Data Safety and Information Security

An intermittent outage at Cloudflare on Tuesday briefly knocked many of the Internet's top destinations offline. Some affected Cloudflare customers were able to pivot away from the platform temporarily so that visitors could still access their websites. But security experts…

I've detected 16 CAs issuing certificates which rely on CT logs that are not recognized by all browsers

In this article I cover what is considered to be the safest programming language developed.

A new malware-as-a-service (MaaS) platform named Atroposia provides cybercriminals a remote access trojan that combines capabilities for persistent access, evasion, data theft, and local vulnerability scanning.

The Making of Digital Identity - The Cryptographic Solution

A report describing an a highly sophisticated AI-led cyberattack

public-key authentication standard

If you see this message, it’s an attack.

Amidst the glossy marketing for VPN services, it can be tempting to believe that the moment you flick on the VPN connection you can browse the internet with full privacy. Unfortunately this is quit…

Some thoughts on security after ten years of qmail 1.0 Bernstein, 2007 I find security much more important than speed. We need invulnerable software systems, and we need them today, even if they ar…

Update, 7:11 p.m. ET: A Meta representative reached out to 9to5Mac and provided the following statement: “We are grateful to...

Persona

Test of time passed

How a privacy researcher proved a politician wrong, and how she created the first ever definition of anonymity in the process.

Cloudflare identifies high-risk top-level domains, with .motorcycles ranking No. 1 among the most abused TLDs.

Learn how a Google spoof used a DKIM replay attack to bypass email security and trick users with a fake subpoena in this real-world phishing case.

Aisuru, the botnet responsible for a series of record-smashing distributed denial-of-service (DDoS) attacks this year, recently was overhauled to support a more low-key, lucrative and sustainable business: Renting hundreds of thousands of infected Internet of Things (IoT) devices to proxy…

What is Sender Policy Framework (SPF)? Sender Policy Framework (SPF) is a technical standard designed to provide a layer of protection against fraudulent

When performing a penetration test (pen test) on an application, especially one where the functionality relies on XML parsing in the backend, it's

AI agents are now hacking computers. They’re getting better at all phases of cyberattacks, faster than most of us expected. They can chain together different aspects of a cyber operation, and hack autonomously, at computer speeds and scale. This is going to change everything. Over the summer, hackers proved the concept, industry institutionalized it, and criminals operationalized it. In June, AI company XBOW took the top spot on HackerOne’s US leaderboard after submitting over 1,000 new vulnerabilities in just a few months. In August, the seven teams competing in DARPA’s AI Cyber Challenge ...

Have you ever seen articles about how hackers stole data from major platforms using external applications? This type of data breach often exploits a

The Making of Digital Identity - From Trust to Proof: The Birth of Digital Authentication (1950s-1960s)

Securing the software supply chain requires more than building hardened images. Learn why DIY often fails and what it takes to maintain secure images at scale.

Visa isn't centralized. Instead, it's a trust framework that lets thousands of participants interoperate. First-person identity brings that same model to digital identity, enabling not one

How law enforcement and private parties can access your information without your knowledge, and what you can do about it.

The latest data breaches are a regular topic in the news. Raising awareness about the prevalence and severity of the issue, as well as how the financial impact on the business can be limited is what we contribute with this article.

Today’s world requires us to make complex and nuanced decisions about our digital security. Evaluating when to use a secure messaging app like Signal or WhatsApp, which passwords to store on your smartphone, or what to share on social media requires us to assess risks and make judgments accordingly. Arriving at any conclusion is an exercise in threat modeling. In security, threat modeling is the process of determining what security measures make sense in your particular situation. It’s a way to think about potential risks, possible defenses, and the costs of both. It’s how experts avoid being distracted by irrelevant risks or overburdened by undue costs...