Nextcloud 资源管理错误漏洞

An access control error vulnerability exists in Nextcloud End-to-End Encryption, an open source, self-hosted file synchronization and sharing communication application platform from Nextcloud Germany, which stems from improper access restrictions. The vulnerability allows remote attackers to gain...

WhatsApp reverses course, will not limit app functionality

WhatsApp, the end-to-end encrypted messaging service that has lost users, its founders, and a large amount of public goodwill, issued a reversal on its recent privacy policy enforcement measures, clarifying that it will no longer punish users who refuse to share some of their data with the...

End to end encryption folder locking is not properly protected

None...

WhatsApp Sues Indian Government Over New Internet Regulations

WhatsApp on Wednesday fired a legal salvo against the Indian government to block new regulations that would require messaging apps to trace the "first originator" of messages shared on the platform, thus effectively breaking encryption protections. "Requiring messaging apps to 'trace' chats is th...

WhatsApp calls and messages will break unless you share data with Facebook

WhatsApp told users last week that there was no need for alarm regarding an upcoming privacy policy deadline, as users who refuse to accept the privacy policy will not have their accounts deleted—they will just have their apps rendered useless, eventually incapable of receiving calls and messages...

Nextcloud: Clients do not verify server public key

So this is related to https://hackerone.com/reports/1189162 but also to your RFC Bear with me because there is going to be some hand waving here and there. Since not everything is implemented yet from your RFC. Right now what happens is:...

Nextcloud: End to end encryption folder locking is not properly protected

I do not see the endtoendencryption app listed here. But since you advertise it big on your website and in communication. And the clients that also support it are covered I assume this is part of the program as well. 1. userA has end to end encryption setup 2. userB wants to annoy userA 3. userB...

Nextcloud: Android app does not clear end to end encryption keys

userA on serverA sets up end to end encryption on their android device 2. userA has some end to end encrypted data 3. userA removes their account on serverA from their android device for whatever reason 4. attacker evil admin obtains the device of userA 5. attacker evil admin logs in on the...

Nextcloud: End to end encryption public key is not properly verified on Desktop and Android

Since last time when I reported something on multiple platforms you seems to prefer handling it in 1 spot. I now just do one. Let me know if You want me to fill separate for android as well. This issue does not seem to happen on iOS as there a test string is encrypted and decrypted, in short...

Signal app insists it’s so private it can’t provide subpoenaed call data

Signal—the private, end-to-end encrypted messaging app that surged in popularity in recent months—once again reminded criminal investigators that it could not fully comply with a legal request for user records and communications because of what it asserts as a simple, unchanging fact: The records...

The UK Is Trying to Stop Facebook's End-to-End Encryption

The government's latest attack is aimed at discouraging the company from following through with its planned rollout across platforms...

CVE-2021-21387

Wrongthink peer-to-peer, end-to-end encrypted messenger with PeerJS and Axolotl ratchet. In wrongthink from version 2.0.0 and before 2.3.0 there was a set of vulnerabilities causing inadequate encryption strength. Part of the secret identity key was disclosed by the fingerprint used for connectio...

Protecting Sensitive Cardholder Data in Today’s Hyper-Connected World

The payment processing system has steadily evolved over time. Greatly amplified by the COVID-19 pandemic, the use of electronic payment systems in this economy has soared nearly overnight. With online shopping at an all-time high as consumer behaviors shift toward more convenience and flexibility...

Secret Chat in Telegram Left Self-Destructing Media Files On Devices

Popular messaging app Telegram fixed a privacy-defeating bug in its macOS app that made it possible to access self-destructing audio and video messages long after they disappeared from secret chats. The vulnerability was discovered by security researcher Dhiraj Mishra in version 7.3 of the app, w...

Ring Adds End-to-End Encryption to Quell Security Uproar

Smart doorbell maker Ring is giving cybersecurity critics less to gripe about with the introduction of end-to-end encryption to many of its models. Ring products, which have been a juggernaut success with consumers, have faced a litany of harsh criticism from cybersecurity experts for what they s...

Post-Backlash, WhatsApp Spells Out Privacy Policy Updates

WhatsApp is making explicit clarifications around its updated privacy policy, after reports ran amok about the messaging app mandating all-encompassing data-sharing with parent company Facebook. The app’s new privacy policy and terms of service, which will go into effect Feb. 8, says that WhatsAp...

Facebook’s Mandatory Data-Sharing Rules for WhatsApp Spark Ire

WhatsApp is asking users to accept a new privacy policy that will share all of their data with Facebook beginning Feb. 8, a move that has users sounding an alarm once again about the privacy of their information in the hands of the social media giant. The Facebook-owned messaging service already...

Google Is Testing End-to-End Encryption in Android Messages

For now, the security measure will be available only to people using the beta version of the app...

Zoom Finally Has End-to-End Encryption. Here's How to Use It

You can lock down your meetings like never before—even if you have to give up a few features to do so...

News Wrap: Barnes & Noble Hack, DDoS Extortion Threats and More

The Threatpost editors break down the top security stories of the week ended Oct. 16, including: Patch Tuesday insanity, with Microsoft and Adobe releasing fixes for severe vulnerabilities – including a critical, potentially wormable remote code execution bug known as the “Ping of Death” Barnes a...