Data Safety and Information Security

The xz Utils attack almost succeeded. Will we be as lucky next time?

The attackers were allegedly able to access GitLab repositories hosted by Sisense, where hard-coded secrets may have been found.

Anyone who has had to deal with HTML emails on a technical level has probably reached the point where they wanted to quit their job or just set fire to all the mail clients due to their inconsistent implementations. But HTML emails are not just a source of frustration, they can also be a serious security risk.

The xz backdoor is naturally still the top story of the week. If you need a refresher, see our previous coverage. As expected, some very talented reverse engineers have gone to work on the code, an…

Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross-Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft, to site defacement, to malware distribution.

An off-the-clock Microsoft developer got suspicious while doing some micro-benchmarking.

Malicious code planted in xz Utils has been circulating for more than a month.

When you click or press the Like button, you may be disclosing more about yourself than you imagine. You may also be contributing to the bank accounts of Internet scammers.

CITP is releasing a report today based on a two day in-person workshop on the security of the Web Public Key Infrastructure (Web PKI) we held last year.

For the "W3C Workshop on the Future of Social Networking", taking place in Barcelona January 2009

The concept of a Web of Trust is most closely associated with Phil Zimmerman and PGP. The basic idea is that by signing each other's keys, usually at things like key signing parties, people could grow the network of keys they trusted to sign or encrypt documents such as email, sign legal documents, etc... The distributed system of trust feels right, but the idea never really took off, even though the keysigning parties must have been fun, probably because they still required physical presence. In foaf+ssl we are also using a Web of Trust mechanism, but as I will show here, this does not require key signing, and furthermore it uses PKI to do this (some may say it subverts PKI to do this). It should therefore be able to grow much faster, and hopefully give us the same benefits.

Product security plans and automating security with security as code offer a new — and better — approach to achieving app and cloud security goals.

Everyone loves themes. Doesn’t matter if it’s a text editor or a smart display in the kitchen, we want to be able to easily customize its look and feel to our liking. When setting up a …

How to secure BigData or microservices efficiently on the Web

Have you heard about SOPS? If you have already been in a situation where you needed to share sensitive information with your teammates, this is for you.

Learn how to encrypt your secrets with Mozilla/SOPS

Modern and secure platform to manage a decentralized identity based on cryptographic keys

Read on to understand how Google currently evaluates the threat landscape related to post-quantum cryptography, and what implications this has for migrating from classical cryptographic algorithms to PQC.

When I first used passkeys, I felt they had too many issues to be used in production, but I’ve changed my mind. I recommend these steps for using them.

A cautionary FOSDEM talk from the Nix community about all the vulnerable software that may still overlooked on your systems.

Authentication is central to securing applications and enabling personalised websites. This post discusses the different forms of authentication used in software.

Police believe a string of nine robberies in Edina have used this tech.

This blog post uses storytelling to introduce beginners to Verifiable Credentials, followed by a...

The Best Memorable Password Generator ever that is completely free. Easily create secure, unique and strong passwords in no time.