# Security & Privacy Published articles for Security & Privacy. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## An Organizational Second Brain: Building an AI That Learns From Experts DevFeed: [An Organizational Second Brain: Building an AI That Learns From Experts]() Original publisher: [Read original article]() Author: Shaurya Sengar; Jason Nawrocki; Jay Shah; Prashant Kommireddi Published: 2026-09-02T09:00:29Z Content type: article Language: en Sources: [Engineering at Meta](), [Meta AI Research](), [Meta ML Applications]() Topics: [Large Language Model](), [Architecture & Design]() Tags: [ai-agent](), [ai-research](), [architecture](), [compliance](), [llms](), [ml-applications](), [security-privacy]() ### AI overview Meta describes an AI agent for a compliance domain that preserves specialist knowledge through an auditable knowledge architecture, an expert-like reasoning layer, and a feedback-driven improvement pipeline without model retraining. ### Source excerpt We've built an AI agent that acts as a secondary expert for a given domain, making deep specialist knowledge readily available and preserved for anyone in an organization to access, share, and build upon. This is not a typical domain-specific agent. Its novelty comes from integrating two layers: A structured, auditable knowledge architecture separates what [...] Read More... The post An Organizational Second Brain: Building an AI That Learns From Experts appeared first on Engineering at Meta. ## How We're Building Scam Alert on WhatsApp With End-to-End Encryption and Verifiability Guarantees DevFeed: [How We're Building Scam Alert on WhatsApp With End-to-End Encryption and Verifiability Guarantees]() Original publisher: [Read original article]() Author: Chris Wiltz Published: 2026-08-12T13:00:28Z Content type: article Language: en Sources: [Engineering at Meta]() Topics: [End-to-End Encryption](), [Encryption](), [Machine Learning & Artificial Intelligence](), [Inference](), [Security](), [Bug Bounty](), [Social engineering]() Tags: [bug-bounty](), [encryption](), [machine-learning](), [privacy](), [scam](), [security](), [security-privacy](), [social-engineering](), [user-control](), [whatsapp]() ### AI overview An early technical overview of WhatsApp's optional Scam Alert feature, which uses a small on-device machine learning model to classify potential scam messages while keeping message content on the device. The article explains how the design preserves end-to-end encryption through local processing, avoids automatic reporting, gives users control, and supports independent security review during a limited Beta rollout. ### Source excerpt WhatsApp is committed to helping people stay safe while protecting the privacy of their messages. As scam tactics evolve -- from impersonation to social engineering to AI-generated lures -- we're always evolving as well, so that our protections stay ahead of scammers while protecting people's personal messages with end-to-end encryption. Today, we're sharing an early [...] Read More... The post How We're Building Scam Alert on WhatsApp With End-to-End Encryption and Verifiability Guarantees appeared first on Engineering at Meta. ## Univé builds an AI-ready workforce DevFeed: [Univé builds an AI-ready workforce]() Original publisher: [Read original article]() Published: 2026-07-31T07:00:00Z Content type: article Language: en Sources: [OpenAI News]() Topics: [Artificial Intelligence](), [ChatGPT](), [AI Strategy](), [OpenAI](), [Responsibility & Safety](), [responsible-ai](), [Security](), [Security & Privacy](), [Authorization](), [Monitoring](), [Authentication]() Tags: [ai](), [authentication](), [building](), [chatgpt](), [enterprise](), [governance](), [innovation](), [leadership](), [monitoring](), [openai](), [organizational](), [platform](), [privacy](), [responsible-ai](), [scale](), [security](), [security-privacy](), [strategy](), [technology]() ### AI overview Univé describes building an AI-ready workforce by treating AI adoption as an organizational transformation rather than a technology deployment. Using ChatGPT Enterprise within its governance framework, the insurer combined leadership engagement, employee-led innovation, enterprise authentication, permission controls, privacy assessments, security reviews, responsible AI principles, continuous monitoring, and human accountability to support safe experimentation at scale. ### Source excerpt See how Univé built an AI-ready workforce with ChatGPT Enterprise by combining leadership, responsible governance, and employee-led innovation to transform work at scale. ## Privacy-Aware Infrastructure in the AI-Native Era: An Asset Classification Case Study DevFeed: [Privacy-Aware Infrastructure in the AI-Native Era: An Asset Classification Case Study]() Original publisher: [Read original article]() Author: Rituraj Kirti; Vasileios Lakafosis Published: 2026-06-25T22:30:51Z Content type: article Language: en Sources: [Meta ML Applications]() Topics: [data](), [Large Language Model](), [Artificial Intelligence](), [audit](), [systems](), [Meta]() Tags: [ai](), [audit](), [data](), [engineering](), [meta](), [ml-applications](), [review](), [security-privacy](), [systems]() ### AI overview This Meta engineering article presents a hybrid approach to asset classification for privacy-aware infrastructure. It combines rich context, LLMs for ambiguous or novel assets, human-reviewed labels, and deterministic versioned rules for routine production enforcement. ### Source excerpt Privacy controls -- systems that enforce retention, access, allowed-purpose, downstream-sharing, or anonymization policies -- require a reliable understanding of data to function. Before such a control can operate effectively, it must know exactly what it is looking at. This can be complex, as demonstrated by a field simply named "age": In one context, it [...] Read More... The post Privacy-Aware Infrastructure in the AI-Native Era: An Asset Classification Case Study appeared first on Engineering at Meta. ## OpenAI available at FedRAMP Moderate DevFeed: [OpenAI available at FedRAMP Moderate]() Original publisher: [Read original article]() Published: 2026-04-27T14:00:00Z Content type: news Language: en Sources: [OpenAI News]() Topics: [AI Chat](), [SDKs]() Tags: [ai](), [api](), [chatgpt](), [deployment](), [enterprise](), [fedramp](), [global-affairs](), [government](), [openai](), [security-privacy]() ### AI overview OpenAI announced FedRAMP 20x Moderate authorization for ChatGPT Enterprise and its API Platform, expanding a path for U.S. federal agencies to use its managed AI products. ### Source excerpt OpenAI is available at FedRAMP Moderate authorization for ChatGPT Enterprise and the OpenAI API, enabling secure AI adoption for U.S. federal agencies. ## OWASP Top 10 Agents & AI Vulnerabilities (2026 Cheat Sheet) DevFeed: [OWASP Top 10 Agents & AI Vulnerabilities (2026 Cheat Sheet)]() Original publisher: [Read original article]() Author: Alex Ewerlöf Published: 2026-03-10T18:18:04Z Content type: tutorial Language: en Sources: [Alex Ewerlof Notes]() Topics: [Vulnerabilities](), [Large Language Model](), [Artificial Intelligence](), [prompt injection](), [Security & Privacy]() Tags: [ai](), [llm](), [prompt-injection](), [recipe](), [security](), [security-privacy](), [techniques](), [vulnerabilities]() ### AI overview A pragmatic engineering guide examines the OWASP Top 10 for LLMs and the OWASP Top 10 for Agents. It explains how mixed instructions and data, unpredictability, agentic attack surfaces, reliability failures, cascading failures, and high LLM costs create security and operational risks, with examples and mitigations. ### Source excerpt A pragmatic engineering guide and cheat sheet for the OWASP Top 10 AI, OWASP Top 10 LLM, and OWASP Top 10 Agents vulnerabilities ## PVH reimagines the future of fashion with OpenAI DevFeed: [PVH reimagines the future of fashion with OpenAI]() Original publisher: [Read original article]() Published: 2026-01-27T06:00:00Z Content type: article Language: en Sources: [OpenAI News]() Topics: [ChatGPT](), [Artificial Intelligence](), [OpenAI](), [data](), [Security & Privacy]() Tags: [accelerate](), [ai](), [chatgpt](), [creativity](), [data](), [design](), [efficiency](), [enterprise](), [global-affairs](), [innovation](), [openai](), [optimization](), [privacy](), [product](), [retail](), [scale](), [security](), [security-privacy](), [supply-chain]() ### AI overview PVH Corp. is adopting ChatGPT Enterprise and OpenAI frontier models across its global fashion operations. The initiative targets product design, demand planning, inventory optimization, supply-chain management, marketing, and consumer engagement, with an emphasis on data-driven decisions, creativity, efficiency, security, privacy, and responsible data governance. ### Source excerpt PVH Corp., parent company of Calvin Klein and Tommy Hilfiger, is adopting ChatGPT Enterprise to bring AI into fashion design, supply chain, and consumer engagement. ## Moved my blog to \[blog.wagemakers.be\](https://blog.wagemakers.be) DevFeed: [Moved my blog to \[blog.wagemakers.be\](https://blog.wagemakers.be)]() Original publisher: [Read original article]() Author: Staf Wagemakers Published: 2026-01-26T17:26:00Z Content type: tutorial Language: en Sources: [stafwag Blog]() Topics: [migration](), [hosting](), [GitHub](), [Security](), [RSS Feed](), [Hugo](), [Atom](), [XML]() Tags: [atom](), [blog](), [disquss](), [github](), [hosting](), [html](), [https](), [hugo](), [jekell](), [migration](), [rss](), [security](), [security-privacy](), [xml]() ### AI overview The author moved the blog from GitHub to self-hosted hosting and documents the migration issues encountered. The article covers HTML redirects, updating hardcoded links, Disqus comment reindexing, and difficulties redirecting RSS feeds when moving from Octopress to Jekyll. ### Source excerpt If you follow my blog posts with an RSS reader, update the rss feed to: https://blog.wagemakers.be/atom.xml ...If you want to continue to follow me off-course ;-) I moved my blog from GitHub to my own hosting ( powered by Procolix ). Procolix sponsored my hosting for 20 years, till I decided to start my company Mask27.dev. One reason is that Microsoft seems to like to put "copilot everywhere", including on repositories hosted on github. While I don't dislike AI ( artificial intelligence ), LLM ( Large Language Models ) are a nice piece of technology. The security, privacy, and other issues are overlooked or even just ignored. The migration was a bit more complicated as usual, as nothing "is easy" ;-) You'll find the pitfalls of moving my blog below as they might be useful for somebody else ( including the future me ). ## Android Quick Share Support for AirDrop: A Secure Approach to Cross-Platform File Sharing DevFeed: [Android Quick Share Support for AirDrop: A Secure Approach to Cross-Platform File Sharing]() Original publisher: [Read original article]() Author: Edward Fernandez (noreply@blogger.com) Published: 2025-11-20T17:00:00Z Content type: release Language: en Sources: [Google Online Security]() Topics: [Android](), [cross-platform](), [Security & Privacy](), [interoperability](), [iOS](), [Google](), [Rust]() Tags: [android](), [android-security](), [cross-platform](), [google](), [interoperability](), [ios](), [none](), [rust](), [secure-by-design](), [security-privacy]() ### AI overview Google describes Quick Share interoperability with AirDrop, enabling two-way file sharing between Android and iOS devices starting with the Pixel 10 Family. The article explains the security measures used in the feature, including threat modeling, privacy reviews, penetration testing, and a Rust-based communication channel. ### Source excerpt Posted by Dave Kleidermacher, VP, Platforms Security & Privacy, Google Technology should bring people closer together, not create walls. Being able to communicate and connect with friends and family should be easy regardless of the phone they use. That's why Android has been building experiences that help you stay connected across platforms. As part of our efforts to continue to make cross-platform communication more seamless for users, we've made Quick Share interoperable with AirDrop, allowing for two-way file sharing between Android and iOS devices, starting with the Pixel 10 Family. This new feature makes it possible to quickly share your photos, videos, and files with people you choose to communicate with, without worrying about the kind of phone they use. Most importantly, when you share personal files and content, you need to trust that it stays secure. You can share across devices with confidence knowing we built this feature with security at its core, protecting your data with strong safeguards that have been tested by independent security experts. Secure by Design We built Quick Share's interoperability support for AirDrop with the same rigorous security standards that we apply to all Google products. Our approach to security is proactive and deeply integrated into every stage of the development process. This includes: Threat Modeling: We identify and address potential security risks before they can become a problem. Internal Security Design and Privacy Reviews: Our dedicated security and privacy teams thoroughly review the design to ensure it meets our high standards. Internal Penetration Testing: We conduct extensive in-house testing to identify and fix vulnerabilities. This Secure by Design philosophy ensures that all of our products are not just functional but also fundamentally secure. This feature is also protected by a multi-layered security approach to ensure a safe sharing experience from end-to-end, regardless of what platform you're on. Secure S ## Meta's ACH Tool Uses LLMs for Mutation-Guided Test Generation and Compliance Testing DevFeed: [Meta's ACH Tool Uses LLMs for Mutation-Guided Test Generation and Compliance Testing]() Original publisher: [Read original article]() Author: Mark Harman Published: 2025-09-30T16:00:08Z Content type: article Language: en Sources: [Meta AI Research]() Topics: [Testing](), [mutation-testing](), [Large Language Model](), [Meta](), [Artificial Intelligence](), [Software]() Tags: [ai](), [ai-research](), [code](), [llms](), [meta](), [ml-applications](), [mutation-testing](), [security-privacy](), [testing]() ### AI overview Meta describes its Automated Compliance Hardening (ACH) tool, which uses large language models to generate relevant code mutants and tests designed to catch them. The article explains how this supports mutation testing and helps identify compliance-related bugs. ### Source excerpt Following our keynote presentations at FSE 2025 and Eurostar 2025, we're delving further into the development of Meta's Automated Compliance Hardening (ACH) tool, an LLM-based tool for software testing that is automating aspects of compliance adherence at Meta, while accelerating developer and product velocity. By leveraging LLMs we've been able to overcome the barriers that [...] Read More... The post LLMs Are the Key to Mutation Testing and Better Compliance appeared first on Engineering at Meta. ## Data Inventory DevFeed: [Data Inventory]() Original publisher: [Read original article]() Author: Ritesh Modi Published: 2025-02-19T14:24:14Z Content type: tutorial Language: en Sources: [Wise Engineering - Medium]() Topics: [data-governance](), [data-architecture](), [Security & Privacy](), [Databases](), [Provisioning](), [Terraform]() Tags: [backend](), [data](), [data-governance](), [databases](), [frontend](), [governance](), [least-privilege](), [network-segmentation](), [platform](), [provisioning](), [security](), [security-privacy](), [terraform]() ### AI overview Wise's Data Governance team describes Data Inventory, a catalog of data assets that records their locations and security or privacy controls. The article explains the system's constraints, design outcomes, and process for discovering operational databases and their metadata. ### Source excerpt The Data Governance team, part of Data Platform, develops and operates platform products through which autonomous teams can govern their data. The team's vision is to democratise data in a secure and compliant manner. Data Inventory was the team's first product. What is Data Inventory? A data inventory is an extensive catalog of the Wise's data assets. It helps us understand where the data is located and what kind of security / privacy controls are in place. This is also a requirement for ISO 27001:2022. What are the constraints? Any system has to work well with our controls and way-of-working. This led to following constraints: It shall be built in a way that satisfies our security controls such as network segmentation, least privilege access, secure secret management, etc. It shall be easy to integrate with other in-house platforms to provide cohesive experience. It shall be built to connect with heterogeneous and fragmented infrastructure. Many data systems are built through off-the-shelf or managed service offering but others are built & operated in-house. The system shall be integrated by default with technology provided by Data Platform. On another hand, it shall be extensible enough to integrate with data systems not maintained by Data Platform. How did we build our inventory? At high level, we split this into 4 main outcomes: 1. Register assets at correct granularity. 2. Identify the correct owner and make them accountable for the life cycle. 3. Extract the schema of the data asset. 4. Classify the asset with correct sensitivity. This is how design looks at high level: To achieve the above design and outcome, we follow the following steps: Step 0: Discover data systems network metadata Scanners need to be aware of the network metadata before doing scanning. For example: - What is the host or connection string? - What is the technology of the data system? - What is the name of the data system? Let us take an example of how we solve it in our operational datab ## Manifest V2 phase-out begins DevFeed: [Manifest V2 phase-out begins]() Original publisher: [Read original article]() Author: Chromium Blog (noreply@blogger.com) Published: 2024-05-30T16:45:00Z Content type: article Language: en Sources: [Chromium Blog]() Topics: [Extension](), [Chrome](), [migration](), [Security](), [Security & Privacy](), [Document Object Model (DOM)](), [uBlock Origin Filters]() Tags: [chrome](), [collaboration](), [community](), [extension](), [extensions](), [feature](), [manifest](), [migration](), [none](), [performance](), [security](), [security-privacy](), [update]() ### AI overview Chrome has begun disabling extensions that still use Manifest V2. The article describes the transition to Manifest V3, which is intended to improve extension security, privacy, performance, and trustworthiness while preserving existing functionality. It highlights community-driven improvements, including user scripts, offscreen documents for DOM APIs, larger declarativeNetRequest rulesets, faster review of safe rule updates, and version rollback. More than 85% of actively maintained Chrome Web Store extensions were reported to use Manifest V3. ### Source excerpt Update (10/10/2024): We've started disabling extensions still using Manifest V2 in Chrome stable. Read more details in the MV2 support timeline documentation. In November 2023, we shared a timeline for the phasing out of Manifest V2 extensions in Chrome. Based on the progress and feedback we've seen from the community, we're now ready to roll out these changes as scheduled. We've always been clear that the goal of Manifest V3 is to protect existing functionality while improving the security, privacy, performance and trustworthiness of the extension ecosystem as a whole. We appreciate the collaboration and feedback from the community that has allowed us - and continues to allow us - to constantly improve the extensions platform. Addressing community feedback We understand migrations of this magnitude can be challenging, which is why we've listened to developer feedback and spent years refining Manifest V3 to support the innovation happening across the extensions community. This included adding support for user scripts and introducing offscreen documents to allow extensions to use DOM APIs from a background context. Based on input from the extension community, we also increased the number of rulesets for declarativeNetRequest, allowing extensions to bundle up to 330,000 static rules and dynamically add a further 30,000. You can find more detail in our content filtering guide. This month, we made the transition even easier for extensions using declarativeNetRequest with the launch of review skipping for safe rule updates. If the only changes are for safe modifications to an extension's static rule list for declarativeNetRequest, Chrome will approve the update in minutes. Coupled with the launch of version roll back last month, developers now have greater control over how their updates are deployed. Ecosystem progress After we addressed the top issues and feature gaps blocking migration last year, we saw an acceleration of extensions migrating successfully to Manifest V ## 3 tips from Snyk and Dynatrace's AI security experts DevFeed: [3 tips from Snyk and Dynatrace's AI security experts]() Original publisher: [Read original article]() Author: Sarah Conway Published: 2024-01-22T06:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Securing AI](), [ai-governance](), [dynatrace](), [Generative AI](), [Security & Privacy](), [AI Development]() Tags: [ai](), [ai-governance](), [ai-security](), [application-security](), [awareness](), [blog](), [development](), [devops](), [dynatrace](), [executive](), [generative-ai](), [governance](), [megawatt](), [security](), [security-privacy](), [snyk](), [snyk-platform]() ### AI overview This article recaps a Snyk and Dynatrace fireside chat about generative AI security. It examines AI's effects on software development and business application security, emphasizing cross-team governance, careful testing and implementation, and sustained security attention throughout development. ### Source excerpt Learn more about generative AI security in this recap from our recent fireside chat, featuring security and privacy experts from Snyk and Dynatrace. ## How to intercept, observe & mock WebRTC traffic DevFeed: [How to intercept, observe & mock WebRTC traffic]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2022-10-13T10:00:00Z Content type: tutorial Language: en Sources: [HTTP Toolkit]() Topics: [WebRTC](), [Tooling](), [P2P](), [Security & Privacy]() Tags: [debugging](), [developer-tools](), [how-to](), [interception](), [javascript](), [p2p](), [security-privacy](), [webrtc]() ### AI overview This tutorial explains why WebRTC traffic is difficult to inspect and mock, covering its peer-to-peer encryption, negotiated networking, and limited debugging APIs. It introduces MockRTC and describes how controlling one peer can enable interception, observation, and transformation of WebRTC traffic. ### Source excerpt WebRTC allows two users on the web to communicate directly, sending real-time streams of video, audio & data peer-to-peer, from within a browser environment. It's exciting tech that's rapidly maturing, already forming the backbone of a huge range of video chat, screen sharing and live collaboration tools, but also as a key technology for decentralization of web apps - providing a P2P data transport layer used by everything from WebTorrent to IPFS to Yjs. Unfortunately though, it doesn't have the tooling ecosystem that developers used to networking with HTTP often expect. There's few supporting tools or libraries, inspecting raw traffic is hard or impossible, and mocking WebRTC traffic for automated testing is even harder. Even built-in low-level browser tools like chrome://webrtc-internals don't allow seeing messages sent on WebRTC data channels. It's hard to build modern secure web applications on top of protocols that you can't directly see or interact with. This doesn't just affect developers: it also seriously impacts security & privacy researchers and reverse engineers, each trying to investigate the traffic sent & received by the apps we all use. If you want to know what data a webapp you use is sending over WebRTC, right now it's very hard to find out. Intercepting WebRTC traffic to build these tools and libraries is difficult, because unlike protocols like HTTP that were designed to allow active proxying and user-configureable PKI (i.e. CA certificates) early on, WebRTC encrypts all traffic using peer-to-peer negotiated certificates for authentication without PKI, communicates in a wide variety of different negotiated ways at the network level to avoid NAT issues, and offers no convenient APIs to configure this for debugging. All of this provides some great features to the protocol as a user, but some serious challenges when building developer tools. As it turns out though, despite this, there are just enough places where we can hook into that it is possible ## Public CDNs Can Create Security, Privacy, and Stability Risks DevFeed: [Public CDNs Can Create Security, Privacy, and Stability Risks]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2021-07-19T14:15:00Z Content type: opinion Language: en Sources: [HTTP Toolkit]() Topics: [cdnjs](), [Security & Privacy](), [Caching](), [modern web development](), [JavaScript](), [jQuery]() Tags: [browsers](), [caching](), [cdn](), [javascript](), [performance](), [reference](), [security](), [security-privacy]() ### AI overview This article argues that using public CDNs for common scripts and styles can introduce security, privacy, and stability risks while providing limited modern benefits. It recommends self-hosting content and dependencies, with a private caching CDN placed in front of the application for performance. ### Source excerpt Once upon a time, loading common scripts & styles from a public CDN like cdnjs or Google's Hosted Libraries was a 'best practice' - a great way to instantly speed up your page loads, optimize caching, and reduce costs. Nowadays, it's become a recipe for security, privacy & stability problems, with near-zero benefit. Just last week, a security researcher showed how this could go horribly wrong. There are ways to mitigate those risks, but in practice the best solution is to avoid them entirely: self-host your content and dependencies, and then use your own caching CDN directly in front of your application instead for performance. I'll explain what that means in a second. First though, why was this a good idea, and how has it now become such a mess? Why was this a good idea? The main benefit that public CDNs of popular libraries offered was shared caching. If you used a popular version of jQuery then you could reference it from a public CDN URL, and if a user had recently visited another site that used the same version of jQuery from the same CDN then it would load instantly, straight from their cache. In effect, sites could share resources (almost always JavaScript) between one another to improve caching, reduce load times, and save bandwidth for sites and visitors. Even in the uncached case, this still offered benefits. Browsers limit the number of simultaneous open connections by domain, which limits the performance of parallel resource downloads. By using a separate domain for some resources, resource loading could be spread across more connections, improving load times for visitors. Lastly, the main site's cookies aren't sent in requests to 3rd party domains. If you have large cookies stored for your domain, this creates a lot of unnecessary data sent in every request to your domain, again unnecessarily increasing bandwidth usage and load times (honestly I'm not sure if this overhead really had a practical impact, but it was certainly widely documented as an impor ## Includes No Dirt: Healthcare Threat Modeling (Thursday) DevFeed: [Includes No Dirt: Healthcare Threat Modeling (Thursday)]() Original publisher: [Read original article]() Author: Adam Published: 2019-10-31T00:00:00Z Content type: article Language: en Sources: [Shostack & Friends Blog]() Topics: [Security](), [Security & Privacy](), [risk-management](), [Development]() Tags: [development-process](), [healthcare](), [risk](), [risk-management](), [security](), [security-privacy]() ### AI overview A commentary on the "Includes No Dirt" threat modeling approach by William Dogherty and Patrick Curry of Omada Health. The article describes its focus on security, privacy, and compliance, outlines the NO DIRT model and supporting worksheets, and discusses its potential use in development and vendor risk management. ### Source excerpt "Includes No Dirt" is a threat modeling approach by William Dogherty and Patrick Curry of Omada Health, and I've been meaning to write about it since it came out. ## Threat Modeling & IoT DevFeed: [Threat Modeling & IoT]() Original publisher: [Read original article]() Author: Adam Published: 2017-05-01T00:00:00Z Content type: article Language: en Sources: [Shostack & Friends Blog]() Topics: [Internet of things](), [Security](), [Requirements](), [Cloud]() Tags: [cloud](), [iot](), [requirements](), [security](), [security-privacy]() ### AI overview This article explains how threat modeling for internet-connected devices resembles threat modeling for other computers while presenting recurring IoT-specific tensions. It examines device interfaces, web servers and cloud connectivity, security and privacy tradeoffs, support and operations costs, dependency vulnerabilities, and the conflict between allowing device updates and limiting attackers' ability to install software. ### Source excerpt [no description provided] ## Developing TextSecure iOS with the Axolotl Protocol DevFeed: [Developing TextSecure iOS with the Axolotl Protocol]() Original publisher: [Read original article]() Published: 2014-01-10T00:00:00Z Content type: article Language: en Sources: [Signal Blog]() Topics: [iOS](), [Security](), [Protocol (disambiguation)](), [pull-requests](), [Code](), [Mobile]() Tags: [code](), [cryptographic](), [ios](), [protocol](), [pull-requests](), [security-privacy](), [usability]() ### AI overview The article describes work on TextSecure iOS, including contributions from several developers and implementation of the Axolotl protocol. It also considers usability and brand coherence as Open Whisper Systems expands across applications and devices. ### Source excerpt Winter Break of Code, Day Four At the Open Whisper Systems spring break of code in 2013, I started work on TextSecure iOS. People are chomping at the bit to use our software on iOS. After a hiatus from the project, I've been happy to return to it over the last few months, joining some other contributors, including Frederic Jacobs as co-lead, Alban Diquet, and Claudiu-Vlad Ursache submitting pull requests, even over the holidays, with important cryptographic storage and UI-polishing contributions, and Bitcoin donations coming in from around the world. Contribute code or coins. Read more...