June 01, 2023

S3 Ep137: 16th century crypto skullduggery

Lots to learn, clearly explained in plain English... listen now! (Full transcript inside.)

Naked Security

May 30, 2023

Serious Security: Verification is vital – examining an OAUTH login bug

What good is a popup asking for your approval if an attacker can bypass it simply by suppressing it?

Naked Security

October 10, 2022

Serious Security: OAuth 2 and why Microsoft is finally forcing you into it

Microsoft calls it "Modern Auth", though it's a decade old, and is finally forcing Exchange Online customers to switch to it.

Naked Security

April 29, 2022

GitHub issues final report on supply-chain source code intrusions

Learn how to find out which apps you've given access rights to, and how to revoke those rights immediately in an emergency.

Naked Security

December 18, 2019

Google to choke off ‘less secure applications’

If you're entering a username and password to give an app access to a G Suite account, beware: you won't be able to do it for much longer.

Naked Security

September 02, 2019

Google throws bug bounty bucks at mega-popular third-party apps

If an app has more than 100 million installs, Google will pay for bugs, even if the app makers already have their own bounty programs.

Naked Security

April 04, 2019

Facebook won’t ask for your email password any more

What's that you say - Facebook was asking for the password to your email account? Yes, sometimes it was.

Naked Security

December 18, 2018

Twitter fixes bug that lets unauthorized apps get access to DMs

"You authorise it - whereupon it promptly leaks to the world all your sexts, inappropriate jokes, and dank memes. Tragic!" said the researcher.

Naked Security

January 25, 2016

RSA Conference disables Twitter password-collecting form

After a storm of criticism and shaming over the blurb-tweeting feature, the organizers said that they had used OAuth and hadn't collected passwords.

Naked Security