← Feed

Posts

• View post

  Security personnel around the world are on high alert following the discovery of eight TLS certificates with private keys so weak they could allow anyone to mint trusted browser and app credentials for any site on the Internet. https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/

• View post

  Dutch officials are warning that CVE-2026-65400, a macOS vulnerability that allows attackers to execute malicious code, is under active exploitation. (Apple patched the vulnerability recently.) The attacks come when screen sharing is turned on and port 5900 is exposed to the internet. Can anyone tell me how common it is for this port to be exposed? Does it happen automatically when screen sharing is enabled, or are other conditions required? https://advisories.ncsc.nl/2026/ncsc-2026-0280.html...

• View post

  Backing up your Mac keychain is a lot more restrictive under Tahoe and Golden Gate, according to a new blog. This could be catastrophic in the event your Mac is lost, stolen, or suffers a fatal event. According to the blog, it's impossible to copy the keychain file and successfully decrypt it on a new Mac. Has anyone figured out a way to work around this? https://derflounder.wordpress.com/2026/09/08/manually-copying-login-keychain-files-from-one-mac-to-another-no-longer-works-on-secure-encl...

• View post

  Meta is pushing back on claims Muse access Apple Messages conversations without permission. Meta says the chats aren't accessible to Muse unless a user enables both Full Disk Access and the Messages connector is enabled. Patrick Wardle says that once an app gets FDA permissions it can read any non-root file, including "browsing history, browser cookies, chats, etc etc etc." Does anyone have time to test if FDA is enough for Muse to access messages or if both permissions are necess...

• View post

  https://arstechnica.com/security/2026/10/hackers-obtain-counterfeit-tls-certificates-for-google-and-other-large-services/

• View post

  The suspect was detained as ShinyHunters was in the process of extorting a business unit recently divested by the global aerospace company Boeing, which manufactures the fleet of planes used by the employer of Rey’s father — Royal Jordanian Airlines. https://krebsonsecurity.com/2026/10/shinyhunters-extorted-boeing-spin-off-prior-to-arrests/

• View post

  "A human who conducted such a hack would be facing years in prison. For a machine, criminal liability is harder to determine." https://www.newyorker.com/news/the-lede/inside-openai-hack-of-hugging-face

• View post

  TV sticks that offer free streaming services are turning people's tnternet connections into vehicles for fraud. https://krebsonsecurity.com/2026/07/read-this-before-you-buy-that-tv-streaming-stick/

• View post

  A quantum-resistant cryptography algorithm that was under consideration to become an official US standard has been taken out of the running after an Anthropic security model helped find a flaw that rendered it broken. https://arstechnica.com/security/2026/07/mythos-uncovers-crypto-weaknesses-that-went-unknown-for-years/

• View post

  @hacks4pancakes@infosec.exchange @ProPublica@newsie.social I'd also recommend @kimzetter@infosec.exchange 's Zero Day: https://www.zetter-zeroday.com

• View post

  If it wasn't already, 2FA spraying is now a thing https://arstechnica.com/security/2026/06/dashlane-explains-how-attackers-managed-to-download-encrypted-password-vaults/

• View post

  You too can turn a Bluetooth device into a PC-pwning proxy https://arstechnica.com/security/2026/06/highly-reviewed-speaker-can-be-hacked-over-the-air-to-infect-connected-devices/

• View post

  There's so much I don't understand in Dashlane's disclosure that an attack on its user accounts resulted in the threat actor obtaining 20 encrypted vaults. https://support.dashlane.com/hc/en-us/articles/36038764990866-Security-advisory-Brute-force-attack-on-Dashlane-user-accounts?7194ef805fa2d04b0f7e8c9521f97343 What does it mean to brute force 2fa? Are we talking about TOTPs? That doesn't make sense because TOTPs change every 30-90 seconds, so there's no way for an attacke...

• View post

  Can’t make sense of Dashlane’s vault theft notification? You’re not alone. https://arstechnica.com/security/2026/06/dashlane-issues-opaque-advisory-warning-20-encrypted-vaults-were-stolen/

• View post

  Anybody know of any Linux distributions that have released fixes for Dirty Frag?

• View post

  Would this move by Debian, requiring byte-for-byte reproducible builds, have caught any real-world supply chain attacks seen in the past? https://itsfoss.com/news/debian-makes-reproducible-builds-mandatory/

• View post

  Can anyone help me find my AirTag attached keys? The FindMy app shows me their general location, which is a large public building where I last had them. When I go on site, my app is mostly unable to see them at all. Occasionally my app seems to be able to see a very weak signal but I can't seem to zero in on it. This is driving me nuts. I've looking now for two weeks. Anybody got tips?

• View post

  Are MP3 players even a thing these days? What are some good brands/models?

• View post

  In 2012, an industry-wide coalition of hardware and software makers adopted Secure Boot to protect against a long-looming security threat. The threat was the specter of malware that could infect the BIOS, the firmware that loaded the operating system each time a computer booted up. From there, it could remain immune to detection and removal and could load even before the OS and security apps did. To this day, key players in security—among them Microsoft and the US National Security Agency—regar...

• View post

  If you could ask any question to Mozilla concerning last month's The Zero-days are Numbered post, what would it be? https://blog.mozilla.org/en/privacy-security/ai-security-zero-day-vulnerabilities/

• View post

  There's a ton of skepticism over the true value of AI-assisted vulnerability discovery, and with good reason. Maybe the new details Mozilla has revealed don't tip the scales in favor of it being beneficial, but people should at least sift through them in good faith and with an open mind before declaring all of them bullshit. https://arstechnica.com/information-technology/2026/05/mozilla-says-271-vulnerabilities-found-by-mythos-have-almost-no-false-positives/

• View post

  Mastadonians wanting more security- and privacy-related content here: there are a bunch of journalists, researchers and engineers who are woefully underfollowed relative to the impact and importance of the work they do. Please follow and engage with them so they have a strong incentive to use this platform more. There are way too many to name all of them. In no particular order here are some (but sorry, not all; please look at the people I follow for more): @lhn @josephcox @jasonkoebler @ma...

• View post

  Mozilla has provided behind-the-scenes details on the 271 vulnerabilities it discovered with the help of Mythos. Those details include full Bugzilla reports on 12 of the vulnerabilities. I'd be curious for people to look at the reports and hear what they think. https://hacks.mozilla.org/2026/05/behind-the-scenes-hardening-firefox/

• View post

  Have any distributors/vendors released versions that fix CopyFail? If so, can someone help me compile with distributors and versions?

• View post

  Can someone explain @filippo's post to me like I'm a 5-year-old? https://words.filippo.io/128-bits/

• View post

  It's hard to overstate the importance of SSH in securing home networks, massive cloud centers and everything in between. Now, researchers have devised a novel cryptographic attack that breaks integrity of this widely used protocol. Dubbed Terrapin, it's the first-ever practical attack of its kind, and one of the very few attacks against SSH at all. Terrapin exploits weaknesses in the specification of SSH when paired with widespread algorithms (ChaCha20-Poly1305 and CBC-EtM) to remove an...

• View post

  With growing focus on the threat quantum computing poses to crucial and widely used forms of encryption, @filippo wants to make one thing perfectly clear: Contrary to popular mythology that refuses to die, AES 128 is perfectly fine in a post-quantum world https://arstechnica.com/security/2026/04/contrary-to-popular-superstition-aes-128-is-just-fine-in-a-post-quantum-world/

• View post

  Signal Messenger is warning that Recall, the AI tool rolling out in Windows 11 that will screenshot, index, and store everything a user does every three seconds, poses a risk to its users. Effective immediately, the Windows Desktop version will by default block the ability of Windows to screenshot the app. Of course, Microsoft provides no API to disable Recall from screenshotting specific apps, so Signal is getting creative. They are invoking a digital rights management API that blocks the scree...

• View post

  Transitioning the Internet to post-quantum, especially for digital signatures, is a massive undertaking. By setting a 2029 goal, they are giving themselves some slack. If they target 2035 and miss by 2 years, we are getting uncomfortably close to the danger zone.” https://arstechnica.com/security/2026/04/while-some-big-tech-players-accelerate-pqc-readiness-others-stay-the-course/

• View post

  I was lucky enough to cover Cindy Cohn's trailblazing work BEFORE she joined @eff . Here's one of several stories I wrote about her when she was still an associate attorney in private practice.