CloudFlare, SSL & Unhealthy Security Absolutism (Troy Hunt)

Really interesting (and in my opinion) great artical by Troy Hunt on why CloudFlare’s SSL [free] offerings are awesome!

“First and foremost, if your choices are to either run entirely unencrypted or to protect against the 95% (or thereabouts) of transport layer threats that exist between your visitors and your origin, do the sensible thing. Nobody in their right mind is going to advocate for remaining totally unencrypted rather than using CloudFlare purely to encrypt between their edge nodes and your users. There are people not in their right mind that will argue to the contrary and that’s precisely what the title of this post suggests – it’s unhealthy security absolutism.”

Source: Troy Hunt: CloudFlare, SSL and unhealthy security absolutism

Continue Reading

How to Crack Android Full Disk Encryption on Qualcomm Devices

“Since the key is available to TrustZone, Qualcomm, and OEMs [Original Equipment Manufacturers] could simply create and sign a TrustZone image which extracts the KeyMaster keys and flash it to the target device,” Beniamini wrote. “This would allow law enforcement to easily brute force the FDE password off the device using the leaked keys.”

Source: How to Crack Android Full Disk Encryption on Qualcomm Devices

Continue Reading