Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 684 posts.
On Aug. 16, two men were escorted off a plane headed for Manchester, England, because some passengers thought they looked either Asian or Middle Eastern, might have been talking Arabic, wore leather jackets, and looked at their watches—and the passengers refused to fly with them on board. The men were questioned for…
Anthropic's Claude Desktop silently installs a Native Messaging bridge into seven Chromium browsers, including browsers Anthropic's own documentation says it does not support, and browsers the user has not even installed.
Introduction In a previous post , I introduced a Twitter bot called dumpmon which monitors paste sites for account dumps, configuration fi...
This article documents Hacking Team’s third-party acquisition of zero-day (0day) vulnerabilities and exploits. The recent compromise of Hacking Team’s email archive offers one of the first public case studies of the market for 0days. Because of its secretive nature, this market has been the source of endless debates…
I think turning everyday gadgets into bombs is a bad idea. However, recent news coverage has been framing the weaponization of pagers and radios in the Middle East as something we do not need to concern ourselves with because “we” are safe.
How to turn 256 bits of entropy into a beautiful, avatar-friendly circular SVG: the Hashvatar.
For as long as I remember, HTTP cookies have been vilified as a grave threat to the privacy of online browsing. I don't quite agree, but I f...
Hidden img and script tags with onload and onerror let any site tell if you're logged into GMail, Facebook, Twitter or Digg. Google called it expected.
No matter how much anyone tries to sugar coat it, a service like Have I been pwned [https://haveibeenpwned.com/] (HIBP) which deals with billions of records hacked out of other peoples' systems is always going to sit in a grey area. There are degrees, of course; at one end
At this summer's HOPE conference, Joshua Aaron spoke about ICEBlock, his iPhone app that allows users to anonymously report ICE sightings within a 5 mile radius, and to get notifications when others report ICE sightings near them. You can see the full talk, and the lively/infuriating Q&A,
Encrypting files with passkeys, using the WebAuthn prf extension and the TypeScript age implementation.
An Analysis of Anonymity in the Bitcoin System2011135 points53 commentscited by 3Crypto & Blockchain details
TL;DR Bitcoin is not inherently anonymous. It may be possible to conduct transactions is such a way so as to obscure your identity, but, ...
By making a minor concession EU governments hope to find a majority next week to approve the controversial „chat control“ bill. According to the proposed child sexual abuse regulation (CSAR), providers of messengers, e-mail and chat services would be forced to automatically search all private messag
The 1600 LoC patch allows userspace to pass the kernel the encryption keys for an established connection, making encryption happen transparently inside the kernel.
A 18-year-old Tennessee man who helped set in motion a fraudulent distress call to police that led to the death of a 60-year-old grandfather in 2020 was sentenced to 60 months in prison today.
Two interesting things in formally verified software happened recently. The big one was the release of SeL4 - a formally verified L4 microkernel. The second was much smaller, but closer to my usual scope: a paper which showed the correctness of sections of a couple of the assembly implementations of Curve25519.
I gave a talk a couple of weeks ago at the Yahoo Unconference . The conference was at the end of a particually hard week for a bunch of reasons and I fear that the talk wasn't that great. (Afterwards I got home about 3pm and pretty much slept until the following morning.) This post is a, hopefully clearer…
Survival in an Extremely Adversarial Environment If your secure communications platform isn’t being used by terrorists and pedophiles, you&# …
I have been seeing this paper by cryptographer Peter Schnorr making the rounds: “Fast Factoring Integers by SVP Algorithms.” It describes a new factoring method, and its abstract ends with the provocative sentence: “This destroys the RSA cryptosystem.” It does not. At best, it’s an improvement in factoring—and I’m not…
I screwed up. Big time. Not just with Adblock Plus users but with the Mozilla community at large.
Nowadays, there is an epidemic of web applications purporting to offer “end-to-end” encryption. Examples might range from a file upload service, which allows you to upload and share files of arbitrary size and promises “end-to-end encryption”; or a web-based password safe service which claims that it can't see your…
As the New York Times posts yet another breathless story about Stuxnet, I’m surprised that no one has pointed out its obvious deficiencies. Everyone seems to be hyperventilating about its pur…
Security protocols often assume an accurate, local clock (e.g. TLS, Kerberos, DNSSEC and more). It's a widely accepted assumption when designing protocols but, for a lot of people, it just isn't true. We find good evidence that at least 25% of all certificate errors in Chrome are due to a bad local clock.
a guided introduction for first-timers
A lot of people use VPN every day. Somebody use it in always-on mode to circumvent government or corporative internet censorship, while…
