1
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 41 posts.
2
The Line of Death
When building applications that display untrusted content, security designers have a major problem— if an attacker has full control of a block of pixels, he can make those pixels look like anything…
3
The qmail security guarantee
Of course, ``security hole in qmail'' does not include problems outside of qmail: for example, NFS security problems, TCP/IP security problems, DNS security problems, bugs in scripts run from .forward files, and operating system bugs generally. It's silly to blame a problem on qmail if the system was already…
4
Cryptographic vulnerabilities in IOTA
Last month, Ethan Heilman, Tadge Dryja, Madars Virza, and I took a look at IOTA, currently the 8th largest cryptocurrency with a $1.9B…
5
Cypherpunk Desert Bus: My Role in the 2016 Zcash Trusted Setup Ceremony
Update: taking this down for now until some questions about the deterministicbuilds are answered; currently I do not believe the Zcash trusted setup shouldbe...
6
How The Intercept Outed Reality Winner
Today, The Intercept released documents on election tampering from an NSA leaker. Later, the arrest warrant request for an NSA contractor ...
7
Phishing with Unicode Domains
Vulnerability in Chrome, Firefox, and Opera makes users susceptible to phishing with Unicode domains
8
Suicide Linux
You know how sometimes if you mistype a filename in Bash, it corrects your spelling and runs the command anyway?* Such as when changing directory, or opening a file. I have an idea: Suicide Linux. Any time - any time - you type any remotely incorrect command, the interpreter cr...
9
10
Taking control of all .io domains with a targeted registration
A Hacker's Blog of Unintended Use and Insomnia.
11
Get your loved ones off Facebook
I originally wrote this for my friends and family in 2015, to explain why the latest Facebook privacy policy is really harmful. It’s since been read b
12
How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security
How Chrome OS, Termux, YubiKey & Duo Mobile make for great usable security. A travel Chromebook for modern development, online and offline.
13
On the Perceived Value of EV Certs, Commercial CAs, Phishing and Let's Encrypt
Last week I wrote about how Life Is About to Get a Whole Lot Harder for Websites Without HTTPS [https://www.troyhunt.com/life-is-about-to-get-harder-for-websites-without-https/]. Somewhere in the comments there, the discussion went off on a tangent about commercial CAs, the threat
14
Who is Anna-Senpai, the Mirai Worm Author?
On September 22, 2016, this site was forced offline for nearly four days after it was hit with “ Mirai ,” a malware strain that enslaves poorly secured Internet of Things (IoT) devices like wireless routers and security cameras into a botnet for use in large cyberattacks. Roughly a week after that assault, the…
15
16
17
Dangers of CSV Injection
I’ve been doing the local usergroup circuit with this lately and have been asked to write it up.
18
HTTPS on Stack Overflow: The End of a Long Road
Today, we deployed HTTPS by default on Stack Overflow. All traffic is now redirected to https:// and Google links will change over the next few weeks. The ac...
19
20
Restic Cryptography
tl;dr: this is not an audit and I take no responsibility for your backups, but I had a quick look at the crypto and I think I’m going to use restic for my personal backups.
21
US telcos appear to be selling non-anonymized access to consumer telephone data
https://bit.ly/crazymobiledemo
22
23
I Had My Electronics Seized by U.S. Customs and Border Protection
After my trip in Hamburg, Germany, for the 33rd Chaos Communication Congress, I left Germany for t
24
Avoid Non-Microsoft Antivirus Software
Robert O'Callahan. Christian. Kiwi. Software guy. All content human-authored unless otherwise noted.
25
Call of Duty gaming community points to ‘swatting’ in Wichita police shooting
A 28-year-old Kansas man was shot and killed by police officers on the evening of Dec. 28 after someone fraudulently reported a hostage situation ongoing at his home. The false report was the latest in a dangerous hoax known as “ swatting ,” wherein the perpetrator falsely reports a dangerous situation at an address…
26
Falling through the KRACKs
The big news in crypto today is the KRACK attack on WPA2 protected WiFi networks. Discovered by Mathy Vanhoef and Frank Piessens at KU Leuven, KRACK (Key Reinstallation Attack) leverages a vulnerab…
27
Equifax Breach Fallout: Your Salary History
In May, KrebsOnSecurity broke a story about lax security at a payroll division of big-three credit bureau Equifax that let identity thieves access personal and financial data on an unknown number of Americans. Incredibly, this same division makes it simple to access detailed salary and employment history on a large…
28
Testing FIDO U2F security keys
Last time I reviewed various security keys at a fairly superficial level: basic function, physical characteristics etc. This post considers lower-level behaviour.
29
I cannot consistently write safe C/C++ code
Robert O'Callahan. Christian. Kiwi. Software guy. All content human-authored unless otherwise noted.
30
I'm giving up on HPKP
HTTP Public Key Pinning is a very powerful standard that allows a host to instruct a browser to only accept certain public keys when communicating with it for a given period of time. Whilst HPKP can offer a lot of protection, it can also cause a lot of harm too.