beerisgood/Security-link-collection

This list is constantly being expanded

• Password Manager: Tavis Ormandy's opinion on Password Managers, also fatal flaws in deterministic password managers. How did LastPass master passwords get compromised, how their source code was stolen, how password vaults were obtained and even a year after the disastrous breach, LastPass has not improved. Bitwarden design flaw: Server side iterations. (In)Security of the Unix "Pass" password manager. KeePass's InSecurity against local attackers, A Case Study in Attacking KeePass Part 1, 2
• Networking 101 YouTube
• The Six Dumbest Ideas in Computer Security
• How to test your DNS (security & privacy)
• How to test website (security, privacy, cookies or headers)
• How to test your eMail provider (security & privacy)
• Why the FBI can’t get your browsing history from Apple iCloud (and other scary stories)
• Why GPG/ (Open-)PGP isn't recommend and what the numerous problems are until today
• Check if your email/ phone number or password is in a data breach
• Understand the security risks of permissions for browser extensions and why even manifest v3 does not protect you sufficiently against abusing
• Some examples why browser extensions are bad, scams users - since at least 2015 until today - even big ones like Skype or Adobe and how they make your fingerprint unique or bypass your 2FA and Chrome extensions can steal your passwords from websites and they're the next frontier for Identity Attacks. (Even) Chrome Web Store is a mess.
• read what countless security experts and Washington Post have to say about linux insecurity/ Security Circus, hacks, dangerous configurations and All vendor kernels are plagued with security vulnerabilities (encryption is also broken)
• Some Thoughts about the NSO Group's Pegasus
• An Antivirus does not improve your security and even collect and sell your data or force-install unwanted crap
• Enumerating badness
• (Electron; nodejs) Applications that run Chromium without the Sandbox
• test your ISP (Internet Service Provider) Border Gateway Protocol (BGP) security
• Stop using (encrypted) Email, even in 2026.
• FLOSS doesn't imply security
• Email Security Pitfalls
• End-to-End Encryption in Web Apps
• Docker - the security nightmare of dependencies and hidden place for malware, exposed secrets and private keys and also with "Hub" a place for millions of malicious repositories
• SIM Card Hijacking: How it works and what you can do about it
• SS7 Attacks: Intercepting SMS and calls as easy as ABC
• Messenger (problems): Whatsapp's Backups, Signal's Sealed Sender and downplayed encryption key flaw, Reviewing the Cryptography Used by Signal, Telegram's Cryptanalysis 1, 2 and very old InSecurity, Three Lessons from Threema, Converso - how to uncover extraordinary claims, Tox handshake vulnerablity, Ginlo, Collaborative Groups, KakaoTalk , Session, Part 2, Bitchat security debate
• Browser Insecurity: Pale Moon, ungoogled-Chromium, Brave, Avast Browser, Arc Browser, Perplexity's Comet AI browser
• SMS phishing is way too easy
• Why you shouldn't use VPN services with their leaks. If needed, use MPRs
• avoid Electron based programs
• Matrix InSecurity, concerns and big potential metadata issues
• Phishing with Chromium's Application Mode
• Browser in the Browser (BITB) Attack
• Chrome Browser Exploitation Part 1
• graphics about PassKeys in detail, security overview and an overview of supporting websites
• What happens when you swipe a credit card and what are the differences
• What are the differences between bare metal, virtual machines, and containers
• HTTP/1 to HTTP/2 to HTTP/3 - a Deep Dive
• The Rising Threat to Consumer Data in the Cloud
• Common pitfalls of breaking up HTTPS connections
• (Motherboard vendor) MSI's (in)Secure Boot
• "Sign in with" Apple
• Building a Trusted Ecosystem for Millions of Apps
• Protecting Chrome Traffic with Hybrid Kyber KEM
• fail2ban sucks, pfSense
• iMessage with PQ3 post-quantum cryptographic protocol - external security review 1, 2
• Security problems with Routers like from Netgear, Netgear 2, D-Link, D-Link 2, Asus or DrayTek, TP-Link
• how Apple handle the Digital Markets Act
• Breaking the DECT Standard Cipher with Lower Time Cost
• IoT Device Security Specification 1.0
• Cloud InSecurity: Nextcloud E2EE broken
• About Apple threat notifications and protecting against mercenary spyware
• WiFi - The SSID Confusion Attack
• Leveraging DNS Tunneling for Tracking and Scanning
• Security research on Apple's Private Cloud Compute
• Privacy, Anonymity and Compartmentalization repository
• Flow Correlation Attacks on Tor Onion Service Sessions with Sliding Subset Sum
• Detect and avoid social engineering schemes such as phishing messages, fake support calls, and other scams
• Understanding Aggregate Trends for Apple Intelligence Using Differential Privacy
• Online Identity Verification with the Digital Credentials API
• Video: Secure your app with Memory Integrity Enforcement | Meet with Apple
• ASCII Smuggling for LLMs, Hidden Prompt Injections with Anthropic Claude, Ghosts in the Machine: ASCII Smuggling across Various LLMs, Defending LLM applications against Unicode character smuggling
• Hacking Google Bard - From Prompt Injection to Data Exfiltration, Mitigating prompt injection attacks with a layered defense strategy
• TEE.fail: Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition
• GPUBreach: Privilege Escalation Attacks on GPUs using Rowhammer
• What does Lockdown Mode actually do to keep you safe from spyware? Video
• A blueprint for formal verification of Apple corecrypto
• GPUHammer: Rowhammer Attacks on GPU Memories are Practical
• GPUBreach: Privilege Escalation Attacks on GPUs using Rowhammer
• GPUThor - Amplifying Rowhammer Attacks via Non-Uniform Patterns to Exploit ECC-Protected GPUs
• Apple Reference Image: A New Approach for Verified Photography
• Blocking Identity Resolution Infrastructure