Th3 Core

If you'd like to check out an interesting password manager I came across F-Secure KEY https://www.f-secure.com/en/web/home_global/key

There was someone re-tweeting that they're giving away free premium accounts until June 10.
https://twitter.com/FSecureKEY/status/740110091635068928
KEYDADADA

The premium key lasts 6 months and lets you share passwords between accounts. Not sure what happens after that.

I like the security involved with this app. They don't even ask for your e-mail address when signing up. Everything is encrypted locally. F-Secure only gets an encrypted set of your passwords that they can't read even if they wanted to.

Not sure I'll move to this, but it looks promising in early tests.

NoScript and other popular Firefox add-ons open millions to new attack
Unlike many browsers, Firefox doesn't always isolate an add-on’s functions.

NoScript, Firebug, and other popular Firefox add-on extensions are opening millions of end users to a new type of attack that can surreptitiously execute malicious code and steal sensitive data, a team of researchers reported.

The attack is made possible by a lack of isolation in Firefox among various add-ons installed by an end user. The underlying weakness has been described as an extension reuse vulnerability because it allows an attacker-developed add-on to conceal its malicious behavior by invoking the capabilities of other add-ons. Instead of directly causing a computer to visit a booby-trapped website or download malicious files, the add-on exploits vulnerabilities in popular third-party add-ons that allow the same nefarious actions to be carried out. Nine of the top 10 most popular Firefox add-ons contain exploitable vulnerabilities. By piggybacking off the capabilities of trusted third-party add-ons, the malicious add-on faces much better odds of not being detected.

FF had better revamp their entire core structure...quick

I'm trying to help someone redo the information architecture of a website that has a few hundred pages. They've been giving me charts made in Excel and it's impossible to move things around or do anything really. I suggested Visio, but they don't want to pay for that. Do you guys know of any good diagramming tools (free preferred) that could handle a task like this?

All I want to do is show pages of the site and their links to help them visualize where content will go, and show them how visitors will navigate the site.

This is Why People Fear the ‘Internet of Things’

Imagine buying an internet-enabled surveillance camera, network attached storage device, or home automation gizmo, only to find that it secretly and constantly phones home to a vast peer-to-peer (P2P) network run by the Chinese manufacturer of the hardware. Now imagine that the geek gear you bought doesn’t actually let you block this P2P communication without some serious networking expertise or hardware surgery that few users would attempt.

This is the nightmare “Internet of Things” (IoT) scenario for any system administrator: The IP cameras that you bought to secure your physical space suddenly turn into a vast cloud network designed to share your pictures and videos far and wide. The best part? It’s all plug-and-play, no configuration necessary!

I need to get this implemented on my sites: Content Security Policy (CSP)
Looks like a great way to thwart cross-site scripting attcks.

This guy has a scanner https://securityheaders.io/ that grades your headers just like SSL Labs does for certs. He also has a CSP policy builder https://report-uri.io/home/generate/ but there are a lot of options in there that I'd need to look into.

Anyone here use a CSP?

Not surprising

Consumers Spend 85% Of Time On Smartphones In Apps, But Only 5 Apps See Heavy Use

Based on this data and other findings in the new report, Forrester advises businesses to design their apps only for their best and most loyal or frequent customers – because those are the only one who will bother to download, configure and use the application regularly. For instance, most retailers say their mobile web sales outweigh their app sales, the report says. Meanwhile, outside of these larger players, many customers will use mobile websites instead of a business’ native app.

Hackers build a new Tor client designed to beat the NSA
http://www.dailydot.com/politics/tor-astoria-timing-attack-client/

With the threat of powerful intelligence agencies, like the NSA, looming large, researchers have built a new Tor client called Astoria designed specifically to make eavesdropping harder for the world's richest, most aggressive, and most capable spies.

A Year of DuckDuckGo http://www.designwithtom.com/blog/2015/3/23/a-year-of-duckduckgo

An interesting blog post about this guy's experience with DDG. The only thing that doesn't really parallel my experience is the Instant Search features. I haven't see a lot of them. I still find it necessary to go to GG for some stuff like calculations or currency conversion in the SERPs. I guess DDG is catching up.