691
Hacking Starbucks for unlimited coffee
We do penetration testing, source code auditing and vulnerability assessments
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 1,584 posts.
692
Ways we harden our KVM hypervisor at Google Cloud: Security in plaintext
Google Cloud uses the open-source KVM hypervisor that has been validated by scores of researchers as the foundation of Google Compute Engine and Google Container Engine , and invests in additional security hardening and protection based on our research and testing experience. Then we contribute back our changes to the…
693
No boundaries: Exfiltration of personal data by session-replay scripts
This is the first post in our “No Boundaries” series, in which we reveal how third-party scripts on websites have been extracting personal information in increasingly intrusive ways. [0] by Steven Englehardt, Gunes Acar, and Arvind Narayanan Update: we’ve released our data — the list of sites with session-replay…
694
Apple Has Begun Scanning Your Local Image Files Without Consent
Preface: I don’t use iCloud. I don’t use an Apple ID. I don’t use the Mac App Store. I don’t store photos in the macOS “Photos” application, even locally. I…
695
Post-mortem and remediations for the Matrix.org security breach
Matrix, the open protocol for secure decentralised communications
696
Did NSA Put a Secret Backdoor in New Encryption Standard? (2007)
Random numbers are critical for cryptography: for encryption keys, random authentication challenges, initialization vectors, nonces, key-agreement schemes, generating prime numbers and so on. Break the random-number generator, and most of the time you break the entire security system. Which is why you should worry…
697
It’s time to stop using SMS for security
By now most infosec professionals are aware of various ways SMS text messaging can be hijacked. For example so-called “SIM Swap” attacks…
698
Potential Impact of Spectre on Processors in the Power family
View, search and download security bulletin information for individual IBM product versions and releases.
699
700
Analyzing the legal implications of GitHub Copilot
Explore the potential legal challenges GitHub Copilot faces regarding copyright infringement and license compliance of its code suggestions.
701
Appeals Court Holds that Email Privacy Protected by Fourth Amendment
In a landmark decision issued today in the criminal appeal of U.S. v. Warshak, the Sixth Circuit Court of Appeals has ruled that the government must have a search warrant before it can secretly seize and search emails stored by email service providers. Closely tracking arguments made by EFF in its...
702
The facts around Zoom and encryption for meetings/webinars
Learn more about how to use each Zoom product to connect with coworkers, customers, businesses, and more with insights and best practices.
703
704
Role-based access control like it was meant to be
Learn about role-based access control, its use cases and benefits.
705
Mozilla Announces Experimental Partnership with ProtonVPN
Mozilla has long played an important role in the online world, and we’re proud of the impact we’ve had. But we want to do even more, and that means exploring ...
706
The Fallacy of Cracking Contests (1998)
In this issue: The Fallacy of Cracking Contests How to Recognize Plaintext News The Doghouse: Iomega Zip Disks Counterpane Systems News Final Report from the Commerce Department Technical Advisory Committee on Key Recovery Comments From Readers About "CRYPTO-GRAM"
707
Requiring secure contexts for all new features
Since Let’s Encrypt launched, secure contexts have become much more mature. We have witnessed the successful restriction of existing, as well as new features to secure contexts. The W3C TAG ...
708
What happens when DNS in China is poisoned and pointed at your server
I’ve been using the Internet in one form or another since the mid-80’s. In that time, I’ve seen a lot of strange stuff happening on our global network. On Tuesday, I experienced something extraordinary. It all started with a text message from my partner Ged at 8:30 AM: Mail server down. Please take a look […]
709
710
Target Hackers Broke in via HVAC Company
Last week, Target told reporters at The Wall Street Journal and Reuters that the initial intrusion into its systems was traced back to network credentials that were stolen from a third party vendor. Sources now tell KrebsOnSecurity that the vendor in question was a refrigeration, heating and air conditioning…
711
Operation Triangulation: iOS devices targeted with previously unknown malware
While monitoring the traffic of our own corporate Wi-Fi network, we noticed suspicious activity that originated from several iOS-based phones. Since it is impossible to inspect modern iOS devices from the inside, we created offline backups of the devices, inspected them and discovered traces of compromise.
712
Attack of the Week: Apple iMessage
Today’s Washington Post has a story entitled “Johns Hopkins researchers poke a hole in Apple’s encryption”, which describes the results of some research my students and I have bee…
713
OAuth for the Open Web
OAuth has become the de facto standard for authorization and authentication on the web. Nearly every company with an API used by third party developers has implemented OAuth to enable people to build apps on top of it.
714
Cloudflare mitigated yet another Okta compromise
On Wednesday, October 18, 2023, we discovered attacks on our system that we were able to trace back to Okta. We have verified that no Cloudflare customer information or systems were impacted by this event because of our rapid response.
715
How to use FIDO2 USB keys with SSH
I recently installed Ubuntu Wacky Whatever, the latest version, and I’m very excited about it shipping with SSH 8.2, which means that I can finally use hardware USB keys for secure, easy to use authentication. If securing your devices has been something you’ve wanted to easily do yourself, read on, because it’s…
716
Who and what is Coinhive?
Multiple security firms recently identified cryptocurrency mining service Coinhive as the top malicious threat to Web users, thanks to the tendency for Coinhive’s computer code to be used on hacked Web sites to steal the processing power of its visitors’ devices. This post looks at how Coinhive vaulted to the top of…
717
Privacy Friendly Apps – improved privacy protection on the smartphone
We use our smartphone for private conversations, store our contacts and organise our meetings with it. The access to all this sensitive data is handled with the so-called permissions. It means, for example, that each app that requires the smartphone camera needs to get the corresponding permission first. Many of the…
718
TextSecure's Private Group Messaging
One of the major features we introduced in the TextSecure v2 release was private group chat. We believe that group chat is an important feature for encrypted communications projects, so we wanted to try to summarize some of the existing work in this area, as well as how TextSecure’s group chat pr...
719
The Cryptographic Doom Principle (2011)
When it comes to designing secure protocols, I have a principle that goes like this: if you have to perform any cryptographic operation before verifying the MAC on a message you’ve received, it will somehow inevitably lead to doom.
720
Titan in depth: Security in plaintext
While there are no absolutes in computer security, we design, build and operate Google Cloud Platform (GCP) with the goal to protect customers' code and data. We harden our architecture at multiple layers, with components that include Google-designed hardware, a Google-controlled firmware stack, Google-curated OS…