Boston bans face recognition, bad passwords.

• Boston bans facial recognition
• 123456 is still the most popular password
• iOS 14 catches Linked-In, Tik Tok, and others red handed!
• US-CERT notes two Emergency Windows Updates
• HackerOne shares their top 10 public bug bounty programs
• Sony launches PlayStation bug bounty program with rewards of $50K+
• F5 Networks patches a highest-severity vulnerability

We invite you to read our show notes at https://www.grc.com/sn/SN-774-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

Congress wants to kill encryption & face recognition.

• New information about Ripple20
• The Facial Recognition and Biometric Technology Moratorium Act wants to kill face recognition
• The Lawful Access to Encrypted Data Act wants to kill encryption
• Michigan State's legislative House passed the "Microchip Protection Act"
• Apple forces the industry down to one-year web browser certificate lifespans
• Safari to eschew 16 new web API's for the sake of user privacy
• Apple also got on the DoH & DoT bandwagon
• Mozilla + Comcast + DoH: Strange Bedfellows
• Don't forget about VirusTotal

We invite you to read our show notes at https://www.grc.com/sn/SN-773-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

Zoom encryption, Windows 10 printer error.

• Ripple20: a set of 19 TCP/IP vulnerabilities that could let remote attackers gain control over your device
• Russian government lifts its failed ban on Telegram
• Zoom: everybody gets optional end to end encryption
• Google removed 106 malicious Chrome extensions collecting sensitive user data
• Windows 10 update breaks printing
• VLC Media Player 3.0.11 fixes severe remote code execution flaw
• Netgear in the doghouse
• DDoS is alive and well... and growing
• How to get the new Edge for Windows 7

We invite you to read our show notes at https://www.grc.com/sn/SN-772-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

Windows update kills printers & SSDs.

• Lamphone: eavesdrop on a hanging lightbulb
• Brave Browser caught and chastised for tweaking user-entered URLs for its benefit
• Microsoft breaks its own record for Patch Tuesday patches
• TFW Windows 10 loses your printer port
• Last week's Patch Tuesday broke ALL PRINTING (even to PDFs) for many users. Fix won't come for a month
• Windows 10 2004 update is messing up SSDs and non-SSDs
• SMBleed
• Subject: Your Site Has Been Hacked
• Authentic database ransom attacks
• Another side-channel attack on Intel chips

We invite you to read our show notes at https://www.grc.com/sn/SN-771-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

Zoom's end-to-end encryption fail.

• Zoom will offer end-to-end encryption, but only if you pay for it
• IBM announces no more work on facial recognition
• The Odd Case of Mozilla's DoH DDoS
• Cisco's Talos group found two critical flaws in the Zoom client
• CallStranger UPnP bug has tech press in a tizzy
• Microsoft has started to replace old Edge with new Edge

We invite you to read our show notes at https://www.grc.com/sn/SN-770-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

Zoom gets end-to-end encryption.

• ACLU takes Clearview to court, but maybe they should worry about their own website first
• The state of drive-by malvertising downloads
• Google will be bad listing notification abusing sites
• Who else is doing the eBay-like ThreatMetrix port scanning?
• Facebook to require identity verification for high impact posters
• Google Messaging is apparently heading toward E2EE
• The return of a much more worrisome StrandHogg
• The SHA-1 hash to finally be dropped from OpenSSH
• What happens when you fuzz USB?
• Zoom's end-to-end encryption design

We invite you to read our show notes at https://www.grc.com/sn/SN-769-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

Contact tracing apps are not going to work.

• Why contact tracing apps are never going to work
• Unc0ver: There's a new iOS jailbreak in town, and as jailbreaks go, it looks VERY nice!
• Firefox 77 picks up a nifty new security trick
• New features in Chrome 83: cookie management, "Safety Check," blocking third-party cookies by default in Incognito mode, and "Tab Groups"
• Adobe rushes out four out-of-cycle emergency updates to fix security flaws
• Zerodium temporarily stops buying iOS remote code execution vulnerabilities
• The NXNS Attack: A group of cybersecurity researchers in Israeli have responsibly disclosed details about a new way they worked out of using the Internet's domain name resolution system to hugely amplify (by a factor of at least 1620 packets) a DDoS attack to take down targeted websites.
• BIAS - Bluetooth Impersonation AttackS is nothing less than a complete collapse of Bluetooth security.
• Is eBay port scanning its user's computers? Kinda.
• Security Now trivia: Steve Gibson helped develop the Speak & Spell! It did voice synthesis with only a 4K bits (0.5K bytes) processor.

We invite you to read our show notes at https://www.grc.com/sn/SN-768-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

WiFi 6, Apple vs. FBI, face masks.

• Last Tuesday's Windows patch Tuesday was not the biggest ever, but it was the 3rd largest in Microsoft's history, weighing in with a whopping 111 CVE-tracked bug fixes, 16 of which were rated CRITICAL and all but one of which enabled Remote Code Execution by an attacker.
• The DOJ and FBI again criticize Apple over encryption
• When is a fix not a fix?
• Face masks have thwarted the London police's LFR rollout
• Utah chooses to roll their own contact tracing app
• Everything you need to know about WiFi 6

We invite you to read our show notes at https://www.grc.com/sn/SN-767-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

Thunderbolt security flaw, Zoom buys Keybase.

• Why the ThunderSpy Thunderbolt security flaw is such a big deal
• Zoom purchases Keybase to fix encryption
• Firefox 76 released with new features
• But Firefox 76 broke Amazon's Assistant!
• Hallelujah!! Edge moves to silence those annoying notification requests.
• Critical WordPress plugin bugs present on over one million sites
• Critical vBulletin patch
• Samsung has patched a CRITICAL bug affecting the past 6 years of Smartphones
• DefCon and Black Hat 2020 go virtual

We invite you to read our show notes at https://www.grc.com/sn/SN-766-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

China wants to rebuild the Internet.

• China's proposal to rebuild the internet is an authoritarian nightmare
• Bruce Schneier on COVID-19 Contact Tracing Apps
• Political Correctness hits cybersecurity
• DHS's CISA says no to 3rd-party DoH
• "POWER-SUPPLaY: Leaking Data from Air-Gapped Systems by Turning the Power-Supplies Into Speakers"
• An authorization bypass in SaltStack
• Adobe's Big Last Tuesday, Non-Patch Tuesday, Update
• Google has announced its impending clean-up of the Chrome Web Store
• Warning about RDP is not crying wolf

We invite you to read our show notes at https://www.grc.com/sn/SN-765-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors: