181
Can Apple read your iMessages?
About a year ago I wrote a short post urging Apple to publish the technical details of iMessage encryption. I’d love tell you that Apple saw my influential crypto blogging and fell all over t…
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 684 posts.
182
Brave New Trusted Boot World
Posts and writings by Lennart Poettering
183
The first serious infowar is now engaged
by John Perry Barlow Governments of the Industrial World, you weary giants of flesh and steel, I come from Cyberspace, the new home of Mind. On behalf of the future, I ask you of the past to leave us alone. You are not welcome among us. You have no sovereignty where we gather.We have no elected...
184
185
Excess Automobile Deaths as a Result of 9/11
People commented about a point I made in a recent essay: In the months after 9/11, so many people chose to drive instead of fly that the resulting deaths dwarfed the deaths from the terrorist attack itself, because cars are much more dangerous than airplanes. Yes, that’s wrong. Where I said “months,” I should have…
186
How to design an elliptic-curve signature system
Earlier this month a new paper by Naomi Benger, Joop van de Pol, Nigel Smart, and Yuval Yarom hit the news . The paper explains how to recover secret keys from OpenSSL's implementation of ECDSA-secp256k1 using timing information from "as little as 200 signatures"; ECDSA-secp256k1 is the signature system used by…
187
The Apple goto fail vulnerability: lessons learned (2014)
Description of what we have learned
188
GPG and Me (2015)
I receive a fair amount of email from strangers. My email address is public, which doesn’t seemto be a popular choice these days, but I’ve received enough inspiring correspondence over the yearsto leave it be.When I receive a GPG encrypted email from a stranger, though, I immediately get the fee...
189
190
Taking control of all .io domains with a targeted registration
A Hacker's Blog of Unintended Use and Insomnia.
191
NSA, NIST, and post-quantum crypto: my second lawsuit against the US government
The Black Chamber was founded by the U.S. Army and the U.S. State Department in 1919. The Secretary of State terminated funding in 1929, famously writing that "Gentlemen do not read each other's mail."
192
Passkeys: A shattered dream
Firstyear's blog
193
GDPR: Don't Panic
In another week the GDPR , or the General Data Protection Regulation will become enforceable and it appears that unlike any other law to date this particular one has the interesting side effect of causing mass hysteria in the otherwise rational tech sector.
194
I'm giving up on PGP
After years of wrestling GnuPG with varying levels of enthusiasm, I came to the conclusion that it’s just not worth it, and I’m giving up. At least on the concept of long term PGP keys.
195
I've locked myself out of my digital life
Imagine… Last night, lightning struck our house and burned it down. I escaped wearing only my nightclothes. In an instant, everything was vaporised. Laptop? Cinders. Phone? Ashes. Home server? A smouldering wreck. Yubikey? A charred chunk of gristle. This presents something of a problem. In order to recover my digital…
196
197
Get your loved ones off Facebook
I originally wrote this for my friends and family in 2015, to explain why the latest Facebook privacy policy is really harmful. It’s since been read b
198
Endlessh: An SSH Tarpit
This article was discussed on Hacker News ( later ), on reddit ( also ), featured in BSD Now 294 . Also check out this Endlessh analysis .
199
A cryptography engineer's perspective on quantum computing timelines
The risk that cryptographically-relevant quantum computers materialize within the next few years is now high enough to be dispositive, unfortunately.
200
A better zip bomb
This article shows how to construct a non-recursive zip bomb that achieves a high compression ratio by overlapping files inside the zip container. "Non-recursive" means that it does not rely on a decompressor's recursively unpacking zip files nested within zip files: it expands fully after a single round of…
201
How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security
How Chrome OS, Termux, YubiKey & Duo Mobile make for great usable security. A travel Chromebook for modern development, online and offline.
202
Mitigating the Hetzner/Linode XMPP.ru MitM interception incident
(If you just want some recommendations for what to do, skip down to the Recommendations section below .)
203
Schneier's response to Eric Schmidt
Schmidt said: I think judgment matters. If you have something that you don’t want anyone to know, maybe you shouldn’t be doing it in the first place. If you really need that kind of privacy, the reality is that search engines—including Google—do retain this information for some time and it’s important, for example…
204
The .ly domain space to be considered unsafe
I would like to warn current and future owners of .ly domains of a concerning incident regarding the deletion of one of our prime domains…
205
A Bug in Early Creative Commons Licenses Has Enabled Copyleft Trolls (2022)
Copyleft trolls, robosigning, and Pixsy.
206
Beg Bounties
When someone passed me hundreds of thousands of records on kids taken from CloudPets a few years ago [https://www.troyhunt.com/data-from-connected-cloudpets-teddy-bears-leaked-and-ransomed-exposing-kids-voice-messages/] , I had a nightmare of a time getting in touch with the company. They'd
207
XZ Backdoor: Times, damned times, and scams
Some timezone observations on the recently discovered backdoor hidden in an xz tarball.
208
South Korea’s online security dead end
Websites in South Korea often require installation of “security applications.” Not only do these mandatory applications not help security, way too often they introduce issues.
209
210
