New Attacks Against Secure Enclaves
November 10 2025Encryption can protect data at rest and data in transit, but does nothing for data in use. What we have are secure enclaves. I’ve written about this before:
Almost...
Read more
A Surprising Amount of Satellite Traffic Is Unencrypted
October 17 2025Here’s the summary:
We pointed a commercial-off-the-shelf satellite dish at the sky and carried out the most comprehensive public study to date of geostationary satellite communication. A shockingly large...
Read more
Data Wallets Using the Solid Protocol
July 25 2024I am the Chief of Security Architecture at Inrupt, Inc., the company that is commercializing Tim Berners-Lee’s Solid open W3C standard for distributed data ownership. This week,...
Read moreOn IoT Devices and Software Liability
January 12 2024New law journal article:
Smart Device Manufacturer Liability and Redress for Third-Party Cyberattack Victims
Abstract: Smart devices are used to facilitate cyberattacks against both their users and third parties. While...
Read more
New iPhone Security Features to Protect Stolen Devices
December 27 2023Apple is rolling out a new “Stolen Device Protection” feature that seems well thought out:
When Stolen Device Protection is turned on, Face ID or Touch ID authentication is...
Read more
Cars Have Terrible Data Privacy
September 12 2023A new Mozilla Foundation report concludes that cars, all of them, have terrible data privacy. All 25 car brands we researched earned our *Privacy Not Included warning label—making cars the...
Read moreThe Conviction of Uber’s Chief Security Officer
November 7 2022I have been meaning to write about Joe Sullivan, Uber’s former Chief Security Officer. He was convicted of crimes related to covering up a cyberattack against Uber. It’s a...
Read moreLeaking Passwords through the Spellchecker
September 26 2022Sometimes browser spellcheckers leak passwords:
When using major web browsers like Chrome and Edge, your form data is transmitted to Google and Microsoft, respectively, should enhanced spellcheck features be...
Read more
More Log4j News
December 16 2021Log4j is being exploited by all sorts of attackers, all over the Internet:
At that point it was reported that there were over 100 attempts to exploit the vulnerability...
Read more
ProtonMail Now Keeps IP Logs
September 10 2021After being compelled by a Swiss court to monitor IP logs for a particular user, ProtonMail no longer claims that “we do not keep any IP logs.”
EDITED...
Read more
Recent Comments