Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 684 posts.
Complex software is, to put it mildly, hard to get right (for details, see almost any other posting on this or any other security blog). Especially for gadgets that are rich with microphones, cameras, location and environmental sensors, and communication links (such as, you know, smartphones), errors and security…
Many people will land on this page after learning that their email address has appeared in a data breach I've called "Collection #1". Most of them won't have a tech background or be familiar with the concept of credential stuffing so I'm going to write this post
On Friday January 21, 2022 I received this email. I tweeted about it and it took off like crazy. The email comes from a fortune-500 multi-billion dollar company that apparently might be using a product that contains my code, or maybe they have customers who do. Who knows? My guess is that they do this … Continue…
We recently switched Google's two billion line repository over to BoringSSL , our fork of OpenSSL . This means that BoringSSL is now powering Chromium (on nearly all platforms), Android M and Google's production services. For the first time, the majority of Google's products are sharing a single TLS stack and making…
Someone recently noticed a Washington Post story on the TSA that originally contained a detailed photograph of all the TSA master keys. It’s now blurred out of the Washington Post story, but the image is still floating around the Internet. The whole thing neatly illustrates one of the main problems with backdoors…
Welcome to acronym city! The Court of Appeal of Brussels has made an interesting ruling. A customer complained that their bank was spelling the customer's name incorrectly. The bank didn't have support for diacritical marks. Things like á, è, ô, ü, ç etc. Those accents are common in many languages. So it was a little…
Obligatory Disclaimer: Personal or political views presented within this post absolutely do not reflect those of my employer(s), client(s), and/or legal counsel.
How to obtain encryption keys to decrypt the LastPass vault in different scenarios
Where the pipe-dream of Bitcoin’s real-world fungibility goes to die.
You may have read at NYMag that I’ve been in discussions with the Clinton campaign about whether it might wish to seek recounts in critical…
Sources tell KrebsOnSecurity that Microsoft Corp. is slated to release a software update on Tuesday to fix an extraordinarily serious security vulnerability in a core cryptographic component present in all versions of Windows . Those sources say Microsoft has quietly shipped a patch for the bug to branches of the U.S…
Telegram, the encrypted messaging app loved by terrorists, has been in the news lately. Terrorists have long used existing commercial and…
Security is both very important and often under-emphasized. While many targeted techniques help, there are some basic clean code habits which every developer can and should be doing
GPT4-V is the new mode of GPT-4 that allows you to upload images as part of your conversations. It’s absolutely brilliant. It also provides a whole new set of vectors …
Updated August 4, 2019: Added link to “A.C.L.U. Says F.B.I. Funded ‘Army’ To Terrorize Young War Dissidents” The unsealing of an application for a search warrant by the federal governme…
Since there haven't been any major public announcements regarding PS4 hacking for a long time now, I wanted to explain a bit about how far PS4 hacking has come, and what is preventing further progression.
Riley Goodside, yesterday: Exploiting GPT-3 prompts with malicious inputs that order the model to ignore its previous directions. pic.twitter.com/I0NVr9LOJq- Riley Goodside (@goodside) September 12, 2022 Riley provided several examples. Here’s …
Ever since the Intercept published this story about the US government’s Terrorist Screening Database, the press has been writing about a “second leaker”: The Intercept article focuses on the growth in U.S. government databases of known or suspected terrorist names during the Obama administration. The article cites…
You could always sign Git commits with a GPG key, but now your SSH key is just as powerful!
Ed25519 signature validation criteria vary widely between implementations, creating risks for consensus systems. Here's why and how to fix it.
So you want to roll your own crypto. Well, be careful. Be very careful.
That's it - I'm calling it - extended validation certificates are dead. Sure, you can still buy them (and there are companies out there that would just love to sell them to you!), but their usefulness has now descended from "barely there" to "as good as non-existent". This change
This is my personal blog. The views expressed on this page are mine alone. Update, April 8, 2013: Can you hear it? Take the watermark listening test. Update, January 14, 2015: Check out the results of the listening test. A while ago, I wrote about my confusion regarding Weird Spotify Compression Artifacts. It turns…
