Security #DigitalSovereignty #mailboxorg

Why is it that Home Depot has passkey support and my bank still wants me to answer those three questions?

#security #SecurityFail #FacePalm

So after listening to your feedback, I agree: let’s spend that money in the EU to create a publicly-owned, free and open ACME-compatible certificate authority.

See post quoted below, with links to Tom’s work as he’s already been thinking/working on this.

#EU #ACME #TLS #security #LetsEncrypt #technologyCommons #SmallTech https://mamot.fr/@tdelmas/114224564125819333

Why You Should (Still) Use Signal As Much As Possible

As I write this in March 2025, there is a lot of confusion about Signal messenger due to the recent news of people using Signal in government, and subsequent leaks.

The short version is: there was no problem with Signal here. People were using it because they understood it to be secure, not the other way around.

Both the government and the Electronic Frontier Foundation recommend people use Signal. This is an unusual alliance, and in the case of the government, was prompted because it understood other countries had a persistent attack against American telephone companies and SMS traffic.

So let’s dive in. I’ll cover some basics of what security is, what happened in this situation, and why Signal is a good idea.

This post isn’t for programmers that work with cryptography every day. Rather, I hope it can make some of these concepts accessible to everyone else.

What makes communications secure?

When most people are talking about secure communications, they mean some combination of these properties:

1. Privacy - nobody except the intended recipient can decode a message.
2. Authentication - guarantees that the person you are chatting with really is the intended recipient.
3. Ephemerality - preventing a record of the communication from being stored. That is, making it more like a conversation around the table than a written email.
4. Anonymity - keeping your set of contacts to yourself and even obfuscating the fact that communications are occurring.

If you think about it, most people care the most about the first two. In fact, authentication is a key part of privacy. There is an attack known as man in the middle in which somebody pretends to be the intended recipient. The interceptor reads the messages, and then passes them on to the real intended recipient. So we can’t really have privacy without authentication.

I’ll have more to say about these later. For now, let’s discuss attack scenarios.

What compromises security?

There are a number of ways that security can be compromised. Let’s think through some of them:

Communications infrastructure snooping

Let’s say you used no encryption at all, and connected to public WiFi in a coffee shop to send your message. Who all could potentially see it?

• The owner of the coffee shop’s WiFi
• The coffee shop’s Internet provider
• The recipient’s Internet provider
• Any Internet providers along the network between the sender and the recipient
• Any government or institution that can compel any of the above to hand over copies of the traffic
• Any hackers that compromise any of the above systems

Back in the early days of the Internet, most traffic had no encryption. People were careful about putting their credit cards into webpages and emails because they knew it was easy to intercept them. We have been on a decades-long evolution towards more pervasive encryption, which is a good thing.

Text messages (SMS) follow a similar path to the above scenario, and are unencrypted. We know that all of the above are ways people’s texts can be compromised; for instance, governments can issue search warrants to obtain copies of texts, and China is believed to have a persistent hack into western telcos. SMS fails all four of our attributes of secure communication above (privacy, authentication, ephemerality, and anonymity).

Also, think about what information is collected from SMS and by who. Texts you send could be retained in your phone, the recipient’s phone, your phone company, their phone company, and so forth. They might also live in cloud backups of your devices. You only have control over your own phone’s retention.

So defenses against this involve things like:

• Strong end-to-end encryption, so no intermediate party – even the people that make the app – can snoop on it.
• Using strong authentication of your peers
• Taking steps to prevent even app developers from being able to see your contact list or communication history

You may see some other apps saying they use strong encryption or use the Signal protocol. But while they may do that for some or all of your message content, they may still upload your contact list, history, location, etc. to a central location where it is still vulnerable to these kinds of attacks.

When you think about anonymity, think about it like this: if you send a letter to a friend every week, every postal carrier that transports it – even if they never open it or attempt to peak inside – will be able to read the envelope and know that you communicate on a certain schedule with that friend. The same can be said of SMS, email, or most encrypted chat operators. Signal’s design prevents it from retaining even this information, though nation-states or ISPs might still be able to notice patterns (every time you send something via Signal, your contact receives something from Signal a few milliseconds later). It is very difficult to provide perfect anonymity from well-funded adversaries, even if you can provide very good privacy.

Device compromise

Let’s say you use an app with strong end-to-end encryption. This takes away some of the easiest ways someone could get to your messages. But it doesn’t take away all of them.

What if somebody stole your phone? Perhaps the phone has a password, but if an attacker pulled out the storage unit, could they access your messages without a password? Or maybe they somehow trick or compel you into revealing your password. Now what?

An even simpler attack doesn’t require them to steal your device at all. All they need is a few minutes with it to steal your SIM card. Now they can receive any texts sent to your number - whether from your bank or your friend. Yikes, right?

Signal stores your data in an encrypted form on your device. It can protect it in various ways. One of the most important protections is ephemerality - it can automatically delete your old texts. A text that is securely erased can never fall into the wrong hands if the device is compromised later.

An actively-compromised phone, though, could still give up secrets. For instance, what if a malicious keyboard app sent every keypress to an adversary? Signal is only as secure as the phone it runs on – but still, it protects against a wide variety of attacks.

Untrustworthy communication partner

Perhaps you are sending sensitive information to a contact, but that person doesn’t want to keep it in confidence. There is very little you can do about that technologically; with pretty much any tool out there, nothing stops them from taking a picture of your messages and handing the picture off.

Environmental compromise

Perhaps your device is secure, but a hidden camera still captures what’s on your screen. You can take some steps against things like this, of course.

Human error

Sometimes humans make mistakes. For instance, the reason a reporter got copies of messages recently was because a participant in a group chat accidentally added him (presumably that participant meant to add someone else and just selected the wrong name). Phishing attacks can trick people into revealing passwords or other sensitive data. Humans are, quite often, the weakest link in the chain.

Protecting yourself

So how can you protect yourself against these attacks? Let’s consider:

• Use a secure app like Signal that uses strong end-to-end encryption where even the provider can’t access your messages
• Keep your software and phone up-to-date
• Be careful about phishing attacks and who you add to chat rooms
• Be aware of your surroundings; don’t send sensitive messages where people might be looking over your shoulder with their eyes or cameras

There are other methods besides Signal. For instance, you could install GnuPG (GPG) on a laptop that has no WiFi card or any other way to connect it to the Internet. You could always type your messages on that laptop, encrypt them, copy the encrypted text to a floppy disk (or USB device), take that USB drive to your Internet computer, and send the encrypted message by email or something. It would be exceptionally difficult to break the privacy of messages in that case (though anonymity would be mostly lost). Even if someone got the password to your “secure” laptop, it wouldn’t do them any good unless they physically broke into your house or something. In some ways, it is probably safer than Signal. (For more on this, see my article How gapped is your air?)

But, that approach is hard to use. Many people aren’t familiar with GnuPG. You don’t have the convenience of sending a quick text message from anywhere. Security that is hard to use most often simply isn’t used. That is, you and your friends will probably just revert back to using insecure SMS instead of this GnuPG approach because SMS is so much easier.

Signal strikes a unique balance of providing very good security while also being practical, easy, and useful. For most people, it is the most secure option available.

Signal is also open source; you don’t have to trust that it is as secure as it says, because you can inspect it for yourself. Also, while it’s not federated, I previously addressed that.

Government use

If you are a government, particularly one that is highly consequential to the world, you can imagine that you are a huge target. Other nations are likely spending billions of dollars to compromise your communications. Signal itself might be secure, but if some other government can add spyware to your phones, or conduct a successful phishing attack, you can still have your communications compromised.

I have no direct knowledge, but I think it is generally understood that the US government maintains communications networks that are entirely separate from the Internet and can only be accessed from secure physical locations and secure rooms. These can be even more secure than the average person using Signal because they can protect against things like environmental compromise, human error, and so forth. The scandal in March of 2025 happened because government employees were using Signal rather than official government tools for sensitive information, had taken advantage of Signal’s ephemerality (laws require records to be kept), and through apparent human error had directly shared this information with a reporter. Presumably a reporter would have lacked access to the restricted communications networks in the first place, so that wouldn’t have been possible.

This doesn’t mean that Signal is bad. It just means that somebody that can spend billions of dollars on security can be more secure than you. Signal is still a great tool for people, and in many cases defeats even those that can spend lots of dollars trying to defeat it.

And remember - to use those restricted networks, you have to go to specific rooms in specific buildings. They are still not as convenient as what you carry around in your pocket.

Conclusion

Signal is practical security. Do you want phone companies reading your messages? How about Facebook or X? Have those companies demonstrated that they are completely trustworthy throughout their entire history?

I say no. So, go install Signal. It’s the best, most practical tool we have.

This post is also available on my website, where it may be periodically updated.

#privacy #security #signal

Why You Should (Still) Use Signal As Much As Possible

As I write this in March 2025, there is a lot of confusion about Signal messenger due to the recent news of people using Signal in government, and subsequent leaks.

The short version is: there was no problem with Signal here. People were using it because they understood it to be secure, not the other way around.

Both the government and the Electronic Frontier Foundation recommend people use Signal. This is an unusual alliance, and in the case of the government, was prompted because it understood other countries had a persistent attack against American telephone companies and SMS traffic.

So let’s dive in. I’ll cover some basics of what security is, what happened in this situation, and why Signal is a good idea.

This post isn’t for programmers that work with cryptography every day. Rather, I hope it can make some of these concepts accessible to everyone else.

What makes communications secure?

When most people are talking about secure communications, they mean some combination of these properties:

1. Privacy - nobody except the intended recipient can decode a message.
2. Authentication - guarantees that the person you are chatting with really is the intended recipient.
3. Ephemerality - preventing a record of the communication from being stored. That is, making it more like a conversation around the table than a written email.
4. Anonymity - keeping your set of contacts to yourself and even obfuscating the fact that communications are occurring.

If you think about it, most people care the most about the first two. In fact, authentication is a key part of privacy. There is an attack known as man in the middle in which somebody pretends to be the intended recipient. The interceptor reads the messages, and then passes them on to the real intended recipient. So we can’t really have privacy without authentication.

I’ll have more to say about these later. For now, let’s discuss attack scenarios.

What compromises security?

There are a number of ways that security can be compromised. Let’s think through some of them:

Communications infrastructure snooping

Let’s say you used no encryption at all, and connected to public WiFi in a coffee shop to send your message. Who all could potentially see it?

• The owner of the coffee shop’s WiFi
• The coffee shop’s Internet provider
• The recipient’s Internet provider
• Any Internet providers along the network between the sender and the recipient
• Any government or institution that can compel any of the above to hand over copies of the traffic
• Any hackers that compromise any of the above systems

Back in the early days of the Internet, most traffic had no encryption. People were careful about putting their credit cards into webpages and emails because they knew it was easy to intercept them. We have been on a decades-long evolution towards more pervasive encryption, which is a good thing.

Text messages (SMS) follow a similar path to the above scenario, and are unencrypted. We know that all of the above are ways people’s texts can be compromised; for instance, governments can issue search warrants to obtain copies of texts, and China is believed to have a persistent hack into western telcos. SMS fails all four of our attributes of secure communication above (privacy, authentication, ephemerality, and anonymity).

Also, think about what information is collected from SMS and by who. Texts you send could be retained in your phone, the recipient’s phone, your phone company, their phone company, and so forth. They might also live in cloud backups of your devices. You only have control over your own phone’s retention.

So defenses against this involve things like:

• Strong end-to-end encryption, so no intermediate party – even the people that make the app – can snoop on it.
• Using strong authentication of your peers
• Taking steps to prevent even app developers from being able to see your contact list or communication history

You may see some other apps saying they use strong encryption or use the Signal protocol. But while they may do that for some or all of your message content, they may still upload your contact list, history, location, etc. to a central location where it is still vulnerable to these kinds of attacks.

When you think about anonymity, think about it like this: if you send a letter to a friend every week, every postal carrier that transports it – even if they never open it or attempt to peak inside – will be able to read the envelope and know that you communicate on a certain schedule with that friend. The same can be said of SMS, email, or most encrypted chat operators. Signal’s design prevents it from retaining even this information, though nation-states or ISPs might still be able to notice patterns (every time you send something via Signal, your contact receives something from Signal a few milliseconds later). It is very difficult to provide perfect anonymity from well-funded adversaries, even if you can provide very good privacy.

Device compromise

Let’s say you use an app with strong end-to-end encryption. This takes away some of the easiest ways someone could get to your messages. But it doesn’t take away all of them.

What if somebody stole your phone? Perhaps the phone has a password, but if an attacker pulled out the storage unit, could they access your messages without a password? Or maybe they somehow trick or compel you into revealing your password. Now what?

An even simpler attack doesn’t require them to steal your device at all. All they need is a few minutes with it to steal your SIM card. Now they can receive any texts sent to your number - whether from your bank or your friend. Yikes, right?

Signal stores your data in an encrypted form on your device. It can protect it in various ways. One of the most important protections is ephemerality - it can automatically delete your old texts. A text that is securely erased can never fall into the wrong hands if the device is compromised later.

An actively-compromised phone, though, could still give up secrets. For instance, what if a malicious keyboard app sent every keypress to an adversary? Signal is only as secure as the phone it runs on – but still, it protects against a wide variety of attacks.

Untrustworthy communication partner

Perhaps you are sending sensitive information to a contact, but that person doesn’t want to keep it in confidence. There is very little you can do about that technologically; with pretty much any tool out there, nothing stops them from taking a picture of your messages and handing the picture off.

Environmental compromise

Perhaps your device is secure, but a hidden camera still captures what’s on your screen. You can take some steps against things like this, of course.

Human error

Sometimes humans make mistakes. For instance, the reason a reporter got copies of messages recently was because a participant in a group chat accidentally added him (presumably that participant meant to add someone else and just selected the wrong name). Phishing attacks can trick people into revealing passwords or other sensitive data. Humans are, quite often, the weakest link in the chain.

Protecting yourself

So how can you protect yourself against these attacks? Let’s consider:

• Use a secure app like Signal that uses strong end-to-end encryption where even the provider can’t access your messages
• Keep your software and phone up-to-date
• Be careful about phishing attacks and who you add to chat rooms
• Be aware of your surroundings; don’t send sensitive messages where people might be looking over your shoulder with their eyes or cameras

There are other methods besides Signal. For instance, you could install GnuPG (GPG) on a laptop that has no WiFi card or any other way to connect it to the Internet. You could always type your messages on that laptop, encrypt them, copy the encrypted text to a floppy disk (or USB device), take that USB drive to your Internet computer, and send the encrypted message by email or something. It would be exceptionally difficult to break the privacy of messages in that case (though anonymity would be mostly lost). Even if someone got the password to your “secure” laptop, it wouldn’t do them any good unless they physically broke into your house or something. In some ways, it is probably safer than Signal. (For more on this, see my article How gapped is your air?)

But, that approach is hard to use. Many people aren’t familiar with GnuPG. You don’t have the convenience of sending a quick text message from anywhere. Security that is hard to use most often simply isn’t used. That is, you and your friends will probably just revert back to using insecure SMS instead of this GnuPG approach because SMS is so much easier.

Signal strikes a unique balance of providing very good security while also being practical, easy, and useful. For most people, it is the most secure option available.

Signal is also open source; you don’t have to trust that it is as secure as it says, because you can inspect it for yourself. Also, while it’s not federated, I previously addressed that.

Government use

If you are a government, particularly one that is highly consequential to the world, you can imagine that you are a huge target. Other nations are likely spending billions of dollars to compromise your communications. Signal itself might be secure, but if some other government can add spyware to your phones, or conduct a successful phishing attack, you can still have your communications compromised.

I have no direct knowledge, but I think it is generally understood that the US government maintains communications networks that are entirely separate from the Internet and can only be accessed from secure physical locations and secure rooms. These can be even more secure than the average person using Signal because they can protect against things like environmental compromise, human error, and so forth. The scandal in March of 2025 happened because government employees were using Signal rather than official government tools for sensitive information, had taken advantage of Signal’s ephemerality (laws require records to be kept), and through apparent human error had directly shared this information with a reporter. Presumably a reporter would have lacked access to the restricted communications networks in the first place, so that wouldn’t have been possible.

This doesn’t mean that Signal is bad. It just means that somebody that can spend billions of dollars on security can be more secure than you. Signal is still a great tool for people, and in many cases defeats even those that can spend lots of dollars trying to defeat it.

And remember - to use those restricted networks, you have to go to specific rooms in specific buildings. They are still not as convenient as what you carry around in your pocket.

Conclusion

Signal is practical security. Do you want phone companies reading your messages? How about Facebook or X? Have those companies demonstrated that they are completely trustworthy throughout their entire history?

I say no. So, go install Signal. It’s the best, most practical tool we have.

This post is also available on my website, where it may be periodically updated.

#privacy #security #signal

In an EO, #Trump hit the elite firm w/many of the same penalties that he had applied to its competitors who had taken on cases or causes he did not like.

He directed the cancellation of all govt contracts w/ #WilmerHale, & the suspension of any #security clearances of its employees. The order also barred WilmerHale employees from federal buildings [Federal Court buildings fall into the category], banned them from communicating w/govt employees & prevented them from being hired at govt agencies.

After the article from The Atlantic, I've seen a lot of misinformation circulating among journalists. I'm not getting into the political side of things, but many are focusing on the fact that Signal was used, claiming it's "not encrypted" or "not secure." This really saddens me because it spreads the wrong message.

#Signal #Privacy #Security #Encryption #Misinformation #TechNews #Journalism

How to Protect Your Web Applications From XSS, by @torgo (@w3c):

https://www.w3.org/blog/2025/how-to-protect-your-web-applications-from-xss/

#howtos #webapps #security #xss

My team at Polytechnic Institute of Paris/Télécom #Paris school of engineering is looking for a research engineer to conduct development and empirical experiments in various fields, including: #software #security and #SoftwareEngineering.

Programming skills in #Rust are particularly welcome, but we are polyglots and would also welcome #C/#Java/#OCaml developers 😉

Permanent position (French "CDI"), on site in the south of Paris.

Full job description at: https://institutminestelecom.recruitee.com/l/en/o/ingenieure-ou-ingenieur-de-recherche-en-informatique

#getfedihired

So after listening to your feedback, I agree: let’s spend that money in the EU to create a publicly-owned, free and open ACME-compatible certificate authority.

See post quoted below, with links to Tom’s work as he’s already been thinking/working on this.

#EU #ACME #TLS #security #LetsEncrypt #technologyCommons #SmallTech https://mamot.fr/@tdelmas/114224564125819333

Interesting Git repos of the week:

Detection:

* https://github.com/tstromberg/ucd - hunt for unauthorised changes
* https://github.com/mnrkbys/fjta - check for anomalies in your FS timeline

Exploitation:

* https://github.com/hardenedlinux/tzram-audit - audit your TrustZone implementatation

Nerd:

* https://gist.github.com/halcy/b4f455ef05c4c36906107e9367b8dd63 the Fediverse in FUSE

#security, #research, #code

My team at Polytechnic Institute of Paris/Télécom #Paris school of engineering is looking for a research engineer to conduct development and empirical experiments in various fields, including: #software #security and #SoftwareEngineering.

Programming skills in #Rust are particularly welcome, but we are polyglots and would also welcome #C/#Java/#OCaml developers 😉

Permanent position (French "CDI"), on site in the south of Paris.

Full job description at: https://institutminestelecom.recruitee.com/l/en/o/ingenieure-ou-ingenieur-de-recherche-en-informatique

#getfedihired

Quick tip! You can actually see the changelog details for Debian/Ubuntu packages, which includes security info, CVEs, package urgency, and a short description. Super helpful for figuring out if you need to patch right away or schedule downtime, especially if you're working with clusters. For example, here is how to see info about the nginx:

apt changelog nginx

See https://www.cyberciti.biz/faq/debian-ubuntu-linux-show-package-changelog-command/ for more info.

#linux #debian #ubuntu #opensource #security

Quick tip! You can actually see the changelog details for Debian/Ubuntu packages, which includes security info, CVEs, package urgency, and a short description. Super helpful for figuring out if you need to patch right away or schedule downtime, especially if you're working with clusters. For example, here is how to see info about the nginx:

apt changelog nginx

See https://www.cyberciti.biz/faq/debian-ubuntu-linux-show-package-changelog-command/ for more info.

#linux #debian #ubuntu #opensource #security

How to Protect Your Web Applications From XSS, by @torgo (@w3c):

https://www.w3.org/blog/2025/how-to-protect-your-web-applications-from-xss/

#howtos #webapps #security #xss

Interesting Git repos of the week:

Detection:

* https://github.com/tstromberg/ucd - hunt for unauthorised changes
* https://github.com/mnrkbys/fjta - check for anomalies in your FS timeline

Exploitation:

* https://github.com/hardenedlinux/tzram-audit - audit your TrustZone implementatation

Nerd:

* https://gist.github.com/halcy/b4f455ef05c4c36906107e9367b8dd63 the Fediverse in FUSE

#security, #research, #code

Oh, great. #Pixelfed had a broken implementation of "follower-only" posts, _and_ fucked up the disclosure / bugfix release process.

https://fokus.cool/2025/03/25/pixelfed-vulnerability.html

Summary of the bug: If you have a protected account (on Pixelfed, Mastodon, GTS, whatever) and a Pixelfed user followed you and got approved by you, _all_ users on that instance were now able to see your followers-only posts, not just the one you approved.

#Fediverse #ActivityPub #security #fail

#EdDavey, Ldr of the #UK’s Liberal Democrats:

“#JDVance & his mates clearly aren't fit to run a group chat, let alone the world's strongest #military force. It has to make our #security services nervous about the #intelligence we're sharing with them.”

“#Trump's #WhiteHouse can't be trusted. Their reckless approach to security means it's only a matter of time before British intelligence is leaked.

“The Govt must urgently review our intelligence-sharing arrangements with the US.”

#geopolitics

Uh, is it normal for an automated #security scanner to be unaware of #debian patched packages?

Like how OpenSSH 9.2p1 is vulnerable to CVE-2023-38408 but the Debian version 1:9.2p1-2+deb12u5 is patched. But the security scanner sees the "9.2p1" string and sounds the alarm.

https://security-tracker.debian.org/tracker/CVE-2023-38408

Is this a common problem for people running Debian servers?

This is a pretty cool yet somewhat creepy website lol.

https://www.deviceinfo.me/

#chrome #firefox #brave #duckduckgo #microsoft #microsoftedge #edge #opera #operagx #safari #vivaldi #chromium #ungoogle #torbrowser #mullvad #mullvadbrowser #librewolf #cromite #firefoxfocus #yandex #privacy #security #ungoogledchromium #linux #windows #ios #android #mac #macos

This is a pretty cool yet somewhat creepy website lol.

https://www.deviceinfo.me/

#chrome #firefox #brave #duckduckgo #microsoft #microsoftedge #edge #opera #operagx #safari #vivaldi #chromium #ungoogle #torbrowser #mullvad #mullvadbrowser #librewolf #cromite #firefoxfocus #yandex #privacy #security #ungoogledchromium #linux #windows #ios #android #mac #macos

Blogged: Creating a software bill of materials (SBOM) for an open-source NuGet package

https://andrewlock.net/creating-a-software-bill-of-materials-sbom-for-an-open-source-nuget-package/

In this post I discuss several tools you can use to create a software bill of materials (SBOM) for an application or a NuGet package

#nuget #security

Hi all, been lurking for a few days but introducing myself now! I'm Matt and a #security reporter at WIRED. Like many others here, I'm coming to Mastodon after the chaos at the bird site in the last week.

The things I cover on a regular basis are #privacy, cybersecurity, #surveillance, internet freedom, #tech and human rights, and a bunch more things in the wider security realm.

I'm based in #London—and have lived here for the last decade—so I'm often reporting on issues from across Europe. When not writing words for the web, I'm often found #running and have been dabbling in the #ultramarathon a few times over the last few years #introduction (edited to add introduction hashtag)

Want do do a PhD in Computer Science in the heart of Europe? We are hiring!

10 FWF-funded positions at TU Wien for doctoral students in our newly founded doctoral college on

Automated Reasoning (https://forsyte.at/docfunds/)

Come to Vienna (repeatedly ranked the world's most livable city) to work with an amazing team on on exciting topics at the intersection of security and artificial intelligence with Automated Reasoning at the core!

Deadline: May 18, 2025
Start: October 2025 (or soon after)
Details: https://forsyte.at/docfunds/

#phdposition #phd #hiring #automatedreasoning #security #artificial_intelligence #FWF

I kept seeing people misunderstanding the differences between privacy, security, and anonymity. So I created a video at @privacyguides to educate people on the differences between them!

It's essential to know the distinction between them so you can make educated decisions on what tools to utilise for your situation. 🔒

➡️ Watch it here: https://www.privacyguides.org/videos/2025/03/14/stop-confusing-privacy-anonymity-and-security/

#privacyguides #privacy #security

I kept seeing people misunderstanding the differences between privacy, security, and anonymity. So I created a video at @privacyguides to educate people on the differences between them!

It's essential to know the distinction between them so you can make educated decisions on what tools to utilise for your situation. 🔒

➡️ Watch it here: https://www.privacyguides.org/videos/2025/03/14/stop-confusing-privacy-anonymity-and-security/

#privacyguides #privacy #security

I kept seeing people misunderstanding the differences between privacy, security, and anonymity. So I created a video at @privacyguides to educate people on the differences between them!

It's essential to know the distinction between them so you can make educated decisions on what tools to utilise for your situation. 🔒

➡️ Watch it here: https://www.privacyguides.org/videos/2025/03/14/stop-confusing-privacy-anonymity-and-security/

#privacyguides #privacy #security

Herzlichen Glückwunsch! 🎉 Denn wenn du das hier lesen kannst, hast du sehr vieles richtig gemacht. Das unabhängige #Fediverse geht aber noch weit über Mastodon hinaus. In unserem kurz&mündig Band 16 erfährst du mehr über das dezentrale Social-Media-Universum

Band 16 der Reihe kurz&mündig
Autor.innen: Leena Simon 🔗 muendigkeit.digital und Christian Pietsch
A6, 28 Seiten, ISBN 978-3-934636-45-3
5 Euro, https://shop.digitalcourage.de

#digitalcourage #kurzundmündig #kum #wissenfürdiehosentasche #digitalmündig #datenschutz #freiheit #freedom #humanrights #privacy #security #grundrecht

Herzlichen Glückwunsch! 🎉 Denn wenn du das hier lesen kannst, hast du sehr vieles richtig gemacht. Das unabhängige #Fediverse geht aber noch weit über Mastodon hinaus. In unserem kurz&mündig Band 16 erfährst du mehr über das dezentrale Social-Media-Universum

Band 16 der Reihe kurz&mündig
Autor.innen: Leena Simon 🔗 muendigkeit.digital und Christian Pietsch
A6, 28 Seiten, ISBN 978-3-934636-45-3
5 Euro, https://shop.digitalcourage.de

#digitalcourage #kurzundmündig #kum #wissenfürdiehosentasche #digitalmündig #datenschutz #freiheit #freedom #humanrights #privacy #security #grundrecht

Zoom In On This
https://talkingpointsmemo.com/edblog/zoom-in-on-this

"DOGE went to the private #security contractor working for #USIP ...said, you don’t have a clear #legal or ethical ability to do this. But if you don’t want to lose all your federal contracts, you have to. And they did...

There are a lot of very large federal security contractors who wield #violence & force on behalf of the #US govt... those contractors are also extremely vulnerable to #DOGE because DOGE can make contracts disappear"

#Musk #News #USA

This week we’re tackling some common misconceptions with privacy, security, and anonymity!

Often privacy and anonymity are used interchangeably. However, there are distinct differences between the two. In our latest video, we aim to explain and discuss the differences, so you can make better decisions on your privacy and security journey.

https://www.privacyguides.org/videos/2025/03/14/stop-confusing-privacy-anonymity-and-security/

#Privacy #Security #Anonymity #PrivacyGuides #Video

Elon Musk’s Starlink Takes Over the White House

The world’s richest man now has control over the internet at the White House.
https://newrepublic.com/post/192855/elon-musk-white-house-starlink-internet

"numerous #conflicts of interest & #ethics issues. #Musk already collects billions of dollars through his #government contracts, & controls #Starlink. If #WhiteHouse employees are using the #internet service, he could have access to their #data... questions as to how secure Starlink’s #network is."

#ElonMusk #Coup #Tech #Security #News #US #USA

Elon Musk’s Starlink Expands Across White House Complex

#Trump admn officials said the company donated the #internet service, saying the gift had been vetted by the lawyer overseeing ethics issues in the #WhiteHouse Counsel’s Office.
https://www.nytimes.com/2025/03/17/us/politics/elon-musk-starlink-white-house.html

" #Musk... controls Starlink...

the White House “was aware of DOGE’s intentions...” and that it “did not consider this matter a security incident or #security breach.”

#ElonMusk #Coup #Corruption #GOP #Politics #USPol #News #US #USA

Elon Musk’s DOGE Guts U.S. Nuclear Agency

DOGE cuts have hit some of the country’s top nuclear scientists.
https://newrepublic.com/post/192825/elon-musk-doge-cuts-nuclear-scientists

"Several #nuclear scientists, bomb engineers, & #safety experts critical to #NationalSecurity were among the cuts...

the wanton, haphazard budget cuts championed by #Musk & the #GOP... Many people who left the agency held top-secret #security clearances, and it will be tough to train replacements."

#ElonMusk #Doge #Trump #Politics #USPol #Science #News #US #USA

New Privacy Guides article 🔐✨
by me:

If you want to keep your password manager local-only, KeePassXC is a great solution!

It's free,
Open-source,
Easy to install and use,
Doesn't require an account,
Works on Linux, macOS, and Windows,
And the team is here! 👉 @keepassxc

Here's how to set it up with a YubiKey: https://www.privacyguides.org/articles/2025/03/18/installing-keepassxc-and-yubikey/

#PrivacyGuides #KeePassXC #Privacy #Security #PasswordManager #Passwords #FOSS

Come work with me!

#Monterey #MontereyBayAquarium #Security #GetFediHired #Jobs #Hiring

https://candidateportal.creativecircle.com/job-detail/796730

New Privacy Guides article 🔐✨
by me:

If you want to keep your password manager local-only, KeePassXC is a great solution!

It's free,
Open-source,
Easy to install and use,
Doesn't require an account,
Works on Linux, macOS, and Windows,
And the team is here! 👉 @keepassxc

Here's how to set it up with a YubiKey: https://www.privacyguides.org/articles/2025/03/18/installing-keepassxc-and-yubikey/

#PrivacyGuides #KeePassXC #Privacy #Security #PasswordManager #Passwords #FOSS

New Privacy Guides article 🔐✨
by me:

If you want to keep your password manager local-only, KeePassXC is a great solution!

It's free,
Open-source,
Easy to install and use,
Doesn't require an account,
Works on Linux, macOS, and Windows,
And the team is here! 👉 @keepassxc

Here's how to set it up with a YubiKey: https://www.privacyguides.org/articles/2025/03/18/installing-keepassxc-and-yubikey/

#PrivacyGuides #KeePassXC #Privacy #Security #PasswordManager #Passwords #FOSS

New Privacy Guides article 🔐✨
by me:

If you want to keep your password manager local-only, KeePassXC is a great solution!

It's free,
Open-source,
Easy to install and use,
Doesn't require an account,
Works on Linux, macOS, and Windows,
And the team is here! 👉 @keepassxc

Here's how to set it up with a YubiKey: https://www.privacyguides.org/articles/2025/03/18/installing-keepassxc-and-yubikey/

#PrivacyGuides #KeePassXC #Privacy #Security #PasswordManager #Passwords #FOSS

Blogged: Creating provenance attestations for NuGet packages in GitHub Actions

https://andrewlock.net/creating-provenance-attestations-for-nuget-packages-in-github-actions/

In this post I discuss software provenance, what attestations say about your software, how they work, how to create an attestation for a NuGet package, and why that doesn't really work 😅

#dotnet #security

Mastodon friends, I've heard a few suggestions of companies moving from US cloud providers to those based in the EU, due to risks with the Trump administration/Cloud Act, etc.

Has anyone come across any businesses that have made the leap recently? Feel free to DM or message on Signal, mattburgess.20

#infosec #privacy #cloud #security

DOGE Cuts Reach Key Nuclear Scientists, Bomb Engineers & Safety Experts

Firings & buyouts hit the top-secret National Nuclear Safety Admn amid a major effort to upgrade America’s #nuclear arsenal. Critics say it shows the consequences of heedlessly cutting the federal work force.
https://www.nytimes.com/2025/03/17/us/politics/federal-job-cuts-nuclear-bomb-engineers-scientists.html

"Officials had initially expected that the nuclear agency’s #NationalSecurity mission would protect it from layoffs."

#ElonMusk #Musk #Doge #Trump #GOP #USPol #Politics #Security #News #USA

Mastodon friends, I've heard a few suggestions of companies moving from US cloud providers to those based in the EU, due to risks with the Trump administration/Cloud Act, etc.

Has anyone come across any businesses that have made the leap recently? Feel free to DM or message on Signal, mattburgess.20

#infosec #privacy #cloud #security

I thought I had seen it all when it comes to mail delivery and security issues.

But this morning I was introduced to the fact that there are Exchange admins who will implement a rule that all incoming mail from outside their own organization should be flagged as potentially dangerous and presented to the user with the option to block sender and no option to mark the message or the sender as valid.

Yes, that for every single message.

#exchange #smtp #email #security

I thought I had seen it all when it comes to mail delivery and security issues.

But this morning I was introduced to the fact that there are Exchange admins who will implement a rule that all incoming mail from outside their own organization should be flagged as potentially dangerous and presented to the user with the option to block sender and no option to mark the message or the sender as valid.

Yes, that for every single message.

#exchange #smtp #email #security

New Privacy Guides video 📺✨
by @jw

If you've wondered about
the difference between:

Privacy,
Security,
and Anonymity

And why some privacy-focused
services are worth using even when they don't provide perfect anonymity, watch this!

It's truly an amazing short video!
Everyone should watch it 👇

https://www.privacyguides.org/videos/2025/03/14/stop-confusing-privacy-anonymity-and-security/

#PrivacyGuides #Privacy #Security #Anonymity

One more reason for this: https://arstechnica.com/gadgets/2025/03/everything-you-say-to-your-echo-will-be-sent-to-amazon-starting-on-march-28/ #alexa #security #privacy #geek

One more reason for this: https://arstechnica.com/gadgets/2025/03/everything-you-say-to-your-echo-will-be-sent-to-amazon-starting-on-march-28/ #alexa #security #privacy #geek

One more reason for this: https://arstechnica.com/gadgets/2025/03/everything-you-say-to-your-echo-will-be-sent-to-amazon-starting-on-march-28/ #alexa #security #privacy #geek

One more reason for this: https://arstechnica.com/gadgets/2025/03/everything-you-say-to-your-echo-will-be-sent-to-amazon-starting-on-march-28/ #alexa #security #privacy #geek

The battle for encryption happens TODAY. Your right to privacy and security will be decided behind your back.

We call for the hearing to be made public.

Encryption must be protected from this slippery slope.

Sign and share our petition to have your say ⬇️

https://you.38degrees.org.uk/petitions/keep-our-apple-data-encrypted

#encryption #e2ee #privacy #security #cybersecurity #ukpolitics #ukpol #tech #Apple

The battle for encryption happens TODAY. Your right to privacy and security will be decided behind your back.

We call for the hearing to be made public.

Encryption must be protected from this slippery slope.

Sign and share our petition to have your say ⬇️

https://you.38degrees.org.uk/petitions/keep-our-apple-data-encrypted

#encryption #e2ee #privacy #security #cybersecurity #ukpolitics #ukpol #tech #Apple

"This is a significant test for the battle between law enforcement and technology.”

Holding the Apple case in secret makes the legal process more cloak and dagger, less scales and sword.

It makes it harder to challenge the UK government's order to break encryption and creates a dangerous precedent.

This case sets the stage for more shady encryption-breaking orders to be made.

https://www.theguardian.com/technology/2025/mar/14/what-could-apples-high-court-challenge-mean-for-data-protection

#encryption #e2ee #Apple #ukpolitics #ukpol #privacy #security #tech #cybersecurity

This week we’re tackling some common misconceptions with privacy, security, and anonymity!

Often privacy and anonymity are used interchangeably. However, there are distinct differences between the two. In our latest video, we aim to explain and discuss the differences, so you can make better decisions on your privacy and security journey.

https://www.privacyguides.org/videos/2025/03/14/stop-confusing-privacy-anonymity-and-security/

#Privacy #Security #Anonymity #PrivacyGuides #Video

Come work with me!

#Monterey #MontereyBayAquarium #Security #GetFediHired #Jobs #Hiring

https://candidateportal.creativecircle.com/job-detail/796730

Come work with me!

#Monterey #MontereyBayAquarium #Security #GetFediHired #Jobs #Hiring

https://candidateportal.creativecircle.com/job-detail/796730

Based on the @w3c workshop "Secure the Web Forward” and thanks to work taking place in the W3C Security Web Application Guidelines (SWAG) #CommunityGroup, we are happy to release 6 videos that address the complexities of Content Security Policy and Trusted Types, by introducing open-source tooling that reduce uncertainty and complexity of configuring web #security mitigations against XSS.

▶️ https://www.w3.org/blog/2025/how-to-protect-your-web-applications-from-xss/
cc @simone @torgo

🎬 Security at W3C playlist: https://www.youtube.com/playlist?list=PLNhYw8KaLq2Wr27HLfSTD4d6JpC3G0PVr

Whisper it, the showdown over Apple encryption is THIS WEEK ⏱️

🤐 A secret tribunal will hear the appeal against the UK government’s order to carve a backdoor into Apple’s encrypted services.

🛑 Our cybersecurity and privacy shouldn’t be decided in the shadows.

https://www.computerweekly.com/news/366620363/Secret-London-tribunal-to-hear-appeal-in-Apple-vs-government-battle-over-encryption

#encryption #Apple #privacy #cybersecurity #security #e2ee #ukpolitics #ukpol

In response to the State's demand for insecurity, Apple withdrew its encrypted services from the UK and appealed.

A secret tribunal now decides 🤫

This hearing MUST happen in public.

It starts with Apple... the UK government will chomp away encryption to a rotten core.

https://www.digit.fyi/apple-to-battle-uk-gov-over-encryption-in-secret-tribunal/

#encryption #e2ee #privacy #security #cybersecurity #ukpolitics #ukpol #apple

In response to the State's demand for insecurity, Apple withdrew its encrypted services from the UK and appealed.

A secret tribunal now decides 🤫

This hearing MUST happen in public.

It starts with Apple... the UK government will chomp away encryption to a rotten core.

https://www.digit.fyi/apple-to-battle-uk-gov-over-encryption-in-secret-tribunal/

#encryption #e2ee #privacy #security #cybersecurity #ukpolitics #ukpol #apple

History is a set of lies agreed upon.

The UK government took to revisionist tactics and wiped its advice for lawyers and barristers to use Apple encrypted services.

Putting victims of crime at a greater risk of harm so you don't contradict yourself isn't a good look 🤷‍♂️

https://techcrunch.com/2025/03/06/uk-quietly-scrubs-encryption-advice-from-government-websites/

#encryption #e2ee #privacy #security #cybersecurity #ukpolitics #ukpol #apple

The UK Home Office issued a secret order under the Investigatory Powers Act to make Apple put a backdoor in its encrypted services.

This is so the government can access what's uploaded to the cloud... them and hackers alike.

Too sly sly, hush hush spy to spy.

https://www.openrightsgroup.org/press-releases/uk-government-undermines-security-with-demands-for-apple-encrypted-data/

#encryption #e2ee #privacy #security #cybersecurity #ukpolitics #ukpol #apple

The story so far...

The Investigatory Powers Act was widened last year to:

🔴 Prevent companies from rolling out encryption.
🔴 Have the UK government approve any security updates to tech products.

Surveillance first 👁️, security be damned 🗑️

https://www.openrightsgroup.org/press-releases/investigatory-powers-amendment-bill-threatens-security-and-privacy/

#encryption #e2ee #privacy #security #cybersecurity #ukpolitics #ukpol #apple

Make it rain 🌧️

The UK government’s demand for a spy hole makes your iCloud storage leaky.

All your pics, docs, finances and more are up for grabs. Hackers, blackmailers and predators will have a field day.

Sign our petition to save Apple encrypted services!

➡️ https://you.38degrees.org.uk/petitions/keep-our-apple-data-encrypted

#encryption #e2ee #privacy #security #cybersecurity #ukpolitics #ukpol #apple

🚨BREAKING🚨 The French National Assembly removed the backdoor section from the amendment to the #Narcotrafic law.

Read here how Politicians tried to undermine everybody's #security: https://tuta.com/blog/france-surveillance-nacrotrafic-law

🙏 And thank you for fighting against this with us. This is a great win for privacy, yet, the battle is not over. Together we are strong! 💪

#backdoor #encryption #privacy #security

🚨BREAKING🚨 The French National Assembly removed the backdoor section from the amendment to the #Narcotrafic law.

Read here how Politicians tried to undermine everybody's #security: https://tuta.com/blog/france-surveillance-nacrotrafic-law

🙏 And thank you for fighting against this with us. This is a great win for privacy, yet, the battle is not over. Together we are strong! 💪

#backdoor #encryption #privacy #security

Whisper it, the showdown over Apple encryption is THIS WEEK ⏱️

🤐 A secret tribunal will hear the appeal against the UK government’s order to carve a backdoor into Apple’s encrypted services.

🛑 Our cybersecurity and privacy shouldn’t be decided in the shadows.

https://www.computerweekly.com/news/366620363/Secret-London-tribunal-to-hear-appeal-in-Apple-vs-government-battle-over-encryption

#encryption #Apple #privacy #cybersecurity #security #e2ee #ukpolitics #ukpol

Whisper it, the showdown over Apple encryption is THIS WEEK ⏱️

🤐 A secret tribunal will hear the appeal against the UK government’s order to carve a backdoor into Apple’s encrypted services.

🛑 Our cybersecurity and privacy shouldn’t be decided in the shadows.

https://www.computerweekly.com/news/366620363/Secret-London-tribunal-to-hear-appeal-in-Apple-vs-government-battle-over-encryption

#encryption #Apple #privacy #cybersecurity #security #e2ee #ukpolitics #ukpol

Save Encryption. Save the World 🌐

Only by blocking message scanning technology on messaging apps can we ensure online safety!

End-to-end encryption prevents predators and hackers from weeding their way into our private lives.

We must #PracticeSafeText 💬

https://www.openrightsgroup.org/blog/the-case-for-encryption/

#e2ee #encryption #onlinesafety #onlinesafetyact #ukpolitics #ukpol #privacy #security #cybersecurity #ofcom #whatsapp #signal

Mixing up Public and Private Keys in OpenID Connect deployments - Hanno's Blog:

https://blog.hboeck.de/archives/909-Mixing-up-Public-and-Private-Keys-in-OpenID-Connect-deployments.html

#oauth #openid #security

Based on the @w3c workshop "Secure the Web Forward” and thanks to work taking place in the W3C Security Web Application Guidelines (SWAG) #CommunityGroup, we are happy to release 6 videos that address the complexities of Content Security Policy and Trusted Types, by introducing open-source tooling that reduce uncertainty and complexity of configuring web #security mitigations against XSS.

▶️ https://www.w3.org/blog/2025/how-to-protect-your-web-applications-from-xss/
cc @simone @torgo

🎬 Security at W3C playlist: https://www.youtube.com/playlist?list=PLNhYw8KaLq2Wr27HLfSTD4d6JpC3G0PVr

Carpe DM 👁️‍🗨️?

End-to-end encryption = online safety. It keeps what we send on messaging apps secure from hackers and predators.

🚫 Tell Ofcom NOT to implement message scanning powers in their consultation.

⏰ You have until 5pm TODAY!

#PracticeSafeText 💬

https://action.openrightsgroup.org/48-hours-tell-ofcom-practice-safe-text

#e2ee #encryption #onlinesafety #onlinesafetyact #ukpolitics #ukpol #privacy #security #cybersecurity #ofcom #whatsapp #signal

Carpe DM 👁️‍🗨️?

End-to-end encryption = online safety. It keeps what we send on messaging apps secure from hackers and predators.

🚫 Tell Ofcom NOT to implement message scanning powers in their consultation.

⏰ You have until 5pm TODAY!

#PracticeSafeText 💬

https://action.openrightsgroup.org/48-hours-tell-ofcom-practice-safe-text

#e2ee #encryption #onlinesafety #onlinesafetyact #ukpolitics #ukpol #privacy #security #cybersecurity #ofcom #whatsapp #signal

The State of Personal Online Security and Confidentiality | SXSW LIVE

By @Mer__edith , President Signal Foundation

A brilliant discussion on Signal, human rights, surveillance, and security. 🥳

#Signal #SXSW #Privacy #OpenSource #FOSS #MeredithWhittaker #BigTech #Security

Welcome to Jurassic Park: A Comprehensive Study of #Security Risks in #Deno and its Ecosystem

Deno 2.0 addresses many of the problems identified but it's a great paper to read.

#javascript

https://cispa.de/en/research/publications/84103-welcome-to-jurassic-park-a-comprehensive-study-of-security-risks-in-deno-and-its-ecosystem

Save Encryption. Save the World 🌐

Only by blocking message scanning technology on messaging apps can we ensure online safety!

End-to-end encryption prevents predators and hackers from weeding their way into our private lives.

We must #PracticeSafeText 💬

https://www.openrightsgroup.org/blog/the-case-for-encryption/

#e2ee #encryption #onlinesafety #onlinesafetyact #ukpolitics #ukpol #privacy #security #cybersecurity #ofcom #whatsapp #signal

Welcome to Jurassic Park: A Comprehensive Study of #Security Risks in #Deno and its Ecosystem

Deno 2.0 addresses many of the problems identified but it's a great paper to read.

#javascript

https://cispa.de/en/research/publications/84103-welcome-to-jurassic-park-a-comprehensive-study-of-security-risks-in-deno-and-its-ecosystem

🚨 Time is Running Out to Save Encryption 🔐

Ofcom is consulting on implementing message scanning powers in the UK Online Safety Act.

This would break end-to-end encryption on the messaging apps we all use!

⏰ CLOSES Monday 10 March, 5pm.

Use our tool to tell Ofcom #PracticeSafeText 💬

ACT NOW ⬇️

https://action.openrightsgroup.org/48-hours-tell-ofcom-practice-safe-text

#e2ee #encryption #OnlineSafetyAct #ukpolitics #ukpol #privacy #ofcom #security #cybersecurity #whatsapp #signal

🚨 Time is Running Out to Save Encryption 🔐

Ofcom is consulting on implementing message scanning powers in the UK Online Safety Act.

This would break end-to-end encryption on the messaging apps we all use!

⏰ CLOSES Monday 10 March, 5pm.

Use our tool to tell Ofcom #PracticeSafeText 💬

ACT NOW ⬇️

https://action.openrightsgroup.org/48-hours-tell-ofcom-practice-safe-text

#e2ee #encryption #OnlineSafetyAct #ukpolitics #ukpol #privacy #ofcom #security #cybersecurity #whatsapp #signal

GNU Emacs: new critical remote shell injection vulnerability.

Red Hat discovered a command injection flaw in the text editor Emacs. It allows a remote, unauthenticated attacker to execute any command on your computer. The vulnerability is activated when you visit a malicious website or link.

https://www.cve.org/CVERecord?id=CVE-2025-1244

---

#news #software #gnu #emacs #security #hacking #terminal #linux #cve #opensource #freesoftware

---

Mitigation: uninstall/update immediately.

New Privacy Guides article 🔑✨
by me:

If you are using a YubiKey,

you might get in some situations where you need to reset your key to factory default, and/or set up a backup of it on a spare key.

This tutorial will guide you
through each step to reset and back up your YubiKey successfully, with clear instructions and plenty of visual support.

I hope you find it helpful!

https://www.privacyguides.org/articles/2025/03/06/yubikey-reset-and-backup/

#PrivacyGuides #Privacy #Yubico #YubiKey #Security #OTP #OpenPGP #Encryption #MFA

New Privacy Guides article 🔑✨
by me:

If you are using a YubiKey,

you might get in some situations where you need to reset your key to factory default, and/or set up a backup of it on a spare key.

This tutorial will guide you
through each step to reset and back up your YubiKey successfully, with clear instructions and plenty of visual support.

I hope you find it helpful!

https://www.privacyguides.org/articles/2025/03/06/yubikey-reset-and-backup/

#PrivacyGuides #Privacy #Yubico #YubiKey #Security #OTP #OpenPGP #Encryption #MFA

New Privacy Guides article 🔑✨
by me:

If you are using a YubiKey,

you might get in some situations where you need to reset your key to factory default, and/or set up a backup of it on a spare key.

This tutorial will guide you
through each step to reset and back up your YubiKey successfully, with clear instructions and plenty of visual support.

I hope you find it helpful!

https://www.privacyguides.org/articles/2025/03/06/yubikey-reset-and-backup/

#PrivacyGuides #Privacy #Yubico #YubiKey #Security #OTP #OpenPGP #Encryption #MFA

I can't believe that Mozilla is choosing to take Firefox down this road of seemingly trying to harvest and sell their users' data, when there is already a proven method to increase their revenue with one of their own products.

Thunderbird has already proven that people are willing to support open source, privacy-friendly and well-maintained projects, especially if it's a critical part of their workflow. Just build a product that people want to use.

#Mozilla #Firefox #Privacy #Security

Since Firefox requires a "nonexclusive, royalty-free, worldwide license" to my personal data, I've finally decided to move away to another browser.

https://www.youtube.com/watch?v=Rc96ISKh2OM

The problem appears to be, though, that I'm not sure which browser to use now. Most of the alternatives seem to have questionable privacy or security.

#Firefox #Privacy #Security

#NATO #EU #USpol #security

Very interesting food for thought:

"Managing the Transatlantic Divorce: A roadmap towards a European way of war"

Warning: May make an uncomfortable read but IMHO we have to face reality as is, not as we wish it to be.

https://www.epc.eu/en/publications/Managing-the-Transatlantic-Divorce-A-roadmap-towards-a-European-way-o~62bd58

#NATO #EU #USpol #security

Very interesting food for thought:

"Managing the Transatlantic Divorce: A roadmap towards a European way of war"

Warning: May make an uncomfortable read but IMHO we have to face reality as is, not as we wish it to be.

https://www.epc.eu/en/publications/Managing-the-Transatlantic-Divorce-A-roadmap-towards-a-European-way-o~62bd58

LGBTQ people need online communities for support 🏳️‍🌈 🌐

End-to-end encryption underpins this essential lifeline with the safety of confidentiality.

It's a matter of survival, particularly for people who live with unsupportive families or in oppressive societies.

Save encryption. #PracticeSafeText 💬

https://www.openrightsgroup.org/blog/queercryption-safety-in-numbers/

#e2ee #encryption #lgbtq #lgbtqia #lgbt #queer #privacy #security #queercryption

“Strong encryption strengthens the foundation of trust online and ensures that our digital spaces remain ones where individuals can live authentically and without fear.”

Shae Gardner from LGBT Tech explains why encryption is so important for the LGBTQ community 🏳️‍🌈

#PracticeSafeText 💬

#e2ee #encryption #lgbt #lgbtq #lgbtqia #privacy #security #queer #queercryption

“Strong encryption strengthens the foundation of trust online and ensures that our digital spaces remain ones where individuals can live authentically and without fear.”

Shae Gardner from LGBT Tech explains why encryption is so important for the LGBTQ community 🏳️‍🌈

#PracticeSafeText 💬

#e2ee #encryption #lgbt #lgbtq #lgbtqia #privacy #security #queer #queercryption

LGBTQ people are core users of the Internet 🏳️‍🌈 🌐

80% participate in social networking, compared to 58% of the general public.

Messaging apps that use end-to-end encryption help to keep LGBTQ people safe.

Read more from LGBT Tech ⬇️

https://www.lgbttech.org/post/2019/11/22/lgbt-tech-release-encryption-one-sheet

#PracticeSafeText 💬

#e2ee #encryption #queercryption #privacy #security #lgbt #lgbtq #lgbtqia #queer

LGBTQ people need online communities for support 🏳️‍🌈 🌐

End-to-end encryption underpins this essential lifeline with the safety of confidentiality.

It's a matter of survival, particularly for people who live with unsupportive families or in oppressive societies.

Save encryption. #PracticeSafeText 💬

https://www.openrightsgroup.org/blog/queercryption-safety-in-numbers/

#e2ee #encryption #lgbtq #lgbtqia #lgbt #queer #privacy #security #queercryption

Welcome to Jurassic Park: A Comprehensive Study of #Security Risks in #Deno and its Ecosystem

Deno 2.0 addresses many of the problems identified but it's a great paper to read.

#javascript

https://cispa.de/en/research/publications/84103-welcome-to-jurassic-park-a-comprehensive-study-of-security-risks-in-deno-and-its-ecosystem

🧪 NEW BETA RELEASES 🧪

📱 iOS 18.4 beta 2 (22E5216h)
📱 iPadOS 18.4 beta 2 (22E5216h)
💻 macOS 15.4 beta 2 (24E5222f)
📺 tvOS 18.4 beta 2 (22L5234e)
🥽 visionOS 2.4 beta 2 (22O5215f)
⌚ watchOS 11.4 beta 2 (22T5228e)

#apple #cybersecurity #infosec #security #ios

France is about to pass the worst surveillance law in the EU.

Here's how you can stop them: 👉 https://tuta.com/blog/france-surveillance-nacrotrafic-law

#backdoor #encryption #privacy #security

@psuPete Recommends - Weekly highlights on cyber security issues, 03/01/25 https://www.llrx.com/2025/03/pete-recommends-weekly-highlights-on-cyber-security-issues-march-1-2025/ Five posts from this week: #Trump has purged government websites; The Wayback Machine trying to preserve the record; Turn off your read receipts. They’re a #security risk; You can now easily remove personal info from #Google Search results; Google plans to end #SMS verification in favor of #QR codes; and #Verizon isn’t doing enough to protect customers from #robocall scams. #cybercrime #privacy

@psuPete Recommends - Weekly highlights on cyber security issues, 03/01/25 https://www.llrx.com/2025/03/pete-recommends-weekly-highlights-on-cyber-security-issues-march-1-2025/ Five posts from this week: #Trump has purged government websites; The Wayback Machine trying to preserve the record; Turn off your read receipts. They’re a #security risk; You can now easily remove personal info from #Google Search results; Google plans to end #SMS verification in favor of #QR codes; and #Verizon isn’t doing enough to protect customers from #robocall scams. #cybercrime #privacy

🧪 NEW BETA RELEASES 🧪

📱 iOS 18.4 beta 2 (22E5216h)
📱 iPadOS 18.4 beta 2 (22E5216h)
💻 macOS 15.4 beta 2 (24E5222f)
📺 tvOS 18.4 beta 2 (22L5234e)
🥽 visionOS 2.4 beta 2 (22O5215f)
⌚ watchOS 11.4 beta 2 (22T5228e)

#apple #cybersecurity #infosec #security #ios

Von wegen #Arbeitsagentur: Wer nen schoenen #Job hat, darf mich gerne anpingen. Mit #ubirch hab ich 8 Jahre als #CTO gewerkelt. Dabei war Hardware (#Calliope mini, #Trackle), Software (embedded, Blockchain, #security, #cryptography, #trust) - speziell der elektonische #Impfnachweis und am Ende #ESG greenhouse gas accounting. Ich helfe Teams mit ihren Aufgaben zu wachsen und stabile Produkte zu produzieren.

Von wegen #Arbeitsagentur: Wer nen schoenen #Job hat, darf mich gerne anpingen. Mit #ubirch hab ich 8 Jahre als #CTO gewerkelt. Dabei war Hardware (#Calliope mini, #Trackle), Software (embedded, Blockchain, #security, #cryptography, #trust) - speziell der elektonische #Impfnachweis und am Ende #ESG greenhouse gas accounting. Ich helfe Teams mit ihren Aufgaben zu wachsen und stabile Produkte zu produzieren.

“It is unsurprising that allies in #Europe are gathering in London this weekend & equally unsurprising that the #UK is being taken much more seriously in Brussels & capitals,” Ashton said.

And yet there are limits to #Starmer’s #diplomacy. He was unable to extract any #security guarantees from #Trump for #Ukraine, despite an exaggerated show of deference to the president. That included Starmer hand-delivering an invitation for a state visit from #KingCharles….

#geopolitics #Russia #US #NATO

The #summit meeting has thrust #Starmer into an unaccustomed place for a British prime minister: at the heart of #Europe during a crisis. >8 years after the country voted to leave the #EU, the rapidly changing #security landscape is driving #Britain closer to the continent.

Catherine Ashton, a Briton who served as the EU’s high representative for #ForeignAffairs & security policy, said Starmer’s successful meeting w/ #Trump had reinforced his credentials as a leader for Europe.

#geopolitics

🚀 BiznisBox v2 is here! 🎉

After 6+ months of development, we’re bringing you a major upgrade with:

🔐 2FA & Login Notifications – Enhanced security for safer access
🔗 Webhook Support – Seamless third-party integrations
🛠️ New Support Ticket Module – Streamlined issue tracking
📜 New Contracts Module – Better document organization
🎨 Complete UI Redesign – Modern, intuitive & sleek
Upgrade now & experience the future of business management! 🚀

#BiznisBox #Update #Productivity #Security #NewRelease

France is about to pass the worst surveillance law in the EU.

Here's how you can stop them: 👉 https://tuta.com/blog/france-surveillance-nacrotrafic-law

#backdoor #encryption #privacy #security

🚀 BiznisBox v2 is here! 🎉

After 6+ months of development, we’re bringing you a major upgrade with:

🔐 2FA & Login Notifications – Enhanced security for safer access
🔗 Webhook Support – Seamless third-party integrations
🛠️ New Support Ticket Module – Streamlined issue tracking
📜 New Contracts Module – Better document organization
🎨 Complete UI Redesign – Modern, intuitive & sleek
Upgrade now & experience the future of business management! 🚀

#BiznisBox #Update #Productivity #Security #NewRelease

Good morning to readers; Kyiv remains in Ukrainian hands.

#Zelenskyy said a deal with #Russia is pointless w/o #security #guarantees.

Here’s why: #Kyiv made this mistake before.

#Moscow broke ceasefire after #Minsk agreements. International lawyer Oleksandr watched it all unfold.

Good morning to readers; Kyiv remains in Ukrainian hands.

#Zelenskyy said a deal with #Russia is pointless w/o #security #guarantees.

Here’s why: #Kyiv made this mistake before.

#Moscow broke ceasefire after #Minsk agreements. International lawyer Oleksandr watched it all unfold.

“Principle 4. Individuals’ #security and #privacy on the internet are fundamental and must not be treated as optional.”

“The Mozilla #Manifesto Addendum

Pledge for a Healthy #Internet

The open, global internet is the most powerful communication and collaboration resource we have ever seen. It embodies some of our deepest hopes for human progress. It enables new opportunities for learning, building a sense of shared humanity, and solving the pressing problems facing people everywhere.

Over the last decade we have seen this promise fulfilled in many ways. We have also seen the power of the internet used to magnify divisiveness, incite violence, promote hatred, and intentionally manipulate fact and reality. We have learned that we should more explicitly set out our aspirations for the human experience of the internet. We do so now.”

Lol 🤪 Principles

#mozilla <https://mozilla.org/en-US/about/manifesto/>

GNU Emacs: new critical remote shell injection vulnerability.

Red Hat discovered a command injection flaw in the text editor Emacs. It allows a remote, unauthenticated attacker to execute any command on your computer. The vulnerability is activated when you visit a malicious website or link.

https://www.cve.org/CVERecord?id=CVE-2025-1244

---

#news #software #gnu #emacs #security #hacking #terminal #linux #cve #opensource #freesoftware

---

Mitigation: uninstall/update immediately.

GrapheneOS version 2025022700 released:

https://grapheneos.org/releases#2025022700

See the linked release notes for a summary of the improvements over the previous release.

Forum discussion thread:

https://discuss.grapheneos.org/d/20369-grapheneos-version-2025022700-released

#GrapheneOS #privacy #security

'The EU’s chat control legislation is reportedly back on the table... Polish officials have now tabled a new proposal, which is open for feedback until 20 February.'
#law #eu #privacy #surveillance #csam #encryption #security #cybersecurity https://secure.dialog-mail.com/v/145667/1/Wdn4xzHFg8/99136250

France is about to pass the worst surveillance law in the EU.

Here's how you can stop them: 👉 https://tuta.com/blog/france-surveillance-nacrotrafic-law

#backdoor #encryption #privacy #security

France is about to pass the worst surveillance law in the EU.

Here's how you can stop them: 👉 https://tuta.com/blog/france-surveillance-nacrotrafic-law

#backdoor #encryption #privacy #security

❌ You can't trade privacy to prevent crime.

⚠️ Message scanning tech punches a hole in everyone's security. Surveillance organisations, hackers, scammers and predators alike will be able to creep into your life.

Read our longread on the need to protect end-to-end encryption ⬇️

#PracticeSafeText #e2ee #encryption #OnlineSafetyAct #privacy #security

https://www.openrightsgroup.org/blog/the-case-for-encryption/

LibreOffice: Manipulierte Dokumente können in Windows Befehle einschleusen

In LibreOffice können Angreifer unter Windows eine Lücke missbrauchen, durch die Dateien nach Klick auf Links ausgeführt werden.

https://www.heise.de/news/LibreOffice-Manipulierte-Dokumente-koennen-in-Windows-Befehle-einschleusen-10296915.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#LibreOffice #Security #Sicherheitslücken #news

LibreOffice: Manipulierte Dokumente können in Windows Befehle einschleusen

In LibreOffice können Angreifer unter Windows eine Lücke missbrauchen, durch die Dateien nach Klick auf Links ausgeführt werden.

https://www.heise.de/news/LibreOffice-Manipulierte-Dokumente-koennen-in-Windows-Befehle-einschleusen-10296915.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#LibreOffice #Security #Sicherheitslücken #news

I am hiring a Senior Privacy Engineer at Gusto: https://job-boards.greenhouse.io/gusto/jobs/6527585

Preferring candidates in Denver, but can hire (remote) in Atlanta, Austin, Chicago, Los Angeles, Miami, Toronto.

More roles coming soon...

#FediHire #security #privacy

OPM’s Own Guidance Says Fed Employees Never Have to Respond to the Elon Emails
https://talkingpointsmemo.com/edblog/opms-own-guidance-says-fed-employees-never-have-to-respond-to-the-elon-emails

"new system [created by #Doge] was given the name Government-Wide Email System (GWES). On February 5th, 2025... OPM published this document... in sections 4.2 and 4.3, federal government employees are never obligated to respond to any GWES emails and are under no obligation to share any information."

#ElonMusk #Musk #5Bullets #email #GWES #OPM #Privacy #Security #Government #News #USA

Someone really should start another not self-hosted, non-US-based, Password Manager. I only know of two:

1) Heylogin
2) pCloud

(1Password, is owned by a Canadian company, owned by a US company).

1) Heylogin - Sucks.

It is completely tired to your phone. Using their web browser extension? Check your phone. Want to log in to a site? Check your phone. Want to update a login details? Check your phone.

You ever lose or damage your phone, you're f-cked. It is not designed for multiple devices either.

2) pCloud

It is indeed outside US-jurisdiction. The company is not owned by any business in the USA. It does not own any businesses itself in the USA. But they do resell services in the USA, and the only way you can avoid not being assigned to one of those US Servers is to use a VPN so you'll be forwarded to their Europe Servers.

From their own documentation:

" As a consequence API calls have to be made to the correct API host name depending were the user has been registered – api.pcloud.com for United States and eapi.pcloud.com for Europe. "

#PasswordManager #Password #Security #Privacy

❌ You can't trade privacy to prevent crime.

⚠️ Message scanning tech punches a hole in everyone's security. Surveillance organisations, hackers, scammers and predators alike will be able to creep into your life.

Read our longread on the need to protect end-to-end encryption ⬇️

#PracticeSafeText #e2ee #encryption #OnlineSafetyAct #privacy #security

https://www.openrightsgroup.org/blog/the-case-for-encryption/

❌ You can't trade privacy to prevent crime.

⚠️ Message scanning tech punches a hole in everyone's security. Surveillance organisations, hackers, scammers and predators alike will be able to creep into your life.

Read our longread on the need to protect end-to-end encryption ⬇️

#PracticeSafeText #e2ee #encryption #OnlineSafetyAct #privacy #security

https://www.openrightsgroup.org/blog/the-case-for-encryption/

Thought experiment:

@letsencrypt offers certificates to encrypt the traffic between a website & your browser.

They reside in the US & thus are subject to the judiciary system of the US.

What are the possible risks for websites outside the US, given the current unstable political situation & administration? What type of damage could an executive order do? How could this be mitigated?

Boosts appreciated.

#Politics #Security #GeoPolitics #Encryption #LetsEncrypt #CyberSecurity #Tech

Apple entfernt seine höchste »Sicherheitsstufe« für Nutzerdaten in UK, nachdem die Regierung Zugriff auf Daten forderte. Die »Advanced Data Protection« (ADP) stellt durch Ende-zu-Ende-Verschlüsselung sicher, dass nur Kontoinhaber auf ihre gespeicherten Fotos oder Dokumente zugreifen können. Das gilt nun nicht mehr.

https://www.bbc.com/news/articles/cgj54eq4vejo

#apple #security #adp #sicherheit

Notesnook v3.0.27 is out with an all new command palette, quick open, support for pasting markdown directly, and much more!

Read the full release notes here: https://blog.notesnook.com/notesnook-v3.0.27

#notesnook, #notetaking, #privacy, #security, #productivity, #encryption

European Court of Human Rights Confirms: Weakening Encryption Violates Fundamental Rights

In a milestone judgment—Podchasov v. Russia—the #European Court of #HumanRights ( #ECtHR) has ruled that weakening of #encryption can lead to general and indiscriminate #surveillance of the #communications of all users and violates the #HumanRight to #privacy.

https://www.eff.org/deeplinks/2024/03/european-court-human-rights-confirms-undermining-encryption-violates-fundamental

#security #freedom #authoritarian #backdoors #hackers #IdentityTheft #banking

The least secure TOTP code possible

https://shkspr.mobi/blog/2025/02/the-least-secure-totp-code-possible/

If you use Multi-Factor Authentication, you'll be well used to scanning in QR codes which allow you to share a secret code with a website. These are known as Time-based One Time Passwords (TOTP⁰).

As I've moaned about before, TOTP has never been properly standardised. It's a mish-mash of half-finished proposals with no active development, no test suite, and no-one looking after it. Which is exactly what you want from a security specification, right?!

So let's try to find some edge-cases and see where things break down.

One Punch Man

This is possibly the least secure TOTP code I could create. Scan it and see whether your app will accept it.

What makes it so crap? There are three things which protect you when using TOTP.

1. The shared secret. In this case, it is abcdefghijklmno - OK, that's not the easiest thing to guess, but it isn't exactly complex.
2. The amount time the code is valid for before changing. Most TOTP codes last 30 seconds, this lasts 120.
3. The length of the code. Most codes are 6 digits long. In theory, the spec allows 8 digits. This is 1. Yup. A single digit.

If you were thick enough to use this¹, an attacker would have a 1/10 chance of simply guessing your MFA code. If they saw you type it in, they'd have a couple of minutes in which to reuse it.

Can modern TOTP apps add this code? I crowdsourced the answers.

Surprisingly, a few apps accept it! Aegis, 1password, and BitWarden will happily store it and show you a 1 digit code for 120 seconds.

A few reject it. Authy, Google Authenticator, and OpenOTP claim the code is broken and won't add it.

But, weirdly, a few interpret it incorrectly! The native iOS app, Microsoft Authenticator, and KeepassXC store the code, but treat it as a 6 digit, 30 second code.

Do The Right Thing

What is the right thing to do in this case? The code is outside the (very loosely defined) specification. Postel's Law tells us that we should try our best to interpret malformed data - which is what Aegis and BitWarden do.

But, in a security context, that could be dangerous. Perhaps rejecting a dodgy code makes more sense?

What is absolutely daft² is ignoring the bits of the code you don't like and substituting your own data! Luckily, in a normal TOTP enrolment, the user has to enter a code to prove they've saved it correctly. Entering in a 6 digit code where only 1 is expected is likely to fail.

We're Only Human

A one-digit code is ridiculous. But what about the other extreme? Would a 128-digit code be acceptable? For a human, no; it would be impossible to type in correctly. For a machine with a shared secret, it possibly makes sesne.

On a high-latency connection or with users who may have mobility difficulties, a multi-minute timeframe could be sensible. For something of extremely high security, sub-30 seconds may be necessary.

But, again, the specification hasn't evolved to meet user needs. It is stagnant and decaying.

What's Next?

There's an draft proposal to tighten up to TOTP spec which has expired.

It would be nice if the major security players came together to work out a formal and complete specification for this vital piece of security architecture. But I bet it won't ever happen.

• Google have archived their work on authentication standards.
• Apple points to Google's outdated spec.
• YubiCo's incompatible spec hasn't been updated in 4 years.
• The otpauth registration lists a consortium called https://openauthentication.org who don't appear to published anything in a decade.
• Microsoft don't have any documentation whatsoever.

So there you have it. We're told to rely on TOTP for our MFA - yet the major apps all disagree on how the standard should be implemented. This is a recipe for an eventual security disaster.

How do we fix it?

#CyberSecurity #rant #security #standards #totp

The least secure TOTP code possible

https://shkspr.mobi/blog/2025/02/the-least-secure-totp-code-possible/

If you use Multi-Factor Authentication, you'll be well used to scanning in QR codes which allow you to share a secret code with a website. These are known as Time-based One Time Passwords (TOTP⁰).

As I've moaned about before, TOTP has never been properly standardised. It's a mish-mash of half-finished proposals with no active development, no test suite, and no-one looking after it. Which is exactly what you want from a security specification, right?!

So let's try to find some edge-cases and see where things break down.

One Punch Man

This is possibly the least secure TOTP code I could create. Scan it and see whether your app will accept it.

What makes it so crap? There are three things which protect you when using TOTP.

1. The shared secret. In this case, it is abcdefghijklmno - OK, that's not the easiest thing to guess, but it isn't exactly complex.
2. The amount time the code is valid for before changing. Most TOTP codes last 30 seconds, this lasts 120.
3. The length of the code. Most codes are 6 digits long. In theory, the spec allows 8 digits. This is 1. Yup. A single digit.

If you were thick enough to use this¹, an attacker would have a 1/10 chance of simply guessing your MFA code. If they saw you type it in, they'd have a couple of minutes in which to reuse it.

Can modern TOTP apps add this code? I crowdsourced the answers.

Surprisingly, a few apps accept it! Aegis, 1password, and BitWarden will happily store it and show you a 1 digit code for 120 seconds.

A few reject it. Authy, Google Authenticator, and OpenOTP claim the code is broken and won't add it.

But, weirdly, a few interpret it incorrectly! The native iOS app, Microsoft Authenticator, and KeepassXC store the code, but treat it as a 6 digit, 30 second code.

Do The Right Thing

What is the right thing to do in this case? The code is outside the (very loosely defined) specification. Postel's Law tells us that we should try our best to interpret malformed data - which is what Aegis and BitWarden do.

But, in a security context, that could be dangerous. Perhaps rejecting a dodgy code makes more sense?

What is absolutely daft² is ignoring the bits of the code you don't like and substituting your own data! Luckily, in a normal TOTP enrolment, the user has to enter a code to prove they've saved it correctly. Entering in a 6 digit code where only 1 is expected is likely to fail.

We're Only Human

A one-digit code is ridiculous. But what about the other extreme? Would a 128-digit code be acceptable? For a human, no; it would be impossible to type in correctly. For a machine with a shared secret, it possibly makes sesne.

On a high-latency connection or with users who may have mobility difficulties, a multi-minute timeframe could be sensible. For something of extremely high security, sub-30 seconds may be necessary.

But, again, the specification hasn't evolved to meet user needs. It is stagnant and decaying.

What's Next?

There's an draft proposal to tighten up to TOTP spec which has expired.

It would be nice if the major security players came together to work out a formal and complete specification for this vital piece of security architecture. But I bet it won't ever happen.

• Google have archived their work on authentication standards.
• Apple points to Google's outdated spec.
• YubiCo's incompatible spec hasn't been updated in 4 years.
• The otpauth registration lists a consortium called https://openauthentication.org who don't appear to published anything in a decade.
• Microsoft don't have any documentation whatsoever.

So there you have it. We're told to rely on TOTP for our MFA - yet the major apps all disagree on how the standard should be implemented. This is a recipe for an eventual security disaster.

How do we fix it?

#CyberSecurity #rant #security #standards #totp

The least secure TOTP code possible

https://shkspr.mobi/blog/2025/02/the-least-secure-totp-code-possible/

If you use Multi-Factor Authentication, you'll be well used to scanning in QR codes which allow you to share a secret code with a website. These are known as Time-based One Time Passwords (TOTP⁰).

As I've moaned about before, TOTP has never been properly standardised. It's a mish-mash of half-finished proposals with no active development, no test suite, and no-one looking after it. Which is exactly what you want from a security specification, right?!

So let's try to find some edge-cases and see where things break down.

One Punch Man

This is possibly the least secure TOTP code I could create. Scan it and see whether your app will accept it.

What makes it so crap? There are three things which protect you when using TOTP.

1. The shared secret. In this case, it is abcdefghijklmno - OK, that's not the easiest thing to guess, but it isn't exactly complex.
2. The amount time the code is valid for before changing. Most TOTP codes last 30 seconds, this lasts 120.
3. The length of the code. Most codes are 6 digits long. In theory, the spec allows 8 digits. This is 1. Yup. A single digit.

If you were thick enough to use this¹, an attacker would have a 1/10 chance of simply guessing your MFA code. If they saw you type it in, they'd have a couple of minutes in which to reuse it.

Can modern TOTP apps add this code? I crowdsourced the answers.

Surprisingly, a few apps accept it! Aegis, 1password, and BitWarden will happily store it and show you a 1 digit code for 120 seconds.

A few reject it. Authy, Google Authenticator, and OpenOTP claim the code is broken and won't add it.

But, weirdly, a few interpret it incorrectly! The native iOS app, Microsoft Authenticator, and KeepassXC store the code, but treat it as a 6 digit, 30 second code.

Do The Right Thing

What is the right thing to do in this case? The code is outside the (very loosely defined) specification. Postel's Law tells us that we should try our best to interpret malformed data - which is what Aegis and BitWarden do.

But, in a security context, that could be dangerous. Perhaps rejecting a dodgy code makes more sense?

What is absolutely daft² is ignoring the bits of the code you don't like and substituting your own data! Luckily, in a normal TOTP enrolment, the user has to enter a code to prove they've saved it correctly. Entering in a 6 digit code where only 1 is expected is likely to fail.

We're Only Human

A one-digit code is ridiculous. But what about the other extreme? Would a 128-digit code be acceptable? For a human, no; it would be impossible to type in correctly. For a machine with a shared secret, it possibly makes sesne.

On a high-latency connection or with users who may have mobility difficulties, a multi-minute timeframe could be sensible. For something of extremely high security, sub-30 seconds may be necessary.

But, again, the specification hasn't evolved to meet user needs. It is stagnant and decaying.

What's Next?

There's an draft proposal to tighten up to TOTP spec which has expired.

It would be nice if the major security players came together to work out a formal and complete specification for this vital piece of security architecture. But I bet it won't ever happen.

• Google have archived their work on authentication standards.
• Apple points to Google's outdated spec.
• YubiCo's incompatible spec hasn't been updated in 4 years.
• The otpauth registration lists a consortium called https://openauthentication.org who don't appear to published anything in a decade.
• Microsoft don't have any documentation whatsoever.

So there you have it. We're told to rely on TOTP for our MFA - yet the major apps all disagree on how the standard should be implemented. This is a recipe for an eventual security disaster.

How do we fix it?

#CyberSecurity #rant #security #standards #totp

If you’re a Windows user, I can help you switch to Linux. Please stop supporting an insecure and privacy-intrusive operating system. What’s stopping you from switching to Linux/macOS? Ask all your questions, and I’ll answer everything.

#linux #macOS #privacy #security #windows

Breaking news for the crab people 🚨

🦀 Ring, a widely used Rust cryptography library, is now unmaintained.

🔐 Security advisory: https://rustsec.org/advisories/RUSTSEC-2025-0007

➡️ Details: https://github.com/briansmith/ring/discussions/2414

#rustlang #opensource #library #security #cryptography

Breaking news for the crab people 🚨

🦀 Ring, a widely used Rust cryptography library, is now unmaintained.

🔐 Security advisory: https://rustsec.org/advisories/RUSTSEC-2025-0007

➡️ Details: https://github.com/briansmith/ring/discussions/2414

#rustlang #opensource #library #security #cryptography

Breaking news for the crab people 🚨

🦀 Ring, a widely used Rust cryptography library, is now unmaintained.

🔐 Security advisory: https://rustsec.org/advisories/RUSTSEC-2025-0007

➡️ Details: https://github.com/briansmith/ring/discussions/2414

#rustlang #opensource #library #security #cryptography

Today I learned that the alarm system that came with our house – a very popular one here in Ireland – can be disarmed via Siri.

The default command?

“Hey, Siri, disarm.”

I shit you not.

#security #smartHome #youGottaBeFuckingKiddingMe #siri #openSesame

Today I learned that the alarm system that came with our house – a very popular one here in Ireland – can be disarmed via Siri.

The default command?

“Hey, Siri, disarm.”

I shit you not.

#security #smartHome #youGottaBeFuckingKiddingMe #siri #openSesame

Apple entfernt seine höchste »Sicherheitsstufe« für Nutzerdaten in UK, nachdem die Regierung Zugriff auf Daten forderte. Die »Advanced Data Protection« (ADP) stellt durch Ende-zu-Ende-Verschlüsselung sicher, dass nur Kontoinhaber auf ihre gespeicherten Fotos oder Dokumente zugreifen können. Das gilt nun nicht mehr.

https://www.bbc.com/news/articles/cgj54eq4vejo

#apple #security #adp #sicherheit

A family member has a Mac that appears compromised. It behaves strangely, runs with higher load than it should and macOS produced some error messages that imply it quarantined some code. I think the machine should be wiped completely and rebuilt.

#Security people: how would you go about this without inadvertently carrying bad stuff over to another Mac or the rebuilt Mac? There are many files, email etc that need to be preserved.

#Russia's main demands to stop the fighting include a withdrawal of Kyiv's troops from Ukrainian territory Moscow [illegally] claims & an end to #Ukraine's ambitions to join #NATO. Ukraine says Russia must withdraw from its territory, & wants #security guarantees from the West. The #Trump admin says Ukraine has unrealistic, "illusionary" goals.

#geopolitics #StandWithUkraine

This is NOT GOOD, not good AT ALL!

Now it will be only a matter of time before the US will want the same!

https://www.bbc.com/news/articles/cgj54eq4vejo

#Privacy #InfoSec #Apple #ADP #iCloud #Data #Security

Trump Guts Crucial OPM Team as Elon Musk Gains Even More Power

The Office of Personnel Management has just limited access to certain government records on #ElonMusk and his #DOGE minions.
https://newrepublic.com/post/191663/elon-musk-opm-privacy-team

"The Trump administration has fired members of the “privacy team” at the #OPM, a move that will hinder #public access & scrutiny over #government records related to the #security clearances of #ElonMusk & Doge."

#Musk #Coup #Trump #Corruption #Politics #Privacy #USPol #News #US #USA

Point of view always matters.

#infosec #breach #databreach #security

This is *the most malicious, brutal* malicious compliance I've seen in quite some time, possibly ever, and I am HERE FOR IT. Thank you, @jwz

https://www.jwz.org/xscreensaver/google.html

#privacy #security #infosec #Android #screensaver

I wrote a new blog post about DNS (part 1)!

Learn how DNS works in more depth and I even provide you will some useful terminal commands you can try yourself:

https://blog.melroy.org/2025/dns-part-1/

#dns #security #linux #unbound #bind #linux #recursive authoritative# server #nsd #dig #zone #domain #name #system

This is *the most malicious, brutal* malicious compliance I've seen in quite some time, possibly ever, and I am HERE FOR IT. Thank you, @jwz

https://www.jwz.org/xscreensaver/google.html

#privacy #security #infosec #Android #screensaver

My list of digital service providers outside the jurisdiction of the United States of America. 😉

https://codeberg.org/Linux-Is-Best/Outside_Us_Jurisdiction

The list is now hosted on Codeberg, an alternative to GitHub or GitLab, but based out of Germany. 😉

#Vpn #Dns #Cdn #WebHosting #Email #PasswordManager #WebSearch #Privacy #Security #Project2025 #Fascism #Nazis

We’ve seen significant interest in newsrooms setting up SecureDrop to better protect whistleblowers, so we've put together a quick list of 5 key things you should know before setting it up:

https://securedrop.org/news/five-things-to-know-about-securedrop/

#SecureDrop #security #whistleblowing #OpenSource

We’ve seen significant interest in newsrooms setting up SecureDrop to better protect whistleblowers, so we've put together a quick list of 5 key things you should know before setting it up:

https://securedrop.org/news/five-things-to-know-about-securedrop/

#SecureDrop #security #whistleblowing #OpenSource

Microsoft and the United States Government have a working partnership. You should consider try using Linux.

For a newbie, I would suggest Ultramarine Linux (KDE Plasma) or MX Linux (KDE Plasma). But ultimately, your goal should be to try using Linux.

If you need to keep a copy of Windows for gaming, that's fine. But still try using Linux too.

#Project2025 #Fascism #Nazis #DonaldTrump #Trump #ElonMusk #Musk #Privacy #Security #UsJurisdiction

Microsoft and the United States Government have a working partnership. You should consider try using Linux.

For a newbie, I would suggest Ultramarine Linux (KDE Plasma) or MX Linux (KDE Plasma). But ultimately, your goal should be to try using Linux.

If you need to keep a copy of Windows for gaming, that's fine. But still try using Linux too.

#Project2025 #Fascism #Nazis #DonaldTrump #Trump #ElonMusk #Musk #Privacy #Security #UsJurisdiction

We're Privacy Guides, a non-profit project & community focused on personal data security and privacy. 👋

Much like the right to interracial marriage, woman's suffrage, freedom of speech, and many others, our right to privacy hasn't always been upheld. In several dictatorships, it still isn't. Generations before ours fought for our right to privacy. Privacy is a human right, inherent to all of us, that we are entitled to (without discrimination).

You shouldn't confuse privacy with secrecy. We know what happens in the bathroom, but you still close the door. That's because you want privacy, not secrecy. Everyone has something to protect. Privacy is something that makes us human.

We're on a mission to inform the public about the value of digital privacy, and about global government initiatives which aim to monitor your online activity.

#PrivacyGuides #Introduction #Privacy #Security

My list of digital service providers outside the jurisdiction of the United States of America. 😉

https://codeberg.org/Linux-Is-Best/Outside_Us_Jurisdiction

The list is now hosted on Codeberg, an alternative to GitHub or GitLab, but based out of Germany. 😉

#Vpn #Dns #Cdn #WebHosting #Email #PasswordManager #WebSearch #Privacy #Security #Project2025 #Fascism #Nazis

For every obvious reason and then some, I'm not linking to anything here; I refer herein and throughout to the adult video website that functionally everyone knows exists.

What they want you to believe is that they've made the decision to geo-block U.S. states requiring users to verify their age, specifically because they care about their users' privacy, supposedly.

Adult websites don't need government issued IDs on file to de-anonymize and track people; they already do that, and already do so very well.

So:
"These Terms of Service, your use of this Website, and the relationship between you and us shall be governed by the laws of the Republic of Cyprus, without regard to conflict of law rules. Nothing contained in these Terms of Service shall constitute an agreement to the application of the laws of any other nation to this Website. You agree that this Website shall be deemed a passive Website that does not give rise to personal jurisdiction over us, either specific or general, in jurisdictions other than the Republic of Cyprus. The sole and exclusive jurisdiction and venue for any action or proceeding arising out of or related to these Terms of Service shall be in an appropriate court located in Limassol, Cyprus. You hereby submit to the jurisdiction and venue of said Courts."

They are a business and nothing else, they always care only about their own profit and never about anything else, and it's simply a technical matter that to comply with age verification laws outside of the jurisdiction in which they already hide everything, would nullify the above quoted legally binding contract between themselves, their users, and their precious tax haven.

It is absolutely in their financial best interest to lose a certain number of existing customers when the only alternative necessitates that they stop evading taxes and getting away with it; Al Capone, eat your heart out.

They do not care at all about anyone's privacy, whatsoever.

#privacy #security #infosec #uspol

How do folks deal with GitHub and GPG keys? #github #security #gpg #pgp

Thanks to the threats from the United States, I have only now become interested in getting to know the EU properly, and especially its security issues.

If there are people here who know how to get involved at EU level, all tips and advice are welcome, thank you!

#EU #Security

Thanks to the threats from the United States, I have only now become interested in getting to know the EU properly, and especially its security issues.

If there are people here who know how to get involved at EU level, all tips and advice are welcome, thank you!

#EU #Security

The #traitor #OrangeIdiot in the #WhiteHouse is a #ManchurianCandidate. And the #ApartheidScum is the #handler and a #RussianAgent. They are actively #stripping the country's #security apparatus and #TraitorGOP is #silent. This will not end well.

#felonPresident
#felon
#MAGATraitor

https://www.yahoo.com/news/doge-reversal-firings-us-nuclear-235315700.html

Elon Musk’s DOGE Shares Classified U.S. Intel With Entire World

Elon Musk’s minions posted classified data on their website for anyone to see.
https://newrepublic.com/post/191580/elon-musk-doge-classified-us-intel-data-website

"this incident doesn’t speak well of the pseudo-agency’s #security procedures. The website has already been hacked by Thursday evening thanks to #coding vulnerabilities. And since #DOGE has gotten into all kinds of sensitive #data, every #American could be at risk."

#ElonMusk #Coup #Musk #GOP #Politics #News #USPol #Press #USA

Elon Musk’s DOGE Shares Classified U.S. Intel With Entire World

Elon Musk’s minions posted classified data on their website for anyone to see.
https://newrepublic.com/post/191580/elon-musk-doge-classified-us-intel-data-website

"this incident doesn’t speak well of the pseudo-agency’s #security procedures. The website has already been hacked by Thursday evening thanks to #coding vulnerabilities. And since #DOGE has gotten into all kinds of sensitive #data, every #American could be at risk."

#ElonMusk #Coup #Musk #GOP #Politics #News #USPol #Press #USA

This is *the most malicious, brutal* malicious compliance I've seen in quite some time, possibly ever, and I am HERE FOR IT. Thank you, @jwz

https://www.jwz.org/xscreensaver/google.html

#privacy #security #infosec #Android #screensaver

We're Privacy Guides, a non-profit project & community focused on personal data security and privacy. 👋

Much like the right to interracial marriage, woman's suffrage, freedom of speech, and many others, our right to privacy hasn't always been upheld. In several dictatorships, it still isn't. Generations before ours fought for our right to privacy. Privacy is a human right, inherent to all of us, that we are entitled to (without discrimination).

You shouldn't confuse privacy with secrecy. We know what happens in the bathroom, but you still close the door. That's because you want privacy, not secrecy. Everyone has something to protect. Privacy is something that makes us human.

We're on a mission to inform the public about the value of digital privacy, and about global government initiatives which aim to monitor your online activity.

#PrivacyGuides #Introduction #Privacy #Security

DOGE’s .gov site lampooned as coders quickly realize it can be edited by anyone

DOGE site is apparently not running on government servers.
https://arstechnica.com/tech-policy/2025/02/doges-gov-site-lampooned-as-coders-quickly-realize-it-can-be-edited-by-anyone/

"DOGE appears to have skipped #security steps that are expected of #government websites. That pattern is troubling some federal workers...

makes it possible for bad actors to alter official databases of government information."

#ElonMusk #Musk #Doge #Programming #Tech #Data #Fail #News #US #USA

DOGE software approval alarms Labor Dept employees

Elon Musk’s #DOGE subordinates received approval to use #software at the Labor Dept that could be used to transfer large amounts of #data...
https://www.nbcnews.com/tech/security/doge-software-approval-alarms-labor-department-employees-data-security-rcna191583