Email authentication protocols like SPF, DKIM, and DMARC play a critical role in protecting domains from spoofing and phishing. However, when SEGs are introduced into the email path, the interaction with these protocols becomes more complex. Security gateways(SEGs) are a core part of many organizations’ email infrastructure. They act as intermediaries between the public internet and internal mail systems, inspecting, filtering, and routing messages. This blog examines how security gateways handle SPF, DKIM, and DMARC, with real-world examples from popular gateways such as Proofpoint, Mimecast, and Avanan. We’ll also cover best practices for maintaining authentication integrity and avoiding misconfigurations that can compromise email authentication or lead to false DMARC failures. Security gateways often sit at the boundary between your organization and the internet, managing both inbound and outbound email traffic. Their role affects how email authentication protocols behave. An inbound SEG examines emails coming into your organization. It checks SPF, DKIM, and DMARC to determine if the message is authentic and safe before passing it to your internal mail servers. An outbound SEG handles emails sent from your domain. It may modify headers, rewrite envelope addresses, or even apply DKIM signing. All of these can impact SPF,  DKIM, or DMARC validation on the recipient’s side. Understanding how SEGs influence these flows is crucial to maintaining proper authentication and avoiding unexpected DMARC failures. Inbound Handling of SPF, DKIM, and DMARC by Common Security Gateways When an email comes into your organization, your security gateway is the first to inspect it. It checks whether the message is real, trustworthy, and properly authenticated. Let’s look at how different SEGs handle these checks. Avanan (by Check Point) SPF: Avanan verifies whether the sending server is authorized to send emails for the domain by checking the SPF record. DKIM: It verifies if the message was signed by the sending domain and if that signature is valid. DMARC: It uses the results of the SPF and DKIM check to evaluate DMARC. However, final enforcement usually depends on how DMARC is handled by Microsoft 365 or Gmail, as Avanan integrates directly with them. Avanan offers two methods of integration:1. API integration: Avanan connects via APIs, no change in MX, usually Monitor or Detect modes.2. Inline integration: Avanan is placed inline in the mail flow (MX records changed), actively blocking or remediating threats. Proofpoint Email Protection SPF: Proofpoint checks SPF to confirm the sender’s IP is authorized to send on behalf of the domain. You can set custom rules (e.g. treat “softfail” as “fail”). DKIM: It verifies DKIM signatures and shows clear pass/fail results in logs. DMARC: It fully evaluates DMARC by combining SPF and DKIM results with alignment checks. Administrators can configure how to handle messages that fail DMARC, such as rejecting, quarantining, or delivering them. Additionally, Proofpoint allows whitelisting specific senders you trust, even if their emails fail authentication checks. Integration Methods Inline Mode: In this traditional deployment, Proofpoint is positioned directly in the email flow by modifying MX records. Emails are routed through Proofpoint’s infrastructure, allowing it to inspect and filter messages before they reach the recipient’s inbox. This mode provides pre-delivery protection and is commonly used in on-premises or hybrid environments. API-Based (Integrated Cloud Email Security – ICES) Mode: Proofpoint offers API-based integration, particularly with cloud email platforms like Microsoft 365 and Google Workspace. In this mode, Proofpoint connects to the email platform via APIs, enabling it to monitor and remediate threats post-delivery without altering the email flow. This approach allows for rapid deployment and seamless integration with existing cloud email services. Mimecast SPF: Mimecast performs SPF checks to verify whether the sending server is authorized by the domain’s SPF record. Administrators can configure actions for SPF failures, including block, quarantine, permit, or tag with a warning. This gives flexibility in balancing security with business needs. DKIM: It validates DKIM signatures by checking that the message was correctly signed by the sending domain and that the content hasn’t been tampered with. If the signature fails, Mimecast can take actions based on your configured policies. DMARC: It fully evaluates DMARC by combining the results of SPF and DKIM with domain alignment checks. You can choose to honor the sending domain’s DMARC policy (none, quarantine, reject) or apply custom rules, for example, quarantining or tagging messages that fail DMARC regardless of the published policy. This allows more granular control for businesses that want to override external domain policies based on specific contexts. Integration Methods Inline Deployment: Mimecast is typically deployed as a cloud-based secure email gateway. Organizations update their domain’s MX records to point to Mimecast, so all inbound (and optionally outbound) emails pass through it first. This allows Mimecast to inspect, filter, and process emails before delivery, providing robust protection. API Integrations: Mimecast also offers API-based services through its Mimecast API platform, primarily for management, archival, continuity, and threat intelligence purposes. However, API-only email protection is not Mimecast’s core model. Instead, the APIs are used to enhance the inline deployment, not replace it. Barracuda Email Security Gateway SPF: Barracuda checks the sender’s IP against the domain’s published SPF record. If the check fails, you can configure the system to block, quarantine, tag, or allow the message, depending on your policy preferences. DKIM: It validates whether the incoming message includes a valid DKIM signature. The outcome is logged and used to inform further policy decisions or DMARC evaluations. DMARC: It combines SPF and DKIM results, checks for domain alignment, and applies the DMARC policy defined by the sender. Administrators can also choose to override the DMARC policy, allowing messages to pass or be treated differently based on organizational needs (e.g., trusted senders or internal exceptions). Integration Methods Inline mode (more common and straightforward): Barracuda Email Security Gateway is commonly deployed inline by updating your domain’s MX records to point to Barracuda’s cloud or on-premises gateway. This ensures that all inbound emails pass through Barracuda first for filtering and SPF, DKIM, and DMARC validation before being delivered to your mail servers. Deployment Behind the Corporate Firewall: Alternatively, Barracuda can be deployed in transparent or bridge mode without modifying MX records. In this setup, the gateway is placed inline at the network level, such as behind a firewall, and intercepts mail traffic transparently. This method is typically used in complex on-premises environments where changing DNS records is not feasible. Cisco Secure Email (formerly IronPort) Cisco Secure Email acts as an inline gateway for inbound email, usually requiring your domain’s MX records to point to the Cisco Email Security Appliance or cloud service. SPF: Cisco Secure Email verifies whether the sending server is authorized in the sender domain’s SPF record. Administrators can set detailed policies on how to handle SPF failures. DKIM: It validates the DKIM signature on incoming emails and logs whether the signature is valid or has failed. DMARC: It evaluates DMARC by combining SPF and DKIM results along with domain alignment checks. Admins can configure specific actions, such as quarantine, reject, or tag, based on different failure scenarios or trusted sender exceptions. Integration methods On-premises Email Security Appliance (ESA): You deploy Cisco’s hardware or virtual appliance inline, updating MX records to route mail through it for filtering. Cisco Cloud Email Security: Cisco offers a cloud-based email security service where MX records are pointed to Cisco’s cloud infrastructure, which filters and processes inbound mail. Cisco Secure Email also offers advanced, rule-based filtering capabilities and integrates with Cisco’s broader threat protection ecosystem, enabling comprehensive inbound email security. Outbound Handling of SPF, DKIM, and DMARC by Common Security Gateways When your organization sends emails, security gateways can play an active role in processing and authenticating those messages. Depending on the configuration, a gateway might rewrite headers, re-sign messages, or route them through different IPs – all actions that can help or hurt the authentication process. Let’s look at how major SEGs handle outbound email flow. Avanan – Outbound Handling and Integration Methods Outbound Logic Avanan analyzes outbound emails primarily to detect data loss, malware, and policy violations. In API-based integration, emails are sent directly by the original mail server (e.g., Microsoft 365 or Google Workspace), so SPF and DKIM signatures remain intact. Avanan does not alter the message or reroute traffic, which helps maintain full DMARC alignment and domain reputation. Integration Methods 1. API Integration: Connects to Microsoft 365 or Google Workspace via API. No MX changes are needed. Emails are scanned after they are sent, with no modification to SPF, DKIM, or the delivery path.  How it works: Microsoft Graph API or Google Workspace APIs are used to monitor and intervene in outbound emails. Protection level: Despite no MX changes, it can offer inline-like protection, meaning it can block, quarantine, or encrypt emails before they are delivered externally. SPF/DKIM/DMARC impact: Preserves original headers and signatures since mail is sent directly from Microsoft/Google servers. 2. Inline Integration: Requires changing MX records to route email through Avanan. In this mode, Avanan can intercept and inspect outbound emails before delivery. Depending on the configuration, this may affect SPF or DKIM if not properly handled. How it works: Requires adding Avanan’s Protection level: Traditional inline security with full visibility and control, including encryption, DLP, policy enforcement, and advanced threat protection. SPF/DKIM/DMARC impact: SPF configuration is needed by adding Avanan’s include mechanism to the sending domain’s SPF record. The DKIM record of the original sending source is preserved. For configurations, you can refer to the steps in this blog. Proofpoint – Outbound Handling and Integration Methods Outbound Logic Proofpoint analyzes outbound emails to detect and prevent data loss (DLP), to identify advanced threats (malware, phishing, BEC) originating from compromised internal accounts, and to ensure compliance. Their API integration provides crucial visibility and powerful remediation capabilities, while their traditional gateway (MX record) deployment delivers true inline, pre-delivery blocking for outbound traffic. Integration methods 1. API Integration: No MX record changes are required for this deployment method. Integration is done with Microsoft 365 or Google Workspace. How it works: Through its API integration, Proofpoint gains deep visibility into outbound emails and provides layered security and response features, including: Detect and alert: Identifies sensitive content (Data Loss Prevention violations), malicious attachments, or suspicious links in outbound emails. Post-delivery remediation (TRAP): A key capability of the API model is Threat Response Auto-Pull (TRAP), which enables Proofpoint to automatically recall, quarantine, or delete emails after delivery. This is particularly useful for internally sent messages or those forwarded to other users. Enhanced visibility: Aggregates message metadata and logs into Proofpoint’s threat intelligence platform, giving security teams a centralized view of outbound risks and user behavior. Protection level: API-based integration provides strong post-delivery detection and response, as well as visibility into DLP incidents and suspicious behavior.  SPF/DKIM/DMARC impact: Proofpoint does not alter SPF, DKIM, or DMARC because emails are sent directly through Microsoft or Google servers. Since Proofpoint’s servers are not involved in the actual sending process, the original authentication headers remain intact. 2. Gateway Integration (MX Record/Smart Host): This method requires updating MX records or routing outbound mail through Proofpoint via a smart host. How it works: Proofpoint acts as an inline gateway, inspecting emails before delivery. Inbound mail is filtered via MX changes; outbound mail is relayed through Proofpoint’s servers. Threat and DLP filtering: Scans outbound messages for sensitive content, malware, and policy violations. Real-time enforcement: Blocks, encrypts, or quarantines emails before they’re delivered. Policy controls: Applies rules based on content, recipient, or behavior. Protection level: Provides strong, real-time protection for outbound traffic with pre-delivery enforcement, DLP, and encryption. SPF/DKIM/DMARC impact: Proofpoint becomes the sending server: SPF: You need to configure ProofPoint’s SPF. DKIM: Can sign messages; requires DKIM setup. DMARC: DMARC passes if SPF and DKIM are set up properly. Please refer to this article to configure SPF and DKIM for ProofPoint. Mimecast – Outbound Handling and Integration Methods Outbound Logic Mimecast inspects outbound emails to prevent data loss (DLP), detect internal threats such as malware and impersonation, and ensure regulatory compliance. It primarily functions as a Secure Email Gateway (SEG), meaning it sits directly in the outbound email flow. While Mimecast offers APIs, its core outbound protection is built around this inline gateway model. Integration Methods 1. Gateway Integration (MX Record change required) This is Mimecast’s primary method for outbound email protection. Organizations route their outbound traffic through Mimecast by configuring their email server (e.g., Microsoft 365, Google Workspace, etc.) to use Mimecast as a smart host. This enables Mimecast to inspect and enforce policies on all outgoing emails in real time. How it works: Updating outbound routing in your email system (smart host settings), or Using Mimecast SMTP relay to direct messages through their infrastructure. Mimecast then scans, filters, and applies policies before the email reaches the final recipient. Protection level: Advanced DLP: Identifies and prevents sensitive data leaks. Impersonation and Threat Protection: Blocks malware, phishing, and abuse from compromised internal accounts. Email Encryption and Secure Messaging: Applies encryption policies or routes messages via secure portals. Regulatory Compliance: Enforces outbound compliance rules based on content, recipient, or metadata. SPF/DKIM/DMARC impact: SPF: Your SPF record must include Mimecast’s SPF mechanism based on your region to avoid SPF failures. DKIM: A new DKIM record should be configured to make sure your emails are DKIM signed when routing through Mimecast. DMARC: With correct SPF and DKIM setup, Mimecast ensures DMARC alignment, maintaining your domain’s sending reputation. Please refer to the steps in this detailed article to set up SPF and DKIM for Mimecast. 2. API Integration (Complementary to Gateway) Mimecast’s APIs complement the main gateway by providing automation, reporting, and management tools rather than handling live outbound mail flow. They allow you to manage policies, export logs, search archived emails, and sync users. APIs enhance visibility and operational tasks but do not provide real-time filtering or blocking of outbound messages. Since APIs don’t process live mail, they have no direct effect on SPF, DKIM, or DMARC; those depend on your gateway (smart host) setup. Barracuda – Outbound Handling and Integration Methods Outbound Logic Barracuda analyzes outbound emails to prevent data loss (DLP), block malware, stop phishing/impersonation attempts from compromised internal accounts, and ensure compliance. Barracuda offers flexible deployment options, including both traditional gateway (MX record) and API-based integrations. While both contribute to outbound security, their roles are distinct. Integration Methods 1. Gateway Integration (MX Record / Smart Host) — Primary Inline Security How it works: All outbound emails pass through Barracuda’s security stack for real-time inspection, threat blocking, and policy enforcement before delivery. Protection level: Comprehensive DLP (blocking, encrypting, or quarantining sensitive content)  Outbound spam and virus filtering  Enforcement of compliance and content policies This approach offers a high level of control and immediate threat mitigation on outbound mail flow. SPF/DKIM/DMARC impact: SPF: Update SPF records to include Barracuda’s sending IPs or SPF include mechanism. DKIM: Currently, no explicit setup is needed; DKIM of the main sending source is preserved. Refer to this article for more comprehensive guidance on Barracuda SEG configuration. 2. API Integration (Complementary & Advanced Threat Focus) How it works: The API accesses cloud email environments to analyze historical and real-time data, learning normal communication patterns to detect anomalies in outbound emails. It also supports post-delivery remediation, enabling the removal of malicious emails from internal mailboxes after sending. Protection level: Advanced AI-driven detection and near real-time blocking of outbound threats, plus strong post-delivery cleanup capabilities. SPF/DKIM/DMARC impact: Since mail is sent directly by the original mail server (e.g., Microsoft 365), SPF and DKIM signatures remain intact, preserving DMARC alignment and domain reputation. Cisco Secure Email (formerly IronPort) – Outbound Handling and Integration Methods Outbound Logic Cisco Secure Email protects outbound email by preventing data loss (DLP), blocking spam and malware from internal accounts, stopping business email compromise (BEC) and impersonation attacks, and ensuring compliance. Cisco provides both traditional gateway appliances/cloud gateways and modern API-based solutions for layered outbound security. Integration Methods 1. Gateway Integration (MX Record / Smart Host) – Cisco Secure Email Gateway (ESA) How it works: Organizations update MX records to route mail through the Cisco Secure Email Gateway or configure their mail server (e.g., Microsoft 365, Exchange) to smart host outbound email via the gateway. All outbound mail is inspected and policies enforced before delivery. Protection level: Granular DLP (blocking, encrypting, quarantining sensitive content) Outbound spam and malware filtering to protect IP reputation Email encryption for sensitive outbound messages Comprehensive content and attachment policy enforcement SPF: Check this article for comprehensive guidance on Cisco SPF settings. DKIM: Refer to this article for detailed guidance on Cisco DKIM settings. 2. API Integration – Cisco Secure Email Threat Defense How it works: Integrates directly via API with Microsoft 365 (and potentially Google Workspace), continuously monitoring email metadata, content, and user behavior across inbound, outbound, and internal messages. Leverages Cisco’s threat intelligence and AI to detect anomalous outbound activity linked to BEC, account takeover, and phishing. Post-Delivery Remediation: Automates the removal or quarantine of malicious or policy-violating emails from mailboxes even after sending. Protection level: Advanced, AI-driven detection of sophisticated outbound threats with real-time monitoring and automated remediation. Complements gateway filtering by adding cloud-native visibility and swift post-send action. SPF/DKIM/DMARC impact: Since emails are sent directly by the original mail server, SPF and DKIM signatures remain intact, preserving DMARC alignment and domain reputation. If you have any questions or need assistance, feel free to reach out to EasyDMARC technical support.

Elon Musk’s sudden breakup with President Trump took over social media on Thursday. But the escalating feud won’t be enough to salvage a Starlink contract with Canada’s Ontario province, which canceled the deal to hit back at Trump’s trade war. Ontario Premier Doug Ford today confirmed to reporters that the Starlink deal is still dead, even though Musk is on the outs with Trump. Ford also couldn’t help but take a shot at the very public demise of the Musk-Trump partnership.“Yes, Starlink is done,” he said. “Are we surprised that they’re not seeing eye-to-eye? I predicted that as soon as that marriage happened. I thought that there would be a divorce real quick.”As for why Ontario won’t revive the deal, Ford indicated that Musk’s past support of Trump and his trade war against Canada went too far. This included Musk tweeting “Canada is not a real country" in response to a petition urging the Canadian government to rescind his citizenship.Recommended by Our Editors“I don’t want to deal with someone who’s attacking our country. And he was one of the number one culprits, Elon Musk. And that’s unacceptable. I can’t do business with someone that’s doing that,” Ford said. SpaceX’s Starlink business was originally supposed to receive a $100 million CAD ($73 million) contract to deploy satellite internet dishes that would connect 15,000 underserved homes and businesses. But in March, Ontario killed the deal to retaliate against Trump’s 25% tariff on Canadian goods. The decision caused anti-Starlink sentiment skyrocketed in the country, but it also undermined Ontario's effort to bring high-speed broadband to rural and remote areas. Still, some Canadian consumers continue to subscribe to and sign up for the satellite internet service, which has been pushing Starlink promotions in the country. In the meantime, Musk’s emerging feud with Trump could trigger some harsh consequences for SpaceX, which receives numerous federal contracts. In a Truth Social post on Thursday, the President said: “The easiest way to save money in our Budget, Billions and Billions of Dollars, is to terminate Elon’s Governmental Subsidies and Contracts.”

Elon Musk is contemplating decommissioning SpaceX's Dragon spacecraft, responding to President Donald Trump's apparent intent to terminate government subsidies and contracts with the billionaire's companies. It looks like the feud between the former allies has quickly turned vicious.SpaceX's CEO initially announced that the company would retire its Dragon spacecraft in an X post on Thursday, with Musk sharing a screenshot of a post published on Trump's Truth Social account earlier in the day."The easiest way to save money in our Budget, Billions and Billions of Dollars, is to terminate Elon’s Governmental Subsidies and Contracts," said Trump in the screenshotted post. "I was always surprised that Biden didn’t do it!" You May Also Like "In light of the President’s statement about cancellation of my government contracts, @SpaceX will begin decommissioning its Dragon spacecraft immediately," Musk wrote on X.SpaceX's Dragon spacecraft are a family of vehicles designed to carry passengers and cargo. The National Aeronautics and Space Administration (NASA) has previously relied upon them to transport astronauts to and from the International Space Station (ISS). Mere hours prior to Musk's announcement, SpaceX posted on X that it was preparing to launch a Dragon next Tuesday.For a few hours, it seemed reasonable to assume that this launch would now not go ahead. However, Musk then appeared to quickly walk back his decision. Responding to an X user advising him to "cool off and take a step back for a couple days," the billionaire subsequently stated that Dragon will not be decommissioned after all.It's unclear whether Musk's initial announcement was sincere, or whether his apparent about-face might be sarcastic. Musk has a history of making flippant comments online with no apparent regard to their consequences. What is clear is that Musk and Trump's relationship is well past the honeymoon phase, and now looks much more like an ugly divorce.If Trump does terminate government contracts with Musk's companies, it would deal a significant blow to the billionaire. According to a Washington Post investigation, NASA has invested over $15 billion in SpaceX alone. When put together with Musk's other companies such as EV automaker Tesla, his various businesses have received at least $38 billion in government contracts, loans, subsidies, and tax credits. Mashable Trend Report: Coming Soon! Decode what’s viral, what’s next, and what it all means. Sign up for Mashable’s weekly Trend Report newsletter. By clicking Sign Me Up, you confirm you are 16+ and agree to our Terms of Use and Privacy Policy. Thanks for signing up! Musk and Trump go through messy public breakup Credit: Roberto Schmidt / AFP via Getty Images Musk's relationship with Trump has significantly deteriorated in recent days. The billionaire announced that he was leaving his position as de facto head of the Department of Government Efficiency (DOGE) last Wednesday, just one day after he criticised Trump's tax bill as undermining its work. The split was presented as amicable at the time, with Trump presenting Musk with a golden key and words of praise. However, their love affair has quickly turned sour.Musk continued to lambast Trump's bill after his departure from DOGE, arguing that it will increase government debt by trillions of dollars. Strongly disagreeing with the president's characterisation of the proposed legislation as a "Big Beautiful Bill," Musk labelled it a "disgusting abomination" and has been calling for lawmakers to crush it.For his part, Trump has claimed that Musk is simply throwing a tantrum because the bill supposedly cut an alleged "EV mandate." The president stated on Thursday that he had asked the billionaire to leave his administration, and that Musk had been "wearing thin.""I took away his EV Mandate that forced everyone to buy Electric Cars that nobody else wanted (that he knew for months I was going to do!), and he just went CRAZY!" Trump claimed. Despite Trump's assertions, he did not abolish any EV mandate as there has never been any U.S. law which makes switching to an electric car mandatory. However, Trump has taken several anti-EV measures since his inauguration, including abolishing incentives encouraging EV adoption, pausing $3 billion in funding for a U.S. charging network, and introducing a $250 annual fee for EV users in his recent tax bill. Related Stories Trump's claim about Musk is an interesting contrast to his statements in March, when he praised the billionaire for not complaining about the supposed end of the non-existent EV mandate. The president made the comments while he and Musk co-hosted a Tesla ad on the White House lawn in an effort to boost the company's cratering stock prices.Tesla's struggling share value has now fallen again amidst Musk's feud with Trump, plummeting more than 14 percent on Thursday to wipe out over $150 billion in value."I don’t mind Elon turning against me, but he should have done so months ago," Trump wrote on Thursday.Meanwhile, Musk went all-in attacking Trump on Thursday, claiming that the president is linked to child sex offender Jeffrey Epstein and sharing posts calling for him to be impeached. Musk has also hit out at Trump's tariffs on international trade, predicting that they will "cause a recession in the second half of the year.""Without me, Trump would have lost the election," Musk alleged on X. "Such ingratitude."

The murder of John Forde was the culmination to years of political, social, and criminal intrigue.   Get the Popular Science daily newsletter💡 Breakthroughs, discoveries, and DIY tips sent every weekday. Researchers have uncovered handwritten letters, court documents, and a coroner’s report related to the nearly 700-year-old cold case murder of a medieval priest. Published on June 5 in the journal Criminal Law Forum, the investigation draws on direct archival evidence from Cambridge University that is helping fill in the gaps to a high-profile true crime scandal that would make headlines even today. But despite a mountain of firsthand accounts, the murder’s masterminds never saw justice. The ‘planned and cold-blooded’ crime On Friday, May 3, 1337, Anglican priest John Forde began a walk along downtown London’s Cheapside street after vespers (evening prayers) shortly before sunset. At one point, a clergyman familiar to Forde by the name of Hasculph Neville approached him to begin a “pleasant conversation.” As the pair neared St. Paul’s Cathedral, four men ambushed the priest. One of the attackers then proceeded to slit Forde’s throat using a 12-inch dagger as two other assailants stabbed him in the stomach in front of onlookers. The vicious crime wasn’t a brazen robbery or politically motivated attack. It was likely a premeditated murder orchestrated by Ela Fitzpayne, a noblewoman, London crime syndicate leader—and potentially Forde’s lover. “We are looking at a murder commissioned by a leading figure of the English aristocracy. It is planned and cold-blooded, with a family member and close associates carrying it out, all of which suggests a revenge motive,” Cambridge University criminology professor Manuel Eisner explained in a statement. The location of the murder of John Forde on May 3, 1337. Credit: Medieval Murder Maps / University of Cambridge’s Institute of Criminology / Historic Towns Trust. A longstanding feud To understand how such a brutal killing could take place in daylight on a busy London street, it’s necessary to backtrack at least five years. In January 1332, the Archbishop of Canterbury sent a letter to the Bishop of Winchester that included a number of reputation-ruining claims surrounding Fitzpayne. In particular, Archbishop Simon Mepham described sexual relationships involving “knights and others, single and married, and even with clerics in holy orders.” The wide-ranging punishments for such sinful behavior could include a prohibition on wearing gold and other precious jewelry, as well as large tithes to monastic orders and the poor. But the most humiliating atonement often came in the form of a public walk of shame. The act of contrition involved walking barefoot across Salisbury Cathedral—England’s longest nave—in order to deliver a handcarried, four-pound wax candle to the church altar. What’s more, Archbishop Mepham commanded that Fitzpayne must repeat this penance every autumn for seven years. Fitzpayne was having none of it. According to Mepham’s message, the noblewoman chose to continue listening to a “spirit of pride” (and the devil), and refused to abide by the judgment. A second letter sent by the Archbishop that April also alleged that she had since absconded from her husband, Sir Robert Fitzpayne, and was hiding in London’s Rotherhithe district along the Thames River. Due to this, Archbishop Mepham reported that Ela Fitzpayne had been excommunicated from the church. Image of the Archbishop of Canterbury’s letters to the Bishop of Winchester on the subject of Ela Fitzpayne, from the register of John de Stratford. Credit: Hampshire Archives and Hampshire County Council. Raids and rats But who tipped the clergy off to her indiscretions? According to Eisner’s review of original documents as part of the Cambridge University Institute of Criminology’s Medieval Murder Maps project, it was almost certainly her ex-lover, the soon-to-be-murdered John Forde. He was the only alleged lover named in Archbishop Mepham’s letters, and served as a church rector in a village located on the Fitzpayne family’s estate at the time of the suspected affair.  “The archbishop imposed heavy, shameful public penance on Ela, which she seems not to have complied with, but may have sparked a thirst for vengeance,” Eisner said. “Not least as John Forde appears to have escaped punishment by the church.” But Forde’s relationship with the Fitzpaynes seems to have extended even more illicit activities. In another record reviewed by Eisner, both Ela Fitzpayne and John Forde had been indicted by a Royal Commission in 1322. The crime–assisting in the raid of a Benedictine priory alongside Sir Fitzpayne. They and others reportedly assaulted the priory a year earlier, making off with around 18 oxen, 30 pigs, and 200 sheep. The monastery coincidentally served as a French abbey’s outpost amid increasing tensions between France and England in the years leading up to the Hundred Years’ War. Archbishop Mepham was almost certainly displeased after hearing about the indictment of one of his own clergy. A strict administrator himself, Mepham “was keen to enforce moral discipline among the gentry and nobility,” added Eisner. He theorizes that Forde copped to the affair after getting leaned on by superiors, which subsequently led to the campaign to shame Ela Fitzpayne as a means to reassert the Church’s authority over English nobility. Forde, unfortunately, was caught between the two sides. “John Forde may have had split loyalties,” argued Eisner. “One to the Fitzpayne family, who were likely patrons of his church and granted him the position. And the other to the bishops who had authority over him as a clergy member.” Archbishop Mepham ultimately wouldn’t live to see the scandal’s full consequences. Fitzpayne never accepted her walk of shame, and the church elder died a year after sending the incriminating letters. Eisner believes the Fitzpaynes greenlit their hit job on Forde only after the dust had seemingly settled. It doesn’t help their case three bystanders said the man who slit the rector’s throat was none other than Ela Fitzpayne’s own brother, Hugh Lovell. They also named two family servants as Forde’s other assailants. Archbishop Mepham died four years before Forde’s murder. Credit: ampshire Archives and Hampshire County Council Turning a blind eye Anyone waiting for justice in this medieval saga will likely be disappointed. “Despite naming the killers and clear knowledge of the instigator, when it comes to pursuing the perpetrators, the jury turn[ed] a blind eye,” Eisner said. Eisner explained the circumstances surrounding an initial lack of convictions were simply “implausible.” No one supposedly could locate the accused to bring to trial, despite the men belonging to one of England’s highest nobility houses. Meanwhile, the court claimed Hugh Lovell had no belongings available to confiscate. “This was typical of the class-based justice of the day,” said Eisner. In the end, the only charge that ever stuck in the murder case was an indictment against one of the family’s former servants. Five years after the first trial in 1342, Hugh Colne was convicted of being one of the men to stab Forde in the stomach and sentenced to the notorious Newgate Prison. As dark and sordid as the multiyear medieval drama was, it apparently didn’t change much between Ela Fitzpayne and her husband, Sir Robert. She and the baron remained married until his death in 1354—when she subsequently inherited all his property. “Where rule of law is weak, we see killings committed by the highest ranks in society, who will take power into their own hands, whether it’s today or seven centuries ago,” said Eisner. That said, the criminology professor couldn’t help but concede that Ela Fitzpayne was an “extraordinary” individual, regardless of the era. “A woman in 14th century England who raided priories, openly defied the Archbishop of Canterbury, and planned the assassination of a priest,” he said. “Ela Fitzpayne appears to have been many things.”

Image of the Archbishop of Canterbury's letters to the Bishop of Winchester on the subject of Ela Fitzpayne, from the register of John de Stratford. Reproduced with permission of Hampshire Archives and Hampshire County Council. (Image Credit: Register of John de Stratford. Reproduced with permission of Hampshire Archives and Hampshire County Council.)NewsletterSign up for our email newsletter for the latest science newsEspionage, sex, public humiliation, murder — these may sound like tropes straight out of Game of Thrones, but they’re actually all elements of a nearly 700-year-old cold case in England. After analyzing Medieval letters and records, a research team from the Cambridge University Institute of Criminology’s Medieval Murder Maps project may have found the killer of a priest. However, this priest may not have been so innocent. A new paper published in Criminal Law Forum takes a deeper look at this 14th-century cold case.Tracing a Medieval MurderThe Medieval Murder Maps project uses interactive maps of three English cities, London, Oxford, and York, during the Medieval period. Throughout the cities are the locations of various deaths and murders. Each location has a story associated with it, directly from written records and coroners' reports at the time. Some of these stories are full of intriguing twists and turns.The Cambridge research team analyzed over 100 murders from texts, translated from Latin, from that period, and used a coding method to separate the deaths into different categories, including time (day, week, month), motivation, weapon used, victim, and location. From this information, one of the deaths the team found most interesting was the murder of John Forde in 1337.A Medieval Lover to Murderer From the letters and texts the team analyzed, they pieced together the events that led up to Forde’s death. Forde was a priest living in London when he was murdered on a busy street. But what possible reason would someone have to want to murder a priest? The motive, according to the research team, was likely revenge. According to Manuel Eisner, one of the study’s authors, the murder may have been an act of revenge by noblewoman Ela Fitzpayne. According to the records, the Archbishop of Canterbury, Simon Mepham, had enacted penance on Fitzpayne after it was discovered that Forde had been her lover. A letter written by Archbishop Mepham accused Fitzpayne of adultery with Forde and possibly others. Her penance was to take a barefoot walk of shame across Salisbury Cathedral. Eisner also found a document that suggested Fitzpayne, her husband, and John Forde sent a gang to rob a church priory and took the livestock for ransom. It’s possible that during this time, Forde found himself in bed with Fitzpayne, before betraying her to the Archbishop Mepham. Commissioned Murder Possibly betrayed by her former lover and sentenced to walks of shame that were to take place once a year for seven years,  Fitzpayne would have none of it. On an early evening on a busy London street, near St. Paul’s Cathedral, three men attacked Forde. One slit his throat while the others stabbed him in the gut. Witnesses claim that the murderers were Fitzpayne’s brother and two of her former servants. “We are looking at a murder commissioned by a leading figure of the English aristocracy. It is planned and cold-blooded, with a family member and close associates carrying it out, all of which suggests a revenge motive,” said Eisner in a press release.Cold Case RevealedAccording to letters from Archbishop Mepham, Fitzpayne was led by the devil and a “spirit of pride.”“The archbishop imposed heavy, shameful public penance on Ela, which she seems not to have complied with, but may have sparked a thirst for vengeance,” said Eisner in a press release. “Not least as John Forde appears to have escaped punishment by the church.” When Archbishop Mepham died in 1333, Fitzpayne waited four years before enacting her revenge, and in 1337, Forde was killed. Article SourcesOur writers at Discovermagazine.com use peer-reviewed studies and high-quality sources for our articles, and our editors review for scientific accuracy and editorial standards. Review the sources used below for this article:A graduate of UW-Whitewater, Monica Cull wrote for several organizations, including one that focused on bees and the natural world, before coming to Discover Magazine. Her current work also appears on her travel blog and Common State Magazine. Her love of science came from watching PBS shows as a kid with her mom and spending too much time binging Doctor Who.1 free article leftWant More? Get unlimited access for as low as $1.99/monthSubscribeAlready a subscriber?Register or Log In1 free articleSubscribeWant more?Keep reading for as low as $1.99!SubscribeAlready a subscriber?Register or Log In

WTF?! When the president of the United States and the world's richest person have a falling out, the ramifications can be widespread. Since Musk and Trump went from friends to enemies, $152 billion has been wiped off Tesla's share price, and Musk has threatened to decommission the SpaceX Dragon spacecraft that NASA relies on to deliver crew to and from the International Space Station. Musk has also said that Trump appears in files relating to Jeffrey Epstein. When he left the White House last week, Musk blasted those who said he'd had a falling out with Trump. The CEO insisted his departure was due to his scheduled 130 days as a government employee coming to an end. But Musk had been publicly criticizing Trump's Big Beautiful Bill Act, warning it would increase the budget deficit. After learning that an electric-vehicle tax credit that would help incentivize Tesla purchases was not included in the bill, Musk called it "a disgusting abomination" on X and urged Americans to call Congress to have the bill killed. On Thursday, the two men used their respective social media platforms to throw insults at each other. At one point, Trump threatened to "terminate Elon's Governmental Subsidies and Contracts" as a way to slash billions of dollars from the budget. The warning sent Tesla's shares down just over 14%, wiping around $152 billion off its valuation – and almost $100 billion off Musk's total net worth. In response to Trump's threat to cancel Musk's government contracts, Musk said SpaceX will begin decommissioning its Dragon spacecraft immediately. The craft, which NASA relies on for transport missions including ferrying astronauts to the ISS, is under contract worth roughly $4.9 billion. The capsule is the only US spacecraft capable of flying humans into orbit. The only other crewed spacecraft that sends astronauts to the ISS is Russia's Soyuz system. However, after an X user told him to "cool off," Musk wrote, "Ok, we won't decommission Dragon." // Related Stories As the war of words has grown, Musk said Trump's controversial tariffs will cause a recession in the second half of this year. But his "really big bomb" was an allegation that Trump appears in the files of pedophile financier Jeffrey Epstein, who killed himself in his jail cell in August 2019 while awaiting trial. Musk has also shared a post calling for Trump's impeachment and posted a poll asking if a new political party should be created in the US that "actually represents the 80% in the middle." 81% of the 4.4 million respondents have voted yes. One has to wonder if Musk believes his time in the White House was worth it. Beyond his reputational damage, his companies have suffered by association. Tesla sales were down 50% last month, and there have been protests and attacks on dealerships. The company's share price is down 40% from its all-time high on December 17, 2024, before Musk was part of DOGE.

A significant cyber breach at His Majesty’s Revenue and Customs (HMRC) that saw scammers cheat the public purse out of approximately £47m has been met with dismay from security experts thanks to the sheer simplicity of the attack, which originated via account takeover attempts on legitimate taxpayers. HMRC disclosed the breach to a Treasury Select Committee this week, revealing that hackers accessed the online accounts of about 100,000 people via phishing attacks and managed to claim a significant amount of money in tax rebates before being stopped. It is understood that those individuals affected have been contacted by HMRC – they have not personally lost any money and are not themselves in any trouble. Arrests in the case have already been made. During proceedings, HMRC also came in for criticism by the committee’s chair Meg Hillier, who had learned about the via an earlier news report on the matter, over the length of time taken to come clean over the incident. With phishing emails sent to unwitting taxpayers identified as the initial attack vector for the scammers, HMRC might feel relieved that it has dodged full blame for the incident. But according to Will Richmond-Coggan, a partner specialising in data and cyber disputes at law firm Freeths, even though the tax office had gone to pains to stress its own systems were never actually compromised, the incident underscored just how widespread the consequences of cyber attacks can be – snowballing from simple origins into a multimillion pound loss. “It is clear from HMRC's explanation that the crime against HMRC was only possible because of earlier data breaches and cyber attacks,” said Richmond-Coggan. “Those earlier attacks put personal data in the hands of the criminals which enabled them to impersonate tax payers and apply successfully to claim back tax.” Meanwhile, Gerasim Hovhannisyan, CEO of EasyDMARC, an email security provider, pointed out that phishing against both private individuals and businesses and other organisations had long ago moved beyond the domain of scammers chancing their luck. While this type of scattergun fraud remains a potent threat, particularly to consumers who may not be informed about cyber security matters – the scale of the HMRC phish surely suggests a targeted operation, likely using carefully crafted email purporting to represent HMRC itself, designed to lure self-assessment taxpayers into handing over their accounts. Not only that, but generative artificial intelligence (GenAI) means targeted phishing operations have become exponentially more dangerous in a very short space of time, added Hovhannisyan. “[It] has made [phishing] scalable, polished, and dangerously convincing, often indistinguishable from legitimate communication. And while many organisations have strengthened their security perimeters, email remains the most consistently exploited and underestimated attack vector,” he said. “These scams exploit human trust, using urgency, authority, and increasingly realistic impersonation tactics. If HMRC can be phished, anyone can.” Added Hovhannisyan: “What’s more alarming is that the Treasury Select Committee only learned of the breach through the news. When £47m is stolen through impersonation, institutions can’t afford to stay quiet. Delayed disclosure erodes trust, stalls response, and gives attackers room to manoeuvre.” Once again a service’s end-users have turned out to be the source of a cyber attack and as such, whether they are internal or – as in this case – external, are often considered an organisation’s first line of defence. However, it is not always wise to take this approach, and for an organisation like HMRC daily engaging with members of the public, it is also not really possible. Security education is a difficult proposition at the best of times and although the UK’s National Cyber Security Centre (NCSC) provides extensive advice and guidance on spotting and dealing with phishing emails for consumers – it also operates a phishing reporting service that as of April 2025 has received over 41 million scam reports – bodies like HMRC cannot rely on everybody having visited the NCSC’s website. As such, Mike Britton, chief information officer (CIO) at Abnormal AI, a specialist in phishing, social engineering and account takeover prevention, argued that HMRC could and should have done more from a technical perspective. “Governments will always be a high tier target for cyber criminals due to the valuable information they hold. In fact, attacks against this sector are rising,” he said. “In this case, it looks like criminals utilised account take over to conduct fraud. To combat this, multifactor authentication (MFA) is key, but as attacks grow more sophisticated, further steps must be taken.” Britton said organisations like HMRC really needed to consider adopting more layered security strategies, not only including MFA but also incorporating wider visibility and unified controls across its IT systems. Account takeover attacks such as the ones seen in this incident can unfold quickly, he added, so its cyber function should also be equipped with the tools to identify and remediate compromised accounts on the fly. Read more about trends in phishing Quishing, meaning QR code phishing, is an offputting term for an on-the-rise attack method. Learn how to defend against it. A healthy dose of judicious skepticism is crucial to preventing phishing attacks, said David Fine, supervisory special agent at the FBI, during a presentation at a HIMSS event. Exchange admins got a boost from Microsoft when it improved how it handles DMARC authentication failures to help organisations fight back from email-based attacks on their users.

Published June 5, 2025 10:00am EDT close Don’t be so quick to click that Google calendar invite. It could be a hacker’s trap Cybercriminals are sending fake meeting invitations that seem legitimate. NEWYou can now listen to Fox News articles! Americans’ personal data is now spread across more digital platforms than ever. From online shopping habits to fitness tracking logs, personal information ends up in hundreds of company databases. While most people worry about social media leaks or email hacks, a far less visible threat comes from data brokers.I still find it hard to believe that companies like this are allowed to operate with so little legal scrutiny. These firms trade in personal information without our knowledge or consent. What baffles me even more is that they aren’t serious about protecting the one thing that is central to their business model: data. Just last year, we saw news of a massive data breach at a data broker called National Public Data, which exposed 2.7 billion records. And now another data broker, LexisNexis, a major name in the industry, has reported a significant breach that exposed sensitive information from more than 364,000 people. A hacker at work (Kurt "CyberGuy" Knutsson)LexisNexis breach went undetected for months after holiday hackLexisNexis filed a notice with the Maine attorney general revealing that a hacker accessed consumer data through a third-party software development platform. The breach happened on Dec. 25, 2024, but the company only discovered it months later. LexisNexis was alerted on April 1, 2025, by an unnamed individual who claimed to have found sensitive files. It remains unclear whether this person was responsible for the breach or merely came across the exposed data.MASSIVE DATA BREACH EXPOSES 184 MILLION PASSWORDS AND LOGINSA spokesperson for LexisNexis confirmed that the hacker gained access to the company’s GitHub account. This is a platform commonly used by developers to store and collaborate on code. Security guidelines repeatedly warn against storing sensitive information in such repositories; however, mistakes such as exposed access tokens and personal data files continue to occur.The stolen data varies from person to person but includes full names, birthdates, phone numbers, mailing and email addresses, Social Security numbers and driver's license numbers. LexisNexis has not confirmed whether it received any ransom demand or had further contact with the attacker. An individual working on their laptop (Kurt "CyberGuy" Knutsson)Why the LexisNexis hack is a bigger threat than you realizeLexisNexis isn’t a household name for most people, but it plays a major role in how personal data is harvested and used behind the scenes. The company pulls information from a wide range of sources, compiling detailed profiles that help other businesses assess risk and detect fraud. Its clients include banks, insurance companies and government agencies.In 2023, the New York Times reported that several car manufacturers had been sharing driving data with LexisNexis without notifying vehicle owners. That information was then sold to insurance companies, which used it to adjust premiums based on individual driving behavior. The story made one thing clear. LexisNexis has access to a staggering amount of personal detail, even from people who have never willingly engaged with the company.Law enforcement also uses LexisNexis tools to dig up information on suspects. These systems offer access to phone records, home addresses and other historical data. While such tools might assist in investigations, they also highlight a serious issue. When this much sensitive information is concentrated in one place, it becomes a single point of failure. And as the recent breach shows, that failure is no longer hypothetical. A hacker at work (Kurt "CyberGuy" Knutsson)7 expert tips to protect your personal data after a data broker breachKeeping your personal data safe online can feel overwhelming, but a few practical steps can make a big difference in protecting your privacy and reducing your digital footprint. Here are 7 effective ways to take control of your information and keep it out of the wrong hands:1. Remove your data from the internet: The most effective way to take control of your data and avoid data brokers from selling it is to opt for data removal services. While no service promises to remove all your data from the internet, having a removal service is great if you want to constantly monitor and automate the process of removing your information from hundreds of sites continuously over a longer period of time. Check out my top picks for data removal services here.Get a free scan to find out if your personal information is already out on the web.2. Review privacy settings: Take a few minutes to explore the privacy and security settings on the services you use. For example, limit who can see your social media posts, disable unnecessary location-sharing on your phone and consider turning off ad personalization on accounts like Google and Facebook. Most browsers let you block third-party cookies or clear tracking data. The FTC suggests comparing the privacy notices of different sites and apps and choosing ones that let you opt out of sharing when possible.3. Use privacy-friendly tools: Install browser extensions or plugins that block ads and trackers (such as uBlock Origin or Privacy Badger). You might switch to a more private search engine (like DuckDuckGo or Brave) that doesn’t log your queries. Consider using a browser’s "incognito" or private mode when you don’t want your history saved, and regularly clear your cookies and cache. Even small habits, like logging out of accounts when not in use or using a password manager, make you less trackable.GET FOX BUSINESS ON THE GO BY CLICKING HERE4. Beware of phishing links and use strong antivirus software: Scammers may try to get access to your financial details and other important data using phishing links. The best way to safeguard yourself from malicious links is to have antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe. Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices.5. Be cautious with personal data: Think twice before sharing extra details. Don’t fill out online surveys or quizzes that ask for personal or financial information unless you trust the source. Create separate email addresses for sign-ups (so marketing emails don’t go to your main inbox). Only download apps from official stores and check app permissions.6. Opt out of data broker lists: Many data brokers offer ways to opt out or delete your information, though it can be a tedious process. For example, there are sites like Privacy Rights Clearinghouse or the Whitepages opt-out page that list popular brokers and their opt-out procedures. The FTC’s consumer guide, "Your Guide to Protecting Your Privacy Online," includes tips on opting out of targeted ads and removing yourself from people-search databases. Keep in mind you may have to repeat this every few months.7. Be wary of mailbox communications: Bad actors may also try to scam you through snail mail. The data leak gives them access to your address. They may impersonate people or brands you know and use themes that require urgent attention, such as missed deliveries, account suspensions and security alerts.Kurt’s key takeawayFor many, the LexisNexis breach may be the first time they realize just how much of their data is in circulation. Unlike a social media platform or a bank, there is no clear customer relationship with a data broker, and that makes it harder to demand transparency. This incident should prompt serious discussion around what kind of oversight is necessary in industries that operate in the shadows. A more informed public and stronger regulation may be the only things standing between personal data and permanent exposure.CLICK HERE TO GET THE FOX NEWS APPShould companies be allowed to sell your personal information without your consent? Let us know by writing us atCyberguy.com/Contact.For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter.Ask Kurt a question or let us know what stories you'd like us to cover.Follow Kurt on his social channels:Answers to the most-asked CyberGuy questions:New from Kurt:Copyright 2025 CyberGuy.com. All rights reserved. Kurt "CyberGuy" Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on "FOX & Friends." Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

I don’t know why, but it continues to astonish me just how foolish politicians can be – and how easily persuaded they are by really bad advice from smart but tin-eared advisers. In less than a year, Keir Starmer and Rachel Reeves have squandered the gift of the huge majority won at last year’s General Election on one key issue after another: their response to the genocide in Gaza; wantonly cruel cuts in disability benefits; failing to find creative ways of taxing wealth; dealing with the water companies – and, now, on the new Planning and Infrastructure Bill. On 23 May 23, the Wildlife Trusts and the RSPB (with a combined membership of more than 2 million) launched a devastating attack on Labour’s whole approach to streamlining the planning system through the Planning and Infrastructure Bill.Advertisement Part 3 of the bill will make it possible for developers to ignore existing environmental protections by paying money into a so-called ‘Nature Recovery Fund’, which will be used to pay for environmental projects elsewhere. Starmer and Reeves have gone out of their way, time after time, to claim that it’s these environmental safeguards that are responsible for delays and blockages in the planning process, even though they know this is completely untrue. According to the Wildlife Trusts, roughly 3 per cent of proposals for new housing are delayed for environmental reasons. As The Guardian reported: ‘the data from analysis of 17,433 planning appeals in England in 2024 found that newts were relevant in just 140 (0.8%) planning appeals, and bats were relevant in 432 (2.48%).’ ‘They pursue this path even though are no polls to show that this is what matters to Labour voters tempted by Reform’ So what makes Starmer and Reeves both stupid and totally dishonest? By all accounts the rationale of their tin-eared advisers is to demonstrate to ‘Reform-friendly’ Labour voters that the environment is as unsafe in their hands as it would be in Nigel Farage’s. That economic growth is all that matters. That caring for the natural world is a middle-class self-indulgence (‘the well-to-do prioritising the nice-to-have’ over the interests of working people). And that pouring as much concrete as possible is self-evidently the best way of achieving that growth. And they go on pursuing this ideological path even though there are no supporting polls to show that this is what really matters to Labour voters tempted by Reform’s populist bullshit.Advertisement So they lie. They dig in. They break promises left, right and centre, ready to die, apparently, in this self-constructed ditch of developer-led deceit. That’s why every single amendment put forward through the committee examining the bill was summarily dismissed by the loyal but lumpen Labour MPs on the committee. These included an amendment tabled by veteran Labour MP Barry Gardiner requiring all house builders to provide a specially designed brick (costing £35) to help cavity-nesting such as swifts, house martins, sparrows and starlings – a measure that Labour in opposition enthusiastically supported! And there’s huge public support for this one small, cost-effective biodiversity regulation. To get a measure of this government’s subservient obedience to the demands of the volume housebuilders, just listen to the words of housing minister Matthew Pennycook: ‘We are not convinced that legislating to mandate the use of specific wildlife features is the right approach, whether that is done through building regulations or a freestanding legal requirement'. It’s all so demeaning. So unnecessary. And now that the mainstream environment movement, urged on primarily by the Wildlife Trusts, has realised just how high the stakes are with this Planning and Infrastructure Bill, it’s reasonable to assume that there will be a much more serious debate in the House of Lords, bringing down on ministers’ helmeted heads the righteous outrage of the entire movement. As we’ve learnt, in less than one deeply depressing year, this is a government that needs to be kicked harder and harder until they get desperate enough to make the pain go away. P.S. If you want to read a brilliant summary of ‘reasons to be outraged’ (and what to do about it), check out George Monbiot’s take on this. Jonathon Porritt is a campaigner and author and co-founder of Forum for the Future This article first appeared on his blog 2025-06-06 Jonathon Porritt comment and share

Cybersecurity researchers have flagged several popular Google Chrome extensions that have been found to transmit data in HTTP and hard-code secrets in their code, exposing users to privacy and security risks. "Several widely used extensions [...] unintentionally transmit sensitive data over simple HTTP," Yuanjing Guo, a security researcher in the Symantec's Security Technology and Response team, said. "By doing so, they expose browsing domains, machine IDs, operating system details, usage analytics, and even uninstall information, in plaintext." The fact that the network traffic is unencrypted also means that they are susceptible to adversary-in-the-middle (AitM) attacks, allowing malicious actors on the same network such as a public Wi-Fi to intercept and, even worse, modify this data, which could lead to far more serious consequences. The list of identified extensions are below - SEMRush Rank (extension ID: idbhoeaiokcojcgappfigpifhpkjgmab) and PI Rank (ID: ccgdboldgdlngcgfdolahmiilojmfndl), which call the URL "rank.trellian[.]com" over plain HTTP Browsec VPN (ID: omghfjlpggmjjaagoclmmobgdodcjboh), which uses HTTP to call an uninstall URL at "browsec-uninstall.s3-website.eu-central-1.amazonaws[.]com" when a user attempts to uninstall the extension MSN New Tab (ID: lklfbkdigihjaaeamncibechhgalldgl) and MSN Homepage, Bing Search & News (ID: midiombanaceofjhodpdibeppmnamfcj), which transmit a unique machine identifier and other details over HTTP to "g.ceipmsn[.]com" DualSafe Password Manager & Digital Vault (ID: lgbjhdkjmpgjgcbcdlhkokkckpjmedgc), which constructs an HTTP-based URL request to "stats.itopupdate[.]com" along with information about the extension version, user's browser language, and usage "type" "Although credentials or passwords do not appear to be leaked, the fact that a password manager uses unencrypted requests for telemetry erodes trust in its overall security posture," Guo said. Symantec said it also identified another set of extensions with API keys, secrets, and tokens directly embedded in the JavaScript code, which an attacker could weaponize to craft malicious requests and carry out various malicious actions - Online Security & Privacy extension (ID: gomekmidlodglbbmalcneegieacbdmki), AVG Online Security (ID: nbmoafcmbajniiapeidgficgifbfmjfo), Speed Dial [FVD] - New Tab Page, 3D, Sync (ID: llaficoajjainaijghjlofdfmbjpebpa), and SellerSprite - Amazon Research Tool (ID: lnbmbgocenenhhhdojdielgnmeflbnfb), which expose a hard-coded Google Analytics 4 (GA4) API secret that an attacker could use to bombard the GA4 endpoint and corrupt metrics Equatio – Math Made Digital (ID: hjngolefdpdnooamgdldlkjgmdcmcjnc), which embeds a Microsoft Azure API key used for speech recognition that an attacker could use to inflate the developer's costs or exhaust their usage limits Awesome Screen Recorder & Screenshot (ID: nlipoenfbbikpbjkfpfillcgkoblgpmj) and Scrolling Screenshot Tool & Screen Capture (ID: mfpiaehgjbbfednooihadalhehabhcjo), which expose the developer's Amazon Web Services (AWS) access key used to upload screenshots to the developer's S3 bucket Microsoft Editor – Spelling & Grammar Checker (ID: gpaiobkfhnonedkhhfjpmhdalgeoebfa), which exposes a telemetry key named "StatsApiKey" to log user data for analytics Antidote Connector (ID: lmbopdiikkamfphhgcckcjhojnokgfeo), which incorporates a third-party library called InboxSDK that contains hard-coded credentials, including API keys. Watch2Gether (ID: cimpffimgeipdhnhjohpbehjkcdpjolg), which exposes a Tenor GIF search API key Trust Wallet (ID: egjidjbpglichdcondbcbdnbeeppgdph), which exposes an API key associated with the Ramp Network, a Web3 platform that offers wallet developers a way to let users buy or sell crypto directly from the app TravelArrow – Your Virtual Travel Agent (ID: coplmfnphahpcknbchcehdikbdieognn), which exposes a geolocation API key when making queries to "ip-api[.]com" Attackers who end up finding these keys could weaponize them to drive up API costs, host illegal content, send spoofed telemetry data, and mimic cryptocurrency transaction orders, some of which could see the developer's ban getting banned. Adding to the concern, Antidote Connector is just one of over 90 extensions that use InboxSDK, meaning the other extensions are susceptible to the same problem. The names of the other extensions were not disclosed by Symantec. "From GA4 analytics secrets to Azure speech keys, and from AWS S3 credentials to Google-specific tokens, each of these snippets demonstrates how a few lines of code can jeopardize an entire service," Guo said. "The solution: never store sensitive credentials on the client side." Developers are recommended to switch to HTTPS whenever they send or receive data, store credentials securely in a backend server using a credentials management service, and regularly rotate secrets to further minimize risk. The findings show how even popular extensions with hundreds of thousands of installations can suffer from trivial misconfigurations and security blunders like hard-coded credentials, leaving users' data at risk. "Users of these extensions should consider removing them until the developers address the insecure [HTTP] calls," the company said. "The risk is not just theoretical; unencrypted traffic is simple to capture, and the data can be used for profiling, phishing, or other targeted attacks." "The overarching lesson is that a large install base or a well-known brand does not necessarily ensure best practices around encryption. Extensions should be scrutinized for the protocols they use and the data they share, to ensure users' information remains truly safe." Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.