#security

Security UI does not work

A keynote slide from 2013. In a nutshell, why cookie banners are pointless and the GDPR is a mess.

🔐 This emoji won’t work in Safari’s title bar

Nice small detail: This emoji does not show in the title bar of Safari, presumably to prevent less-reputable sites pretending to be secure (encrypted using HTTPS) when they are not.

Password Rules Are Bullshit

I’ll go so far as to say your password is too damn short. These days, given the state of cloud computing and GPU password hash cracking, any password of 8 characters or less is perilously close to no password at all. So then perhaps we have one rule, that passwords must not be short. A long password is much […]

OverSight

OverSight è una piccola utility sviluppata da Objective-See per monitorare l’uso e l’accesso alla videocamera e al microfono integrati nel Mac; l’app invia una notifica ogni volta che questi si attivano.

Per due anni, un malware nascosto nei pixel dei banner pubblicitari ha collezionato dati personali

Cory Doctorow, su Boing Boing: To do this, they made tiny alterations to the transparency values of the individual pixels of the accompanying banner ads, which were in the PNG format, which allows for pixel-level gradations in transparency. The javascript sent by the attackers would run through the pixels in the banners, looking for ones with […]

Qualcuno sta imparando a buttare giù internet

Bruce Schneier: Over the past year or two, someone has been probing the defenses of the companies that run critical pieces of the Internet. These probes take the form of precisely calibrated attacks designed to determine exactly how well these companies can defend themselves, and what would be required to take them down. […] Who […]

Perché il leak di dati di LinkedIn riguarda tutti noi

Verso inizio giugno sono apparsi sul dark web i dati — inclusa password e email — di 117 milioni di account creati su LinkedIn, ottenuti durante l’attacco che LinkedIn subì nel 2012 (potete controllare se anche il vostro account venne compromesso su haveibeenpwned.com). Come spiega Arstechnica, ogni volta che c’è un leak di queste dimensioni e entità […]