871
Unlocking LUKS2 Volumes with TPM2, FIDO2, PKCS#11 Security HW on Systemd 248
Posts and writings by Lennart Poettering
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 1,584 posts.
872
How AI text watermarking works
A gentle visual guide to how a statistical mark hides inside generated text, and what erases it.
873
Gradually sunsetting SHA-1
Cross-posted on the Chromium Blog The SHA-1 cryptographic hash algorithm has been known to be considerably weaker than it was designed t...
874
875
Mail from the (Velvet) Cybercrime Underground
Over the past six months, “fans” of this Web site and its author have shown their affection in some curious ways. One called in a phony hostage situation that resulted in a dozen heavily armed police surrounding my home . Another opened a $20,000 new line of credit in my name. Others sent more than $1,000 in bogus…
876
Improved Authentication for Email Encryption and Security
Today, we are happy to become the first and only secure email service to support Secure Remote Password (SRP), a much more secure authentication method.
877
On WebKit Security Updates
Linux distributions have a problem with WebKit security. Major desktop browsers push automatic security updates directly to users on a regular basis, so most users don't have to worry about security updates. But Linux users are dependent on their distributions to release updates. Apple fixed over 100 vulnerabilities…
878
Security and privacy risks of public JavaScript CDNs
Once upon a time, loading common scripts & styles from a public CDN like cdnjs or Google's Hosted Libraries was a 'best practice' - a great way to instantly...
879
TikTok: Logs, Logs, Logs
We are in 2020 and the US president is about to ban TikTok, a video-sharing social network mobile app, because “it poses a risk to US…
880
Backblaze Privacy Update: Third-Party Tracking
Read this post for a privacy update regarding third-party tracking code on our website.
881
How 4chan hacked ReCAPTCHA to win the TIME 100 Poll
This morning Time.com published the final result for their annual TIME 100 Poll. Time reports that the new owner of the title ‘Worlds’s most influential person, is moot’. What T…
882
Audio Adversarial Examples
Figure from our paper: given any waveform, we can modify it slightly to produce another (similar) waveform that transcribes as any different target phrase.
883
A Yubico FAQ about passkeys
Delve into Yubico's comprehensive guide about passkeys, a term encapsulating FIDO/WebAuthn credentials that offer a secure, passwordless experience.
884
A Sneaky Phish Just Grabbed My Mailchimp Mailing List
You know when you're really jet lagged and really tired and the cogs in your head are just moving that little bit too slow? That's me right now, and the penny has just dropped that a Mailchimp phish has grabbed my credentials, logged into my account and exported
885
CWI cryptanalist discovers new cryptographic attack in Flame spy malware
Cryptanalyst Marc Stevens from the Centrum Wiskunde & Informatica (CWI) in Amsterdam, known for breaking the https security in 2008 using a cryptanalytic attack on MD5, analyzed the recent Flame virus this week.
886
887
The Definitive Guide on Win32 to NT Path Conversion (2016)
Posted by James Forshaw, path’ological reverse engineer.How the Win32 APIs process file pat...
888
YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support
YubiKey iOS support is here. For developers, we now offer Yubico Mobile SDK for iOS, and LastPass supports the YubiKey NEO over NFC on iOS.
889
Making art with SSH key randomart
SSH is everywhere in the development or operations world now. For development it’s what allows you to push to GitHub. For operations it’s what allows you to reasonably securely log into Linux servers.
890
A Unikernel Firewall for QubesOS
QubesOS provides a desktop operating system made up of multiple virtual machines, running under Xen. To protect against buggy network drivers, the …
891
TLS Symmetric Crypto
At this time last year, the TLS world was mostly running on RC4-SHA and AES-CBC. The Lucky 13 attack against CBC in TLS had just been published and I had spent most of January writing patches for OpenSSL and NSS to implement constant-time CBC decoding. The RC4 biases paper is still a couple of week away, but it's…
892
Introduction to WebKit Content Blockers
Describing content blocking rules in a structured format ahead-of-time, rather than running extension-provided code.
893
894
Where did all the “reject” buttons come from?
More and more websites have added an option to say “no” to cookies and other tracking- as foreseen by the GDPR. Where did this trend come from?
895
Stanford researcher: Google Circumvents iOS Privacy protection in AdSense ads
Earlier today, the Wall Street Journal published evidence that Google has been circumventing the privacy settings of Safari and iPhone users, tracking them on non-Google sites despite Apple's default settings, which were intended to prevent such tracking. This tracking, discovered by Stanford...
896
DNS4EU for Public Is Available
The free DNS4EU resolver, for everyone in Europe. Get the addresses, set it up in minutes, and block malware and phishing with no tracking.
897
Evolving Chrome's security indicators
Previously, we posted a proposal to mark all HTTP pages as definitively “not secure” and remove secure indicators for HTTPS pages. HTTPS us...
898
Nate Lawson Breaks Google Keyczar's HMAC Crypto Signatures
I recently found a security flaw in the Google Keyczar crypto library. The impact was that an attacker could forge signatures for data that was “signed” with the SHA-1 HMAC algorithm (t…
899
Why I’m done with Chrome
This blog is mainly reserved for cryptography, and I try to avoid filling it with random “someone is wrong on the Internet” posts. After all, that’s what Twitter is for! But from …
900
Everyone knows your location: tracking myself down through in-app ads
How I tracked myself down using leaked location data in the in-app ads, and what I found along the way.