361
Don't use bcrypt
(Edit: Some numbers for you people who like numbers) If you're already using bcrypt, relax, you're fine, probably. However, if you're ...
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 684 posts.
362
363
Me on Covid-19 contact tracing apps
I was quoted in BuzzFeed: “My problem with contact tracing apps is that they have absolutely no value,” Bruce Schneier, a privacy expert and fellow at the Berkman Klein Center for Internet & Society at Harvard University, told BuzzFeed News. “I’m not even talking about the privacy concerns, I mean the efficacy. Does…
364
Sexual Harassment at DefCon (and Other Hacker Cons)
Excellent blog post by Valerie Aurora about sexual harassment at the DefCon hackers conference. Aside from the fact that this is utterly reprehensible behavior by the perpetrators involved, this is a real problem for our community. The response of “this is just what hacker culture is, and changing it will destroy…
365
Privacy Protects Bothersome People (2013)
We need to support privacy, not for those of us who have "nothing to hide", but for bothersome people like investigative journalists and activists, without which our democracy would crumble
366
Is Extended Random a Malicious NSA Plot?
Dual_EC was almost certainly an NSA backdoor. Extended Random is the TLS extension that would have made it practical to exploit. Did NSA plant that one too? A look at the evidence.
367
368
369
Unlocking LUKS2 Volumes with TPM2, FIDO2, PKCS#11 Security HW on Systemd 248
Posts and writings by Lennart Poettering
370
How AI text watermarking works
A gentle visual guide to how a statistical mark hides inside generated text, and what erases it.
371
372
Mail from the (Velvet) Cybercrime Underground
Over the past six months, “fans” of this Web site and its author have shown their affection in some curious ways. One called in a phony hostage situation that resulted in a dozen heavily armed police surrounding my home . Another opened a $20,000 new line of credit in my name. Others sent more than $1,000 in bogus…
373
TikTok: Logs, Logs, Logs
We are in 2020 and the US president is about to ban TikTok, a video-sharing social network mobile app, because “it poses a risk to US…
374
How 4chan hacked ReCAPTCHA to win the TIME 100 Poll
This morning Time.com published the final result for their annual TIME 100 Poll. Time reports that the new owner of the title ‘Worlds’s most influential person, is moot’. What T…
375
Audio Adversarial Examples
Figure from our paper: given any waveform, we can modify it slightly to produce another (similar) waveform that transcribes as any different target phrase.
376
A Sneaky Phish Just Grabbed My Mailchimp Mailing List
You know when you're really jet lagged and really tired and the cogs in your head are just moving that little bit too slow? That's me right now, and the penny has just dropped that a Mailchimp phish has grabbed my credentials, logged into my account and exported
377
Making art with SSH key randomart
SSH is everywhere in the development or operations world now. For development it’s what allows you to push to GitHub. For operations it’s what allows you to reasonably securely log into Linux servers.
378
A Unikernel Firewall for QubesOS
QubesOS provides a desktop operating system made up of multiple virtual machines, running under Xen. To protect against buggy network drivers, the …
379
TLS Symmetric Crypto
At this time last year, the TLS world was mostly running on RC4-SHA and AES-CBC. The Lucky 13 attack against CBC in TLS had just been published and I had spent most of January writing patches for OpenSSL and NSS to implement constant-time CBC decoding. The RC4 biases paper is still a couple of week away, but it's…
380
Nate Lawson Breaks Google Keyczar's HMAC Crypto Signatures
I recently found a security flaw in the Google Keyczar crypto library. The impact was that an attacker could forge signatures for data that was “signed” with the SHA-1 HMAC algorithm (t…
381
Why I’m done with Chrome
This blog is mainly reserved for cryptography, and I try to avoid filling it with random “someone is wrong on the Internet” posts. After all, that’s what Twitter is for! But from …
382
Everyone knows your location: tracking myself down through in-app ads
How I tracked myself down using leaked location data in the in-app ads, and what I found along the way.
383
Thanks FedEx, this is why we keep getting phished
I've been getting a lot of those "your parcel couldn't be delivered" phishing attacks lately and if you're a human with a phone, you probably have been too. Just as a brief reminder, they look like this: These get through all the technical controls that exist at
384
The Dropbox hack is real
Earlier today, Motherboard reported on what had been rumoured for some time, namely that Dropbox had been hacked [http://motherboard.vice.com/read/hackers-stole-over-60-million-dropbox-accounts] . Not just a little bit hacked and not in that "someone has cobbled together a list of credentials that work
385
LocationSmart Leaked Location Data for All Major U.S. Carriers in Real Time
On May 16th, I found a vulnerability in the LocationSmart website which allowed anyone, with no prior authentication or consent, to obtain the realtime location of any cellphone in the US to within…
386
I use zip bombs to protect my server
The majority of the traffic on the web is from bots. For the most part, these bots are used to discover new content. These are RSS Feed readers, search engines crawling your content, or nowadays AI bo
387
How to own an airline in 3 easy steps and grab the TSA nofly list along the way
and grab the TSA nofly list along the way
388
I Had My Electronics Seized by U.S. Customs and Border Protection
After my trip in Hamburg, Germany, for the 33rd Chaos Communication Congress, I left Germany for t
389
Avoid Non-Microsoft Antivirus Software
Robert O'Callahan. Christian. Kiwi. Software guy. All content human-authored unless otherwise noted.
390