Encryption

DiskCryptor 2.0 released: disk encryption software makes a comeback

Posted on by Martin Brinkmann

Remember when the developers of TrueCrypt suddenly stopped the project back in 2014 and recommended that users started looking for alternatives? One of these alternatives was VeryCrypt, a fork of the TrueCrypt. Another Disk Cryptor, which I did use for some years.

Disk Cryptor development stopped about ten years ago and it looked as if the project was dead. However, in 2019, David Xanatos took over and started to released new versions of the software. You may know the developer from some of his other projects, such as Sandboxie Plus. DiskCryptor was first released as beta builds but then also as final builds.

The initial builds of the application were focused on improving compatibility and integrating support for new technologies. As a consequence, DiskCryptor should work fine under the latest versions of Windows 10 and 11.

The developer has released DiskCryptor 2.0 this week (and bug fix release 2.0.1), marking a major milestone in the development of the program.

He writes:

This release introduces substantial improvements across virtually every part of the software, including modern cryptography, hardware-backed security, storage management, performance, reliability, and usability.

A major addition is support for the Argon2id key derivation function, providing a modern, memory-hard alternative to the traditional KDFs for significantly improved resistance against password cracking attacks.

DiskCryptor now also supports optional TPM integration in the DCS bootloader, enabling hardware-backed protection and unattended system unlock configurations. Combined with optional Secure Boot support, this allows systems to take advantage of modern platform security features while maintaining DiskCryptor’s flexible boot architecture.

Since this is a major change, the new version is released as a pre-release at the time to gather feedback and react to any issues that might occur.

Is it ready for broader use again? I’m pretty happy with VeraCrypt at the moment and have no desire to switch to another encryption program at the moment, as it would be time consuming. However, if you still use an earlier version of DiskCryptor or want to start encrypting your drives for better protection, it may be worth a try.

I suggest you wait a bit though until the developer gives the okay that the pre-release phase is over. (via Günter Born)

Brave Browser reveals how (some) Manifest V2 extensions continue to work

Posted on by Martin Brinkmann

With Google terminating support for Manifest V2 extensions in Chromium and thus most Chromium-based browsers, only some companies have announced solutions to keep support for select extensions.

The latest version of Brave Browser addresses one of the main problems with the migration from MV2 to MV3: the removal of MV2 extensions from the Chrome Store.

What happens when you need to install a classic extension on a new PC or new browser profile? Unless you happen to have a local copy or know how to download it from GitHub or other repositories — if it is provided there — you may be out of options.

Brave Software implemented an option in the browser to replace “known Web Store MV2 extensions with Brave-hosted equivalents”. Up until that point, users had to walk through the process manually. This also meant that settings were not carried over.

With the new process, at least for “known extensions”, Brave is automating things for the user. A benefit of this is that Settings are carried over, which means that you do not have to reconfigure the entire extensions.

There does not seem to be a list of extensions that get the treatment, but a screenshot highlights uBlock Origin, NoScript, uMatrix and AdGuard.

Windows 11 is getting a fully cloud-based reinstallation option

Posted on by Martin Brinkmann

When things go wrong, Windows administrators have a few options at their disposal to fix problems. From built-in repair tools and restore options to backups and setting up the PC anew.

Nothing beats system backups in my opinion, but some problems can also be dealt with using built-in tools, such as the option to reset the PC.

Cloud rebuild is a new feature that Microsoft announced in the most recent test build of the Windows operating system this week. It can be run from the Windows Recovery Environment and will download everything it needs from the cloud. That is a big difference to the “Reset this PC” option, as it will also download drivers and such from the cloud.

However, it is not the only difference. Another main difference is that Cloud rebuild erases pretty much everything on the main drive. You can’t keep apps, settings or personal files, which makes this more of a last resort kind of option or something that you would run if you have proper backups of apps and files. The only data that is not touched is data on other drives or cloud-based files, which do get synced to the PC again after Windows 11 starts booting again to the desktop.

Windows 11 boots directly into the out-of-box experience. For unmanaged PCs, this means going through the whole setup process as if this were a new PC. The operation requires a working network connection to function at all.

This leaves one main use case: users who need to start anew who have few or none apps installed or personal files on the main drive. Experienced users may want to stick to USB images that may include customizations, including OOBE bypasses and such.

Opera Browser gets new security feature to protect the Clipboard

Posted on by Martin Brinkmann

Opera Software announced a new feature for its Chromium-based Opera browser: Paste Protect is designed to block suspicious content from accessing the Clipboard of the operating system.

Introduced in Opera One as an experimental feature, Paste Protect is designed to protect against two specific attack types, notes Opera Software in an official blog post:

  1. It actively prevents the malicious code from being copied onto your clipboard.
  2. It lets you know that there was an attempt to copy something onto your clipboard that’s potentially harmful.

The main idea is to protect users from copying malicious code to the Clipboard. In the past, attackers have used this to get Internet users to execute malicious code or instructions on their computer systems.

The developers at Opera describe a common form of attack that exploits this on the blog as well:

  1. The website displays a Captcha and ticking a box to confirm that the user is human.
  2. A second verification prompt is displayed after the check. It copies data to the Clipboard of the system in the background.
  3. Instructions are displayed that ask the user to open the run box (Windows+R) and use the Ctrl-V shortcut to paste the content of the Clipboard. All that is required then is for the user to hit ok to run the instructions on the system.

Opera says that the new Paste Protect feature blocks this type of attack. The company explains how its security feature handles potential threats:

When there is something copied to your clipboard, the Opera browser checks the content for potential threats and harmful commands. If a potential threat is detected, Opera will automatically block the capability for the browser to copy something onto your clipboard from the malicious website and provide you with the option to close the site safely.

The browser displays a red warning icon to indicate that it has blocked a threat. It will recommend to close the tab the attack originated from.

Paste Protect is enabled by default, but only available in Opera One. It follows Hijack Protection, which Opera Software introduced in 2021 in the browser. The feature protected the clipboard from so-called hijacking attempts, such as replacing URLs in the clipboard or replacing a bank account number.

You can now sign in to Microsoft Edge with a Google account

Posted on by Martin Brinkmann

Should you sign in to your browser of choice or use it without linked account? Signing in offers some advantages, notable the syncing of some data, such as passwords or the browsing history, between devices.

However, depending on the browser that you use, it may also provide the company in charge of it with additional information.

Many browsers limits the feature to the account of the organization that produces it. If you use Google Chrome, you can only sign in with a Google account. Firefox users may sign in with a Mozilla account, and Microsoft Edge users, at least until very recently, needed a Microsoft account.

This is changing with the release of Microsoft Edge 150. Microsoft notes the following in the release notes:

Sign in to Edge with a Google account. Users can now sign in to Microsoft Edge using a Google account in addition to a Microsoft account from the profile menu and Edge sign-in screen. Available for Windows and macOS devices. Admins can control availability of this feature using the NonMicrosoftAccountSignInEnabled policy. Note: This is a controlled feature rollout. If you don’t see this feature, check back as we continue our rollout.

So, instead of signing in with a Microsoft account, you can now sign in with a Google account. This comes with advantages, such as access to Google-stored passwords and such.

Whether that move will convince more users to give Edge a try on Windows or Mac remains to be seen. I have my doubts, but it does give Edge users more options when it comes to the company that they trust their data with.

Edge 150 is also the last version to support macOS 12, according to the release notes. Starting with Edge 151, macOS 13 is the minimum required version.

Brave 1.92 launches with support for Containers

Posted on by Martin Brinkmann

Brave Software announced that the latest version of Brave Browser supports the Containers feature now. The main idea behind it is to isolate website data. When you load a website in one container, its data and any third-party data is only accessible in that container. Think of a sandbox for sites.

Containers is not a new feature, as it was originally developed and launched by Mozilla in Firefox. The Brave integration is built-in. I had to enable the feature under chrome://flags/#containers first, but it should be available without that in the coming days.

Visit brave://settings/braveContent then to toggle “Enable Containers” there. This turns the feature on so that it is ready for use in the browser.

Like Firefox, Brave includes a set of default containers — personal, work, social and school — but you can add new containers, remove the defaults or rename them.

Once done, right-click on any link or tab and select “Open in Container”. You get the option to pick one of the existing containers and Brave highlights this with a new container icon in front of the tab and also in the address bar.

You may also right-click on the new tab icon to create a new container directly and without opening another website first.

Last but not least, you may also create temporary containers. Regular containers offer the same functionality as open tabs. Means, unless you close the sites or the container, they persist over sessions and you can restore tabs in them using restore functionality.

The main difference to temporary tabs is that they can’t be restored. When you close them, they are gone for good and tab or session restore options do not work for them.

The End of the Disc: Sony Gets Serious, Microsoft Apparently Plans to Follow Suit

Posted on by Martin Brinkmann

Up until today, gaming consoles were designed to play physical media. From the cartridges-days to CD, Blu-Ray and Flash cards. While newer consoles added virtual stores to buy digital versions of games and content, gamers up until now had always the choice between the two options.

Both offer advantages. Digital means that you can start playing immediately, download always the latest version without any 0-day patching marathons, and do not have to find the Blu-Ray or cartridge first before playing the game.

Physical media comes with its own set of advantages, at least those that still come with a disc and not just a download code (virtual in disguise). The main advantage is that you can lend or sell the game at any time. Buy it, play it, and sell it once you are done. With digital, there is a chance that games are taken away from you at one point in time, because you buy only licenses.

Sony plans to end the Disc

Sony announced this week that it is ending the production of physical discs in January 2028 for new games releasing on PlayStation consoles. Sony claims that the change is a response to shifting consumer preferences.

All new games releasing January 2028 or later will only come in digital format. They can be purchased on the PlayStation Store or at retailers, but also only in digital format. Think of the code in a box releases that are out already or will come out in the future.

Microsoft might follow

While Microsoft has not yet officially buried physical releases, The Verge reports that Microsoft is working on a system to turn physical game discs into virtual copies in preparation for the move.

The idea is simple: When you buy a physical copy, it is added automatically to your game library on installation. However, unlike on PlayStation, where you can’t lend or sell it, lending or selling remains an option, reportedly.

When you sell the game and the new buyer installs it, it is removed from your library and added to the buyer’s.

The end is near

While digital-only gamers could say that this does not really matter to them, it is shortsighted. For the companies, Sony especially, it is a way to dry out the second hand market. If you can’t buy used games anymore, then you may be inclined to pay full price online. More money in Sony’s pockets and less options and rights for gamers.

There is another aspect to this. Some gamers prefer physical boxes and content. While these have deteriorated in quality since the good old days, where games used to come with big manuals and extras at no extra charge, it could seriously dampen the collector’s edition market as well.

I have made up my mind a long time ago. I prefer physical, as it gives me full ownership of the copy. I can sell or lend the game at any time, or put it on a shelf to look at its glorious artwork.

I won’t buy digital games on consoles and if this really hits in 2028, Sony won’t squeeze any more money out of my pockets. Will focus my efforts on retro gaming then. Lots of great games out there that need to be replayed or played for the first time.

What about you? Are you a gamer? Do you prefer physical or digital?

Sony gives us another example why you shouldn’t “buy” digital movies

Posted on by Martin Brinkmann

Imagine the following scenario: you browse the digital video store of a company, find a great movie or TV show, hit the buy button, only to find out later that the company that sold you the digital item has removed it from your library again. Money gone, movie gone, and seemingly no option to do anything about it.

This scenario is not one of those extreme unlikely events that never happens. Sony started to remove StudioCanal movies from its PlayStation Store some time ago. The company stopped the integrated movie store back in 2021 and has been at work since to remove content from user libraries.

This September, it is hitting British PlayStation users who bought Studio Canal titles. Sony lists hundreds of movies on a support page.

The reason? Sony says that “content licensing agreements” are to blame. The effect is simple: Starting September 1, 2026, customers will no longer be able to access “previously purchased content from Studio Canal” as it will be removed from the video library of the PlayStation system.

Sony is not the only major company that pulled content that customers purchased digitally before. Google, for instance, closed its Stadia cloud gaming service back in 2023 and cut access to purchased games. Google did refund software and hardware purchases though.

Microsoft shut down its ebooks store in 2019 and that also meant that customers could no longer access ebooks they bought in the store. Microsoft did issue full refunds as well.

The main takeaway is this: while companies use “buy” buttons when it comes to digital media, customers purchase licenses only. The license gives them the right to play, read or stream the content, but only as long as the license is not revoked. Revoking is rare, but it can happen at any time.

Good News: Microsoft extends Windows 10 support by another year

Posted on by Martin Brinkmann

If you are a home user running Windows 10 on a PC, you may know that support for the operating system is coming to an official end. While Microsoft ended support back in October 2025 officially, it introduced an Extended Security Updates (ESU) program for home users for the first time.

Once joined, Windows 10 would get another year of security updates until October 2026. Now, with the deadline looming over the heads of millions, Microsoft announced an extension of support.

In short: Windows 10 machines that joined ESU will receive security updates until October 2027 now. That is valid for Home and Pro editions only, as Enterprise customers get other, mostly paid, options to extend support by up to three years.

If the Windows 10 PC receives security updates via ESU already, then it will continue to receive updates after October 2026.

Microsoft confirmed the extension on the official Windows blog. It updated the original article about Windows 10’s future with the information:

This post has been updated to reflect that the Windows 10 Extended Security Updates (ESU) program for personal use devices is being provided for an additional year, with coverage now available through Oct. 12, 2027. This extension provides customers with more time to transition to a new Windows 11 PC while continuing to receive critical security updates.

The decision makes sense on several levels. While Microsoft claims that this is done to give Windows 10 customers more time to migrate, which it does, it is likely that other reasons have played a role.

For one, Microsoft has received some regulatory pressure to extend support for Windows 10, as millions of customers continue to use the operating system. Some, millions as well, can’t upgrade to Windows 11, which leaves them stranded on the older version of Windows.

While Microsoft hopes that these users will buy new PCs or components, the reality is that some won’t. They may continue to use Windows 10, even at the risk of running a system that has known security issues, or make the switch to Linux to continue using the PC and its components, which in many cases work just fine.

LastPass Hit by Third-Party Data Breach: What You Need to Know About the Klue Incident

Posted on by Martin Brinkmann

Anyone still using LastPass? If so, you need to be aware about a new security incident that has been confirmed by the company this week.

In the modern SaaS ecosystem, a digital fortress is only as secure as the side door left open for third-party vendors. Password management firm LastPass has disclosed a new data breach that involved the intelligence platform Klue.

According to an official incident report published on the LastPass blog, threat actors recently compromised Klue’s systems to steal OAuth tokens, granting them unauthorized access to LastPass’s Salesforce environment.

What the Attackers Obtained

The threat actors compromised Klue’s systems to steal OAuth tokens, which they then used to access LastPass’s Salesforce environment. The exposed data was limited to standard CRM and business contact information:

  • Customer names
  • Email addresses
  • Phone numbers
  • Physical addresses
  • Support case data
  • Sales-related data

What They Did NOT Obtain

The core architecture of LastPass remained unbreached. The attackers did not gain access to:

  • Customer Vaults: All stored passwords, secure notes, and saved data remained encrypted and secure
  • Master Passwords: Because of LastPass’s zero-knowledge architecture, master passwords are never known or stored by the company, and they were not exposed here.
  • Core Systems: LastPass products, services, and primary infrastructure were entirely unaffected

LastPass reveals that the information can be used for phishing attacks and other social engineering attempts. It recommends that “customers remain vigilant” and “exercise caution regarding unsolicited communications, including emails, phone calls, or requests for sensitive information.”.

For LastPass users suffering from breach fatigue, this latest headline likely induces a familiar sense of dread. However, when put into perspective, the Klue incident is a far cry from the devastating, back-to-back breaches of 2022, where threat actors successfully made off with encrypted customer vault backups and proprietary source code.

Still, while this is fundamentally a story about a third-party CRM leak rather than a critical product failure, the stolen contact information arms hackers with exactly what they need to launch highly convincing phishing campaigns.