privacy
29 posts found
Oryxis vs WhoisThat: Two Rust Tools for SSH and VPN
Two recent open-source Rust projects solve real security and tunneling problems without vendor lock-in or subscriptions. Oryxis gives you a native SSH client. W…
Signed Installers and the macOS Infostealer Myth
Fake Zoom and Slack installers are delivering the Sonoma stealer to Macs. Code signing blocks tampering, not deception. Verify the artifact before you run it.
The Myth of Universal VPN Security
Common belief that any VPN provides equal protection ignores implementation differences, transparency, and real-world effectiveness. Reality shows VPNs hide IP …
Android 17 Encrypted Client Hello Still Leaves Hostnames on the Wire
Android 17 turns ECH on by default, but RFC 9849 only hides SNI. Outer public names, dedicated origin IPs, and missing HTTPS ech= records still leak the destina…
How CLI Package Managers Bypass macOS Gatekeeper Execution Rules
CLI downloaders and package managers bypass macOS Gatekeeper by omitting quarantine extended attributes on fetched binaries.
Browser Extension Stores Are Not Security Boundaries
Official add-on marketplaces do not guarantee safety. Malicious Firefox and Chrome extensions slip past linters to harvest credentials and session tokens.
Adversary-in-the-Middle Phishing Proxies: How Modern Frameworks Hijack MFA Sessions
Deep technical breakdown of AiTM phishing proxies like Mirage2FA, how they intercept MFA sessions, and the architectural changes needed to neutralize session th…
Securing Inbound Webhooks: HMAC Verification and Replay Attack Defense
Inbound webhooks without cryptographic verification expose backend services to forgery, replay attacks, and resource exhaustion. Here is how to implement HMAC-S…
Secret Leakage Risks When LLMs Execute Shell Commands
A practical 10-step hardening checklist for securing LLM-driven shell execution: runtime container isolation, credential purging, network exfiltration preventio…
Entra CVSS 10.0: Audit Your Tenant After CVE-2026-69836
Microsoft patched a CVSS 10.0 deserialization RCE in Entra. No customer package to install. Your tenant still needs an audit of grants, secrets, and admin roles…