Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
We have thousands of posts on a wide variety of open source and security topics, conveniently organized for searching or just browsing.
The reported hack of major consumer and business data aggregators has intensified doubts of the reliability of knowledge-based authentication widely used in the financial services industry, analysts say.
Security biz RSA has reportedly warned its customers to stop using the default random-number generator in its encryption products - amid fears spooks can easily crack data secured by the algorithm.
Quantum cryptography has yet to deliver a truly unbreakable way of sending messages. Quantum entanglement may change that. RECENT revelations of online snooping on an epic scale, by government agencies which may well have been breaking the law, have prompted some users of the internet to ask who you can trust with sensitive data these days.
Cryptographers are fighting back against efforts by spy agencies to secretly weaken the encryption standards designed to keep the Internet secure.
I've recently seen two articles speculating on the NSA's capability, and practice, of spying on members of Congress and other elected officials. The evidence is all circumstantial and smacks of conspiracy thinking -- and I have no idea whether any of it is true or not -- but it's a good illustration of what happens when trust in a public institution fails.
The Internet, and many forms of online commerce and communication that depend on it, may be on the brink of a "cryptopalypse" resulting from the collapse of decades-old methods of shared encryption.
Phil Zimmermann, creator of PGP, in a wide-ranging interview talks about the corrupting nature of big data, the end of privacy and the rise of the surveillance society. He also shared his thoughts on Moore
Dennis Fisher talks with Matthew Green of Johns Hopkins University about the crypto advances in recent years, the BREACH attack revealed at Black Hat and whether it
Twitter just rolled out a pretty nice two-factor authentication system using your smart phone as the second factor: The new two-factor system works like this. A user enrolls using the mobile app, which generates a 2048-bit RSA keypair. The private key lives on the phone itself, and the public key is uploaded to Twitter
Some of the people who were most concerned about Internet privacy, and we're using the Tor anonymous Internet service to protect it, may have been the most exposed.
One common and stupidly simple way hosts are compromissed is weak SSH passwords. You would think people have learned by now, but evidently there are still enough systems with root passwords like 12345 around to make scanning for them a worthwhile exercise.
Whether the FBI and NSA have the legal authority to obtain the master keys that companies use for Web encryption remains an open question, but it hasn't stopped the U.S. government from trying.
It took more than eight years for a CIA analyst and a California computer scientist to crack three of the four coded messages on the CIA
For the first time, encryption is thwarting government surveillance efforts through court-approved wiretaps, U.S. officials said today.
Opera Software said Wednesday hackers pilfered from its internal systems at least one code-signing certificate that was used to sign malicious software.
It took eight years after artist Jim Sanborn unveiled his cryptographic sculpture at the CIA
Microsoft has taught version 4.0 of the Windows mitigation tool EMET some new tricks. It now detects attacks that attempt to eavesdrop on encrypted connections and is better at thwarting return-oriented programming (ROP) attacks.
Apple says it has end-to-end encryption for iMessage and FaceTime communications, but users should not interpret that as providing an ironclad defense against government snooping.
SSLyze is a Python tool that can analyze the SSL configuration of a server by connecting to it. It is designed to be fast and comprehensive, and should help organizations and testers identify misconfigurations affecting their SSL servers.
Like staying secure? So do we.
Sign up for updates, tips, and alerts!
