1
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 52 posts.
2
"Pwned Passwords" V2 With Half a Billion Passwords
Last August, I launched a little feature within Have I Been Pwned [https://haveibeenpwned.com/] (HIBP) I called Pwned Passwords [https://www.troyhunt.com/introducing-306-million-freely-downloadable-pwned-passwords/]. This was a list of 320 million passwords from a range of different data breaches which organisations…
3
Why Static Websites Need HTTPS
It was Jan last year that I suggested HTTPS adoption had passed the "tipping point" [https://www.troyhunt.com/https-adoption-has-reached-the-tipping-point/], that is, it had passed the moment of critical mass [https://en.wikipedia.org/wiki/The_Tipping_Point] and as I said at the
4
5
Google: Security Keys Neutralized Employee Phishing
Google has not had any of its 85,000+ employees successfully phished on their work-related accounts since early 2017, when it began requiring all employees to use physical Security Keys in place of passwords and one-time codes, the company told KrebsOnSecurity.
6
7
We're Baking ‘Have I Been Pwned’ into Firefox and 1Password
Pretty much every day, I get a reminder from someone about how little people know about their exposure in data breaches. Often, it's after someone has searched Have I Been Pwned [https://haveibeenpwned.com/] (HIBP) and found themselves pwned somewhere or other. Frequently, it's some long-forgotten site
8
Serious Intel CPU bugs (2016)
2015 was a pretty good year for Intel. Their quarterly earnings reports exceeded expectations every quarter. They continue to be the only game in town for the serious server market, which continues to grow exponentially; from the earnings reports of the two largest cloud vendors, we can see that AWS and Azure grew by…
9
10
Let’s talk about PAKE
The first rule of PAKE is: nobody ever wants to talk about PAKE. The second rule of PAKE is that this is a shame, because PAKE — which stands for Password Authenticated Key Exchange — is actually o…
11
Tracking Firm LocationSmart Leaked Location Data for Customers of All Major U.S. Mobile Carriers Without Consent in Real Time Via Its Web Site
LocationSmart , a U.S. based company that acts as an aggregator of real-time data about the precise location of mobile phone devices, has been leaking this information to anyone via a buggy component of its Web site — without the need for any password or other form of authentication or authorization — KrebsOnSecurity…
12
13
14
15
“Stylish” browser extension steals all your internet history
Before it became a covert surveillance tool disguised as an outstanding browser extension, Stylish really was an outstanding browser extension. It bestowed upon its users nothing less than the power to change the appearance of the internet. Its extensive bank of user-made skins gave bright websites a dark background…
16
GDPR: Don't Panic
In another week the GDPR , or the General Data Protection Regulation will become enforceable and it appears that unlike any other law to date this particular one has the interesting side effect of causing mass hysteria in the otherwise rational tech sector.
17
GDPR – A Practical Guide for Developers (2017)
You’ve probably heard about GDPR. The new European data protection regulation that applies practically to everyone. Especially if you are working in a big company, it’s most likely that there’sContinue reading
18
Vectorized Emulation: fuzzing at 2 trillion instructions per second
This is the introduction of a multipart series. It is to give a high level overview without really deeply diving into any individual component.
19
About rel=noopener (2016)
2021 update: Browsers now implicitly set rel=noopener for any target=_blank link, following a spec change . If the demo on this page no longer seems scary, congratulations — you’re using a modern browser!
20
So Your Startup Received the Nightmare GDPR Letter
Some dumb lawyer figured it would be fun to give GDPR trolls a form letter to use to inflict maximum damage on unsuspecting companies. The reason why this is dumb is simple: the GDPR serves a legitimate need but by decreasing the signal:noise ratio handcrafted requests from users with a legitimate concern can get…
21
7-Zip: Multiple Memory Corruptions via RAR and ZIP
Blog about anti-virus software vulnerabilities.
22
OAuth for the Open Web
OAuth has become the de facto standard for authorization and authentication on the web. Nearly every company with an API used by third party developers has implemented OAuth to enable people to build apps on top of it.
23
Who and what is Coinhive?
Multiple security firms recently identified cryptocurrency mining service Coinhive as the top malicious threat to Web users, thanks to the tendency for Coinhive’s computer code to be used on hacked Web sites to steal the processing power of its visitors’ devices. This post looks at how Coinhive vaulted to the top of…
24
25
Extended Validation Certificates Are Dead
That's it - I'm calling it - extended validation certificates are dead. Sure, you can still buy them (and there are companies out there that would just love to sell them to you!), but their usefulness has now descended from "barely there" to "as good as non-existent". This change
26
27
Audio Adversarial Examples
Figure from our paper: given any waveform, we can modify it slightly to produce another (similar) waveform that transcribes as any different target phrase.
28
Making art with SSH key randomart
SSH is everywhere in the development or operations world now. For development it’s what allows you to push to GitHub. For operations it’s what allows you to reasonably securely log into Linux servers.
29
Why I’m done with Chrome
This blog is mainly reserved for cryptography, and I try to avoid filling it with random “someone is wrong on the Internet” posts. After all, that’s what Twitter is for! But from …
30
LocationSmart Leaked Location Data for All Major U.S. Carriers in Real Time
On May 16th, I found a vulnerability in the LocationSmart website which allowed anyone, with no prior authentication or consent, to obtain the realtime location of any cellphone in the US to within…