After publishing our article about incomplete privacy policies of mostly private servers, several readers asked us for guidance on identifying incomplete privacy policies.
In this guide, we show how you can quickly check if a privacy policy contains mandatory information according to the European GDPR.
Every year, reports about the worst passwords of the year show up. Every year, all of us see the same worst passwords like “123456”, “111111”, “querty”, or “password”, still used by thousands of people. And every year, security people tell us that we must change our passwords regularly, our passwords must have at least n digits, and of course, using biometrics is insecure, short passwords are insecure, using words is insecure, reusing passwords is insecure, and so on.
While countless blogs flood the internet with tips and best practices to keep your passwords “secure” and creating “perfect” passwords, many of them forget about two important things: keeping it simple and defining a threat model.
One year ago, the European General Data Protection Regulation (GDPR) became enforceable after a two-year transition period. In the wake of this event, the media reported about several administrators who decided to permanently shut down their (small) websites while many non-EU websites started to block all EU-based IP addresses. Some people spread myths, and soon afterwards the media lost interest in the GDPR. Taken as a whole, the GDPR caused confusion despite the fact that former national privacy laws were mostly as strict as the GDPR itself.
In this article, we look at the privacy policies of 20 websites (operated by private individuals) to check whether they provide information for their users according to Articles 12 and 13 (GDPR).
Some readers want to start their career in information security. However, they don’t know how to start. In this article, we talk about careers in information security.
This week, matrix.org identified that their server infrastructure got compromised. Matrix.org is the reference server of the open Matrix protocol used for real-time communication. People reacted differently: some tried to defend matrix.org since it is offering an open and decentralized communication platform, others stated that matrix.org is a security mess, and that they will stay with XMPP or their favorite instant messaging protocol. While matrix.org still recovers from the data breach, it seems to be already clear that this breach was possible due to human error and organizational shortcomings.
In this article, we discuss lessons learned from the matrix.org data breach that are important for everyone.