Microsoft breached secrets used in ongoing attacks. Chrome's real-time phsihing protection. FCC approves cybersecurity label.

It seems the attacks are still ongoing, with the threat group having breached internal systems and source code, and using stolen secrets in follow-on attacks against customers.

Google's current Safe Browsing feature uses a client-side list of known malware URL's to check against, a feature that I very much like. They now plan to switch this to real-time, server-side checks. I'm probably not the only one who gets a little nervous when hearing that. The article does a good job of explaining what measures will be taken to safeguard user privacy, in cooperation with Fastly's Oblivious HTTP (OHTTP) relays. I'm still nervous though.

It's called the Cyber Trust Mark, and it's initially focused on consumer IoT devices but may be broadened in the future. I know that labels sound boring, but I honestly believe this is one of the best ways to both educate consumers and force vendors to do the right thing.

I realise that I haven't really thought of the implications of eSIM's in SIM swapping attacks, and this article explains it well. It really is just a matter of breaching your online provider account, generating a new QR code, et voila, the attacker now has your number and yours phone stops working. I don't know if various mobile service providers have different security measures in place for this, but either way it's worth being aware off.

This is a deep-diving technical write-up that just tickled me. It's on how you can set up your own LetsEncrypt-like flow to sign your own certificates for use in your homelab or LAN. It's not at all necessary, but lovingly nerdy and interesting.

I don't think most developers realise how valuable 1Password can be. It doesn't just hold passwords, it also hold your SSH keys, signs your Git commits, injects tokens and other secrets in CLI scripts, and much more. (Sponsored)