Collaborate Disseminate
I understand that for most package managers (pip, brew, TeX tlmgr, etc) packages are typically not audited, so there are some inherent security risks in using these package managers. Sometimes the package repositories aren’t trustworthy ei… Continue reading For package managers like pip, is it a better practice to install packages with the `–user` flag?
Many Google Chrome extensions require permissions to read the contents of webpages the user visits. How can the user verify whether and to what extent a certain Chrome extension leaks data?
Continue reading How do I know if a Google Chrome extension is leaking data?
Authy is a popular cross-platform TOTP application that supports syncing keys across devices. I have been a little confused by the idea of having a desktop client… This way if someone accesses my primary PC they’d find all my passwords s… Continue reading Doesn’t installing a TOTP client on your primary PC undermine the whole point of 2FA? [duplicate]
Are there any dangers of extending my PATH, say by adding /Users/me/bin?
Many popular VPN services (that provide encrypted tunnels between the users’ devices and distant VPN servers) authenticate users using a pair of email address and password. What attacks would the disclosure of the credentials… Continue reading What attacks does the disclosure of VPN user credentials allow?
Why would an attacker want to know if a key exchange between two parties succeeded or failed? What are some motivations for wanting to know this?
How can (third-party) VPN applications tunnel all communication of all processes on sandboxed operating systems (such as OSX, etc)? Can they access the traffic of other apps and redirect them?
Why is this approach often pref… Continue reading How can third-party VPN applications tunnel all traffic of all processes on sandboxed operating systems?
What features risk information leakage and how secure is the ecosystem overall? What are some of the most recent exploits?
Continue reading To what extent can the latest iOS be trusted?
I am using a VPN to ensure to encrypt my traffic.
I wonder though if I could check somehow if the datastream really is encrypted?
Continue reading How do I know that my connection is really encrypted?