61
Requiring secure contexts for all new features
Since Let’s Encrypt launched, secure contexts have become much more mature. We have witnessed the successful restriction of existing, as well as new features to secure contexts. The W3C TAG ...
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 128 posts.
62
OAuth for the Open Web
OAuth has become the de facto standard for authorization and authentication on the web. Nearly every company with an API used by third party developers has implemented OAuth to enable people to build apps on top of it.
63
Who and what is Coinhive?
Multiple security firms recently identified cryptocurrency mining service Coinhive as the top malicious threat to Web users, thanks to the tendency for Coinhive’s computer code to be used on hacked Web sites to steal the processing power of its visitors’ devices. This post looks at how Coinhive vaulted to the top of…
64
Facebook Container Extension: Take control of how you’re being tracked
Our Multi-Account Containers extension has been a game changer for many users, letting them manage various parts of their online life without intermingling
65
66
Court has confirmed coordinated raids of Zwiebelfreunde in Germany were illegal
Update July 10th: Last week Monday, prosecution stated that they will keep our things for further analysis, even after explicitly confirming to journalists that they are aware that our only connection to Riseup is the collection of donations. This includes items belonging to our partners, and other third parties like…
67
Extended Validation Certificates Are Dead
That's it - I'm calling it - extended validation certificates are dead. Sure, you can still buy them (and there are companies out there that would just love to sell them to you!), but their usefulness has now descended from "barely there" to "as good as non-existent". This change
68
69
Audio Adversarial Examples
Figure from our paper: given any waveform, we can modify it slightly to produce another (similar) waveform that transcribes as any different target phrase.
70
YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support
YubiKey iOS support is here. For developers, we now offer Yubico Mobile SDK for iOS, and LastPass supports the YubiKey NEO over NFC on iOS.
71
Making art with SSH key randomart
SSH is everywhere in the development or operations world now. For development it’s what allows you to push to GitHub. For operations it’s what allows you to reasonably securely log into Linux servers.
72
Evolving Chrome's security indicators
Previously, we posted a proposal to mark all HTTP pages as definitively “not secure” and remove secure indicators for HTTPS pages. HTTPS us...
73
Why I’m done with Chrome
This blog is mainly reserved for cryptography, and I try to avoid filling it with random “someone is wrong on the Internet” posts. After all, that’s what Twitter is for! But from …
74
75
LocationSmart Leaked Location Data for All Major U.S. Carriers in Real Time
On May 16th, I found a vulnerability in the LocationSmart website which allowed anyone, with no prior authentication or consent, to obtain the realtime location of any cellphone in the US to within…
76
Firefox 59 to strip path information from referrer values for 3rd parties
Starting in version 59, Firefox Private Browsing will remove path data from Referrers sent to third parties. This will help prevent accidentally leaking data to third parties.
77
Intel Issues Updates to Protect Systems from Security Exploits
Intel Newsroom delivers the latest news, announcements, and updates. Stay informed on Intel innovations.
78
What Data Does Facebook Collect When I’m Not Using Facebook, and Why?
Explaining more about the information we get from other websites and apps; how we use the data they send to us; and the controls you have.
79
Keybase Exploding Messages
You're reading the Keybase blog. There are more posts . When you're done, you can install Keybase .
80
First-party isolation in Firefox: what breaks if you enable it?
Firefox’s FPI system keeps websites from tracking your movements across websites. This gives excellent privacy protections but at a cost of web compatibility.
81
Have I Been Pwned Is Now Partnering with 1Password
The penny first dropped for me just over 7 years ago to the day: The only secure password is the one you can't remember [https://www.troyhunt.com/only-secure-password-is-one-you-cant/]. In an era well before the birth of Have I Been Pwned [https://haveibeenpwned.
82
GrayKey iPhone unlocker poses serious security concerns
Ever since the case of the San Bernadino shooter pitted Apple against the FBI over the unlocking of an iPhone, opinions...
83
Chinese Government Fabricates Social Media Posts for Strategic Distraction
The Chinese government has long been suspected of hiring as many as 2,000,000 people to surreptitiously insert huge numbers of pseudonymous and other deceptive writings into the stream of real social media posts, as if they were the genuine opinions of ordinary people. Many academics, and most journalists and…
84
Responsibility Deflected, the CLOUD Act Passes
UPDATE, March 23, 2018: President Donald Trump signed the $1.3 trillion government spending bill—which includes the CLOUD Act—into law Friday morning. “People deserve the right to a better process.”Those are the words of Jim McGovern, representative for Massachusetts and member of the House of...
85
Introducing DNS Resolver for Tor
As was mentioned in the original 1.1.1.1 blog post, our policy is to never write client IP addresses to disk and wipe all logs within 24 hours. Still some folks might not want to reveal their IP address to the resolver at all. This is why we are launching a Tor hidden service for our resolver.
86
Google bug bounty for security exploit that influences search results
Short version: For the $12 cost of a domain, I was able to rank in Google search results against Amazon, Walmart etc. for high value money terms in the US. The…
87
Breaking the Ledger Security Model
In this post, I’m going to discuss a vulnerability I discovered in Ledger hardware wallets. The vulnerability arose due to Ledger’s use of a custom architecture to work around many of the limitations of their Secure Element.
88
Removing Old Versions of TLS
In March of 2020, Firefox will remove support for TLS 1.0 and TLS 1.1.
89
Secure Access to 100 AWS Accounts
Explore technical topics, solutions, and resources for building with Twilio – and beyond.
90
Some thoughts on Spectre and Meltdown
The story of these attacks starts in late 2004. I had submitted my doctoral thesis and had a few months before flying back to Oxford for my defense, so I turned to some light reading: Intel's latest "Optimization Manual", full of tips on how to write faster code. (Eking out every last nanosecond of performance has…