Firefox starts switching on DNS-over-HTTPS to encrypt lookups, stymie tracking

Credit to Author: Gregg Keizer| Date: Wed, 26 Feb 2020 11:11:00 -0800

Mozilla has started to turn on DNS-over-HTTPS, or DoH, as part of its overall strategy of stressing user privacy.

“We know that unencrypted DNS is not only vulnerable to spying but is being exploited,” wrote Selena Deckelmann, Mozilla’s new vice president of desktop Firefox, in a Feb. 25 post to a company blog. “We are helping…to make the shift to more secure alternatives [and] do this by performing DNS lookups in an encrypted HTTPS connection. This helps hide your browsing history from attackers on the network, helps prevent data collection by third parties on the network that ties your computer to websites you visit.”

To read this article in full, please click here

Read more

Mozilla patches Firefox zero-day as attackers exploit flaw

Credit to Author: Gregg Keizer| Date: Thu, 09 Jan 2020 11:46:00 -0800

Just one day after releasing Firefox 72, Mozilla updated the browser with a fix to shut down active attacks, the company acknowledged.

On Wednesday, Mozilla issued Firefox 72.0.1, which included one change: A patch for the vulnerability identified as CVE-2019-17026. “We are aware of targeted attacks in the wild abusing this flaw,” Mozilla said in the short description of the flaw, signaling that criminals were already leveraging the zero-day vulnerability, the term applied because there no time elapses between patching and exploitation.

To read this article in full, please click here

Read more

Security lessons from a Mac-only fintech company

Credit to Author: Jonny Evans| Date: Wed, 20 Nov 2019 07:43:00 -0800

Apple remains a highly secure choice for enterprise professionals, but security threats remain and the environment requires sophisticated endpoint management tools, confirmed Build America Mutual (BAM) CTO, David McIntyre.

The Mac only bank

BAM is one of the leading U.S. municipal bond insurers and has insured over $65 billion since launch in 2012. It also has the rare distinction of being a fintech firm that is completely based on Macs.

To read this article in full, please click here

Read more

Patch Tuesday arrives with Access error, 1909 in tow, and a promise of no more 'optional' patches this year

Credit to Author: Woody Leonhard| Date: Wed, 13 Nov 2019 07:59:00 -0800

The patches haven’t yet been out for 24 hours and already we’re seeing a lot of activity. Here’s where we stand with the initial wave of problems.

Malicious Software Removal Tool installation error 800B0109 

Many early patchers found that the MSRT, KB 890830, kept installing itself over and over again. Poster IndyPilot80 says:

It sits at “Installing: 0%” for a couple minutes then goes away. When I hit “Check for Updates” it shows up again and does the same thing.

To read this article in full, please click here

Read more

Duck Duck Go offers Mac users even more privacy

Credit to Author: Jonny Evans| Date: Thu, 07 Nov 2019 06:20:00 -0800

People are finally waking up to the importance of privacy and the risk of entities over whom we have no control hoovering up the details of our digital lives, and that’s why the latest news from Duck Duck Go is so worthwhile.

Apple’s good privacy just got better

We know Apple is working to protect privacy – its newly updated privacy website shares a huge amount of information on its efforts, while the newly-published Safari white paper confirms the browser’s privacy protections include (among other things):

To read this article in full, please click here

Read more

Google strengthens Chrome's site isolation to protect browser against its own vulnerabilities

Credit to Author: Gregg Keizer| Date: Thu, 31 Oct 2019 04:49:00 -0700

Google is telling Chrome users that it has extended an advanced defensive technology to protect against attacks exploiting vulnerabilities in the browser’s Blink rendering engine.

Chrome 77, which launched in September but was supplanted by Chrome 78 on Oct. 22, received the beefed-up site isolation, wrote Alex Moshchuk and Łukasz Anforowicz, two Google software engineers, in an Oct. 17 post to a company blog. “Site Isolation in Chrome 77 now helps defend against significantly stronger attacks,” the two said. “Site Isolation can now handle even severe attacks where the renderer process is fully compromised via a security bug, such as memory corruption bugs or Universal Cross-Site Scripting (UXSS) logic errors.”

To read this article in full, please click here

Read more