631
HTTPS on Stack Overflow: The End of a Long Road
Today, we deployed HTTPS by default on Stack Overflow. All traffic is now redirected to https:// and Google links will change over the next few weeks. The ac...
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 1,584 posts.
632
How to Compromise the Enterprise Endpoint
Posted by Tavis Ormandy.Symantec is a popular vendor in the enterprise security market, their fla...
633
72% of smart TVs and 46% of game consoles hardcode DNS settings
Welcome Hacker News readers!• Thank you to M. Hammad Mazhar for his research that inspired this guide.• @healyio made some great additional suggestions in th...
634
Xz/liblzma: Bash-stage Obfuscation Explained
Yesterday Andres Freund emailed oss-security@ informing the community of the discovery of a backdoor in xz/liblzma, which affected OpenSSH server (huge respect for noticing and investigating this). Andres' email is an amazing summary of the whole drama, so I'll skip that. While admittedly most juicy and interesting…
635
636
NIST’s new password rules – what you need to know
The Sophos Blog
637
Auditing GitHub users’ SSH key quality
If you have just/as of late gotten an email about your keys being revoked, this is because of me, and if you have, you should really go through and make sure that no one has done anything terrible to you, since you have opened yourself to people doing very mean things to you for what is most likely a very long time.
638
How to Safely Store Your Users' Passwords in 2016
Salted Password Hashing with Argon2, Scrypt, Bcrypt, and PBKDF2
639
Looking back at how Signal works
In the midst of world-wide protests against racism and police brutality, a lot of people are becoming more immediately aware and concerned about the security of their data and online communication. We’ve gotten a lot of questions at Signal over the past week, so we wanted to briefly recap how it ...
640
Attacking UNIX Systems via CUPS
Hello friends, this is the first of two, possibly three (if and when I have time to finish the Windows research) writeups. We will start with targeting GNU/Lin…
641
Third High Severity CVE in Log4j Is Published
The Logging Services Security Team takes security seriously. This allows our users to place their trust in Log4j for protecting their mission-critical data. On this page, we will help you find guidance on security-related issues and access to known vulnerabilities.
642
643
The Fully Remote Attack Surface of the iPhone
Posted by Natalie Silvanovich, Project ZeroWhile there have been several rumours and reports of f...
644
Dangerous domain corp.com goes up for sale
As an early domain name investor, Mike O’Connor had by 1994 snatched up several choice online destinations, including bar.com, cafes.com, grill.com, place.com, pub.com and television.com. Some he sold over the years, but for the past 26 years O’Connor refused to auction perhaps the most sensitive domain in his stable…
645
What Spectre and Meltdown Mean for WebKit
Security researchers have recently uncovered security issues known as Meltdown and Spectre.
646
Dark Patterns at Scale: Findings from a Crawl of 11K Shopping Websites (2019)
Dark patterns are user interface design choices that benefit an online service by coercing, steering, or deceiving users into making unintended and potentially harmful decisions. We conducted a large-scale study, analyzing ~53K product pages from ~11K shopping websites to characterize and quantify the prevalence of…
647
Disrupting the first reported AI-orchestrated cyber espionage campaign
A report describing a highly sophisticated AI-led cyberattack and how we disrupted it.
648
Breaking open the Mt. Gox case, part 1
The official blog of WizSec, a group of bitcoin security specialists, and their investigation into MtGox.
649
650
Best of show – abuse of libc
printf machine. 2020 IOCCC entry carlini - Best of Show - abuse of libc
651
V8: A Year with Spectre
The V8 team details their analysis and mitigation strategy for Spectre, one of the top computer security issues of 2018.
652
Authenticated Boot and Disk Encryption on Linux
Posts and writings by Lennart Poettering
653
Air Gaps
Since I started working with Snowden’s documents, I have been using a number of tools to try to stay secure from the NSA. The advice I shared included using Tor, preferring certain cryptography over others, and using public-domain encryption wherever possible. I also recommended using an air gap, which physically…
654
655
Police search homes of Zwiebelfreunde board members and OpenLab in Augsburg
On June 20th, board members of the „Zwiebelfreunde“ association in multiple German cities had their homes searched under the dubious pretence that they were „witnesses“ while their computers and...
656
657
LibreSSL: More Than 30 Days Later
LibreSSL was officially announced to the world just about exactly five months ago. Bob spoke at BSDCan about the first 30 days. For those who weren't there, I'll quickly rehash some of that material. Also, it's always best to start at the beginning, but then I'll try to focus on some new material and updates.
658
Open Whisper Systems Partners with Google on End-To-end Encryption for Allo
At Open Whisper Systems, our goal is to make private communication simple. The foundation of our technology is Signal Protocol, a modern, open source, strong encryption protocol for asynchronous messaging systems. It is built from the ground up to make seamless end-to-end encrypted messaging poss...
659
Postmortem for Malicious Packages Published on July 12th, 2018
A pluggable and configurable linter tool for identifying and reporting on patterns in JavaScript. Maintain your code quality with ease.
660
Swift Homomorphic Encryption
We’re excited to announce a new open source Swift package for homomorphic encryption in Swift: swift-homomorphic-encryption.