Google's Project Shield

Google has finally launched its much touted Project Shield DDoS mitigation service, with a mission to preserve free speech by protecting news, human rights and election monitoring sites around the world.

Details here; project website here 

Download Google Search History

A wonderful way of reminding yourself, on what Google saves about yourself, and why you must turn off this feature immediately.

Google for VA, Security Scanning

Commendable move by Google. Helping website owners find security flaws in their own websites.

Finally an easy [no] captcha!

Introducing No CAPTCHA, from Google. It's super simple for humans, and is even more secure against bots.

POODLE Vulnerability

Update 14-Dec-14:
Poodle vulnerability is back. It has been discovered that this same vulnerability applies to a certain versions of TLS as well.


Update 15-Oct-14:
As if the system admins weren't already sick and tired of patching (Heartbleed and then Shellshock), here comes another vulnerability.

It is now a trend to give your discovered vulnerability a fancy name, and so Google (the discoverer) calls it POODLE, which stands for: Padding Oracle On Downgraded Legacy Encryption.

And no, this isn't even half as bad as Heartbleed or Shellshock:

1. The vulnerability is present in SSL v3 and earlier.
2. This vulnerability does not put the servers at a risk, but the clients.
3. This vulnerability's prerequisite is for the attacker to have network level access to the victim. So, either a MITM, sniffing wifi connections, or being NSA with hooks in the data-centers

Troy Hunt explains it here. Errata explains the risk and myths. Another simple article for dummies.

5 Million Gmail Credentials Leaked

Not clear what is the source of this leak. Apparently Gmail says they were not compromised.

Update 20-Sep-14:
Seems like Google wasn't compromised, and majority of the leaked credentials are incorrect. Could be an old dump?!

End to end encryption for emails

25-May-2015:
German government encourages encryption, by setting up easy to use and free service. Commendable move, I hope it is done properly, and does not leave any holes behind.

09-Aug-2014:
Yahoo follows suit, and announces the same for next year.

18-Jun-2014
Another commendable move from Gmail, even tho it comes at the cost of losing a bit business for them

Google Project Zero

Google's project tries to put an end to the wide impact of zero-day exploits. Scope has no bounds, and all the findings will be responsibly disclosed to the public. Sounds very ambitious!!

Unauthorized Google Certs Issues by NIC, India

The National Informatics Centre (NIC) of India, which holds several intermediate CA certificates trusted by the Indian Controller of Certifying Authorities (India CCA), issued unauthorized certificates for Google's domains.

Google Maps Create Fake Listings

Google calls this spam, but I am thinking this could be more damaging. Create any fake business, go over Google's verification, and voila - till the time it is flagged down as spam, your business is up!

Google moving to sound based authentication

Google acquires SlickLogin!

Rogue certs for Google domains issued!

Update 10-Dec-13:

An intermediate certificate authority (CA) registered to the French Ministry of Finance issued rogue certificates for several Google domains without authorization. Link

Google Chat Delivered To Wrong People!!

A big kick to the Big G - For about 2 days, Google chat messages were being delivered to the wrong people, thanks to some bug in their software.

Google knows YOUR WiFi Password!

Google has access to clear-text wifi passwords. Now considering there are 900 Million+ android devices, and each device would have multiple wifi passwords stored on them - do the maths!
Meaning all the good folks at NSA need to do is but send a request to Google asking for the wifi password of anyone, so that they could snoop in on their computers

Gmail says users have no right to privacy

This is plain ridiculous.

Google said that "just as a sender of a letter to a business colleague cannot be surprised that the recipient's assistant opens the letter, people who use Web-based e-mail today cannot be surprised if their communications are processed by the recipient's ECS provider in the course of delivery." 

Google Chrome's Password Storage

Stop storing passwords on Chrome. Looks like the passwords are not encrypted with a master password, and hence visible to anyone with physical access to your system.

Stealing Google Authentication

Single sign on is a boom - even for the hackers. A hacker shows how to steal authentication token

Iranians under phising attacks

Iran. Political motive, just ahead of elections. Result is rise in Gmail phising

NSA data snooping!

Unbelievable how much data these guys are spying on!

Did NSA manage to decrypt BlackBerry data as well? RIM has declined for now.

NSA Director talks about this program (named PRISM)

Was Microsoft providing vulnerabilities to NSA?

An upcoming app, which promises to defeat all these govt snooping. Already raised 100K in 36 hours!

How much does it cost the govt to eavesdrop on people? Substantial amount of money actually!

DNI Presenter a tool used by NSA to capture citizen's personal chats and messages!

FBI engaged hackers to deploy malware on Android phones.

XKeyscore – the Front End that Queries the NSA Databases

Update 10-Aug-2013:
NSA 'nicely' asks lavabit and SilentText to shut down. They were instrumental in providing end-to-end encrypted email services.

Update 17-Sep-2013:
Some open source tools to help non-NSA folks, achieve some similar reconnaissance.

Update 19-Sep-2013:
NSA purchased 0-days from Vupen (French security researchers)

Update 28-Sep-2013:
NSA even spied on Indian Embassy and UN

Update 29-Oct-2013:
Firefox launches "Lightbeem"

Update 10-Nov-2013:
Crowd sourcing project to audit TrueCrypt

Update 12-Nov-2013:
Charges against Snowden to be dropped ?!

Update 13-Nov-2013:
Google outraged over NSA's extent of spying on its data centres

Update 08-Dec-2013:
Tracking all Snowden documents

Update 22-Dec-2013:
NSA bribed [for $10m] RSA for keeping a bacdoor in their products!
Not surprisingly RSA declines it.

Update 18-Jan-2014:
Obama announces some reforms

Update 28-Jan14:
How Angry Birds helped NSA

Update 29-Jan-14:
Snowden nominated for Nobel

Update 22-Mar-14:
Google tightens HTTPS protection.

Update 08-May-14:
A few email exchanges between NSA and Google released. Doesn't say much, unlike the hype

Update 17-Oct-15:
How the NSA broke encryption (DH algo).

Google gives 7 days to vendors to patch 0-days!

Google gives 7 days to vendors to patch 0-days! Sounds like a tight deadline from Google.


Update 07-Jun-13:
Google increases the bounty for the bugs found on their own systems!