Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
We have thousands of posts on a wide variety of open source and security topics, conveniently organized for searching or just browsing.
A security startup founded by a former NSA bod has launched an encrypted email and privacy service, aimed initially at ordinary folks.
Yesterday afternoon, a woman seeking help with a decades-old family mystery posted a thread on Ask Metafilter titled "Decoding cancer-addled ramblings":
Underground cybercriminals are attempting to decrypt a 50GB dump of encrypted debit card PINs that security watchers reckon were lifted during last year's high profile breach against retail giant Target.
Bruce Schneier, the famed cryptographer and author who recently left his longtime post at BT, has taken a new position as CTO of Co3 Systems, a startup that provides incident response systems. Schneier, a central figure in the security industry for more than two decades, said he is excited about the new challenge ahead.
The U.S. National Security Agency is attempting to build a new breed of supercomputer that theoretically could make short work of cracking most keys used for encrypted communications.
Here, we describe a new acoustic cryptanalysis key extraction attack, applicable to GnuPG's current implementation of RSA. The attack can extract full 4096-bit RSA decryption keys from laptop computers (of various models), within an hour, using the sound generated by the computer during the decryption of some chosen ciphertexts.
The quantum crypto business is hardly crowded, but ID Quantique is hoping to set itself apart with a 100 Gbps-capable unit.
Following in the footsteps of other tech companies, Twitter is beefing up its security to make it harder for outsiders -- including the government -- to uncover data, the company announced Friday.
Are you concerned about the security of your data in the cloud? Of course you should be, even if you're just an isolated consumer. But what if you're responsible for the security of data for an enterprise?
Newegg's courtroom face-off with patent-licensing giant TQP Development is nearing its end. TQP has sued hundreds of companies, saying it has patented the common Web encryption scheme of combining SSL with the RC4 cipher. Almost 140 companies have paid TQP a total of more than $45 million.
While Microsoft's busy selling t-shirts and mugs about how Google's "Scroogling" you, the search giant's chairman is busy tackling a much bigger problem: How to keep your information secure in a world full of prying eyes and governments willing to drag in data by the bucket load. And according to Google's Eric Schmidt, the answer is fairly straightforward.
Cracking one of the most complicated cipher devices ever created -- the Enigma machine -- may not have been what Britain's Mavis Batey envisioned when she studied the German romantic poets at University College London when World War II broke out.
Google's faster-than-expected upgrade of all its SSL certificates to an RSA key length of 2048 bits will make cracking connections to the company's services more difficult without affecting performance, experts say.
A unique effort to crowdsource a security audit of the popular TrueCrypt open source encryption software appears to be going viral three weeks after it was launched by two U.S. based researchers in response to concerns that the National Security Agency may have tampered with it.
Secure Sockets Layer is a standard mechanism websites use to help secure data and transactions, but according to Qualys security researcher Ivan Ristic, most SSL sites are actually misconfigured. Ristic delivered his study here at the Black Hat security conference as an update to the preliminary data he published last month.
We already know the NSA wants to eavesdrop on the Internet. It has secret agreements with telcos to get direct access to bulk Internet traffic. It has massive systems like TUMULT, TURMOIL, and TURBULENCE to sift through it all. And it can identify ciphertext -- encrypted information -- and figure out which programs could have created it.
Recent revelations about the extent of NSA surveillance have put even the standards by which encryption systems are designed into question. Encryption experts Matthew Green, Phillip Zimmermann, and Martin Hellman discuss what makes a code secure and the limits of privacy in the modern age.
The online anonymity network Tor is a high-priority target for the National Security Agency. The work of attacking Tor is done by the NSA's application vulnerabilities branch, which is part of the systems intelligence directorate, or SID. The majority of NSA employees work in SID, which is tasked with collecting data from communications systems around the world.
"For years Linux has had a false sense of security, mainly because of the 'many eyes make bugs shallow' myth," Slashdot blogger hairyfeet suggested. "Seriously, show of hands: How many have done a code audit of LibreOffice? Firefox? Chromium?
The U.S. National Security Agency's efforts to defeat encryption will backfire by eroding trust in U.S.-based Internet services and in the agency's own efforts to aid U.S. companies with cybersecurity, a group of privacy advocates said Tuesday.
Like staying secure? So do we.
Sign up for updates, tips, and alerts!
