New Chrome extension spots unencrypted tracking

Thursday, January 29th, 2015

A new Chrome extension highlights tools embedded in websites that could pose privacy risks by sending data unencrypted over the Internet. It's hard to find a major website that doesn't use a variety of third-party tracking tools for online advertising, social media and analytics. But if the trackers send data unencrypted, ...

A secure version of user.js to harden Firefox installations

Sunday, December 21st, 2014

Warning: Backup your existing user.js file (if it exists) and use with caution.  Some website functionality may break. Some of the settings in this user.js file might seem redundant, as some of them are already set to the same values by default. However, the user.js file has this nice property, that ...

Your Browser is (not) Locked

Wednesday, December 17th, 2014

Most ransomware has a binary file that needs to be executed before it can infect your PC. Ransomware usually relies on social engineering or exploits to infect unsuspecting users. However, some malware authors are bypassing this requirement with a new trick - browser lockers. Unlike traditional ransomware threats that lock the entire desktop, ...

Strengthening 2-Step Verification with Security Key

Tuesday, October 21st, 2014

2-Step Verification offers a strong extra layer of protection for Google Accounts. Once enabled, you’re asked for a verification code from your phone in addition to your password, to prove that it’s really you signing in from an unfamiliar device. Hackers usually work from afar, so this second factor makes ...

This POODLE bites: exploiting the SSL 3.0 fallback

Tuesday, October 14th, 2014

Today we are publishing details of a vulnerability in the design of SSL version 3.0. This vulnerability allows the plaintext of secure connections to be calculated by a network attacker. I discovered this issue in collaboration with Thai Duong and Krzysztof Kotowicz (also Googlers). SSL 3.0 is nearly 15 years old, ...