Data Safety and Information Security

GreyNoise warns of a mysterious phenomenon observed since January 2020, massive waves of spoofed traffic called Noise Storms.

A new Federal Trade Commission staff report that examines the data collection and use practices of major social media and video streaming services shows they engaged in vast surveillance of consume

Performance Co-Pilot (PCP) is a system for collecting system performance data and sharing it over the network. We performed a review of its main networking daemon component pmcd, which resulted in the finding of two CVEs and a couple of other noticeable aspects.

Please be on the alert for: Spam that includes your name, address, phone number and other personal details. Phone calls that are from human-sounding bots that pretend to be from friends or trusted …

Attacking APIs is easy, if you know what to look for, according to professional API hacker Katie Paxton-Fear. She shared how she does it.

We have a little problem on the web right now and I can only see this becoming a larger concern as time goes by. More and more sites are obtaining certificates, vitally important documents that we need to deploy HTTPS, but we have no way of protecting ourselves when things

Until we value freedom and independence in the digital world, we will yield up control of our digital lives to others who will act in their own interests, not ours.

.mobi top-level-domain managers changed the location of its WHOIS server. No one got the memo.

Sophisticated attack breaks security assurances of the most popular FIDO key.

The 1st Line Of Defense

What is Fingerprint Browser Bot Detection? Fingerprint Browser Bot Detection is a Smart Signal that detects automated activity on your website. It analyses a variety of browser attributes and gives you a bot detection signal with one of three values: Good bot - usually a bot that belongs to a well-k...

Browser fingerprinting gathers hundreds of data points about your users' devices and browser configurations. But how does it stop fraud, and is it enough?

Browser fingerprinting is a website user identification method. Learn more about what it is, how it works & techniques like audio fingerprinting

Do you own a website and keep getting disturbed by bots? Read the article below to learn how to detect and block bot traffic. Bot traffic, if not contained, can mess up your analytics and even add to your server cost.

Any website can use a simple API to replace CAPTCHAs with our invisible alternative, whether they’re on the Cloudflare network or not.

Credentials are a part of our daily lives; driver's licenses are used to assert that we are capable of operating a motor vehicle, university degrees can be used to assert our level of education, and government-issued passports enable us to travel between countries. The family of W3C Recommendations for Verifiable Credentials, described in this overview document, provides a mechanism to express these sorts of credentials on the Web in a way that is cryptographically secure, privacy respecting, and machine-verifiable.

Demonstration of the WebAuthn specification.

Hello passkeys, goodbye passwords! passkeys.dev is a collection of resources and insights to help you deploy passkeys, including practical user experiences, device ecosystem support, frequently asked questions, and more.

Microsoft, Mozilla, and Google are all implementing the new standard.

This document describes a mechanism for creating, encoding, and verifying digital signatures or message authentication codes over components of an HTTP message. This mechanism supports use cases where the full HTTP message may not be known to the signer and where the message may be transformed (e.g., by intermediaries) before reaching the verifier. This document also describes a means for requesting that a signature be applied to a subsequent HTTP message in an ongoing HTTP exchange.

Disclaimer: Thoughts expressed here are my own, and not of my employers.

You can try the new system out right now.

This tech tests your browser to see if you’re a bot.

The internet infrastructure company has an alternative tool to check whether you’re human—and it doesn’t force you to pick out buses in tiny boxes.

Private Access Tokens are powerful tools that prove when HTTP requests are coming from legitimate devices without disclosing someone's identity. They are simple to set up and test — and so, on Thursday, we're inviting you to try out Private Access Tokens on your own server.

Update 2014-01-17 I'm updating this post to include a slightly revised version of the Pyramid.  The only real change I made was that I adde...

Utilize JA3 with JA3S as a method to fingerprint the TLS negotiation between client and server