345 private links
A 862-bits RSA-260 key, so we have time for the 2048 bits key. The CPU (and cloud infrastructure) will have enough power to break 2048 bits key at some point.
ID verification on the Internet. Well there is already a leak ofidscan.net for a year.
In millions:
153 millions drivers license
10 millions identification card
2 millions travel card
and more
La meilleure application gérant les OTPs pour de l'authentification deux facteurs que j'ai trouvé jusqu'à maintenant.
Comment éviter le .env, un fichier en clair
Secure, single-binary Rust CRUD application for managing CSAF 2.0 and 2.1 security advisories. Provides both a server-side rendered web UI (Hyper + Bootstrap 5 + HTMX) and a RESTful HATEOAS JSON API under /api/v1/.
La société française paie l'absence du NIS2 dans les textes légaux actuellement. L'obligation de l'authentification multi-facteurs auraient épargné un certain nombre de piratage.
Le NIS2 semble être un excellent standard à suivre. Pourquoi la France prend-t-elle autant de temps alors qu'elle se numérise ?
La CJUE est saisie afin d'imposer des sanctions financières à la France jusqu'à ce que le texte soit totalement transposé.
C'est la double peine.
The technology giant won the award for publishing a May blog post that threatened security researchers with legal action if they publish zero-days about its products.
How phishing attacks are hard to distinguish because even real pages looks suspicious
Here we go again
From other sources:
- Aikido: https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack
- Bleeping Computer: https://www.bleepingcomputer.com/news/security/massive-chaindrop-npm-supply-chain-attack-infects-hundreds-of-packages/
- Microsoft: https://www.microsoft.com/en-us/security/blog/2026/08/04/chaindrop-supply-chain-compromise-anatomy-self-propagating-worm/#mitigation-and-protection-guidance
One of the recommendation is to use a 3-day cooldown before using new versions. Crazy.
- Rust doesn't prevent TOCTOU (Time-of-Check to Time-of-Use) race conditions (file path resolution → use file handlers directly)
- Panics are denial-of-service vulnerabilities when handling untrusted input.
- In case of a well established tool, compatibility is a security feature.
- Resolve external information before crossing trust boundaries.
- The interactions with the operating system is a security boundary in Rust. The developer has to be careful.
The post goes in-depth for many cases.
Hashcat on a Game Boy Advance runs 727 Hashes per second
About the xz backdoor
It should work with a Tailscape IP (or VPN) for example to be accessible from the Internet.
It's a set of tools to protect a webserver.
- USB: If the USB stick is removed, the LUKS keys are erased and the computer rebooted (it's smilar to a formatting of the hard drive because the data can not be decrypted anymore).
- Dead man switch : If a signal is not sent to a service every 24 hours, the similar operation occurs: Keys are erased and the server reboots.
It's kind of like in spy movies when you don't want your data to fall into the wrong hands.
Transsion est un framework construit sur Android.
Le framework surveille: "Votre position GPS précise, les antennes-relais autour de vous, la consommation réseau appli par appli sur une soixantaine d'applis, quelle appli est affichée à l'écran en temps réel, et même quelle appli vient d'allumer la caméra".
Tout cela est remontée sur des domaines shalltry.com et transsion-os.com.
Ce SDK est utilisé dans plusieurs applications populaire en Afrique aussi.
Tout cela n'est pas désactivable puisque c'est installé au niveau de l'OS. Un malware s'installait sur 53 000 Tecno W2 vendus en Éthiopie, au Ghana ou enore au Cameroun.
Un workaround serait de bloquer les domaines au niveau du DNS, pour qu'au moins aucune information ne remote aux serveurs.
Un retour sur des outils d'IA pour la sécurité.
Cette vulnérabilité nous amène également à parler de Claude Mythos. En effet, un unique commit de 2023 (58c9b016e128, avril 2023) a introduit non pas une, mais deux race conditions distinctes dans quelque 2 500 lignes du code epoll.
But the most troubling part of this story is Apple’s terrible handling of the issue. Murphy reported the bug in June 2024, and Apple responded a month later, saying they had launched an internal investigation. Then, in March of this year, they announced they’d fixed the issue—except they hadn’t. Murphy checked, and the flaw was still there. So in May, Apple changed its tune and flat-out told him to shut up, but the most annoying thing about this whole situation is the crappy handling of it: “We would appreciate it if you wouldn’t disclose this information until our investigation is complete.” In short, just shut up while we do nothing to fix it ^^.
(via https://korben.info/apple-hide-my-email-faille-adresse-reelle.html)