Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 1,584 posts.
Security protocols often assume an accurate, local clock (e.g. TLS, Kerberos, DNSSEC and more). It's a widely accepted assumption when designing protocols but, for a lot of people, it just isn't true. We find good evidence that at least 25% of all certificate errors in Chrome are due to a bad local clock.
a guided introduction for first-timers
Stanford Center for Internet and Society2023119 points147 commentscited by 3Society, Policy & Culture details
Recently, Wired reported on documents leaked in May from the Council of the European Union’s ongoing deliberations over the draft Child Sex Abuse Regulation. The proposal is controversial because, as presently written, it would require online service providers to proactively scan their services – including users’…
A lot of people use VPN every day. Somebody use it in always-on mode to circumvent government or corporative internet censorship, while…
LLMs have the potential to revolutionise our field of healthcare, but the fear and reality of hallucinations prevent adoption in most applications.
How bad can it git? Characterizing secret leakage in public GitHub repositories Meli et al., NDSS’19 On the one hand you might say there’s no new news here. We know that developers shouldn’t …
Tell me if this sounds familiar: any connection from inside the corporate network is trusted and any connection from the outside is not. This is the security strategy used by most enterprises today. The problem is that security is breached, the attacker has access to everything.
The latest Signal for Android release includes support for adding doodles, stickers, and text to images. This release also includes support for censorship circumvention in Egypt and the United Arab Emirates.
Two weeks ago I attended SIGCSE 2012 in Raleigh, NC. The plane on my return flight had Internet access through Gogo’s Inflight Internet. While I think it’s incredibly awesome that Internet access is readily available to those who travel by plane, I personally feel it is not worth …
The JFrog Security Research team has recently discovered and reported a leaked access token with administrator access to Python’s, PyPI’s and Python Software Foundation’s GitHub repositories, which was leaked in a public Docker container hosted on Docker Hub. As a community service, the JFrog Security Research team…
Beginning August 13th, 2021, we will no longer accept account passwords when authenticating Git operations on GitHub.com.
How the wrong settings on a photocopier has let us have a glimpse at a forbidden image of a modern thermonuclear warhead.
1Password X is our brand new, full-featured experience that runs entirely in your browser. Find out what it can do.
A little fun for the last day of 2012: how to crash a program via division? x86’s IDIV instruction traps not only on division by zero, but also on INT_MIN / -1 (signed integer overflow).
During a recent audit, we discovered that some third-party Chromium based browsers were able to integrate Google features, such as Chrome sy...
[An in-depth blog post by Daniel J. Bernstein, crossposted between the ECRYPT blog and the cr.yp.to blog .]
I learned a neat tip from my co-worker, Craig Silverstein ( more on Craig joining Khan Academy ), recently and I thought others might find it to be useful.
This new paper by 11 authors from organizations including IBM, Invariant Labs, ETH Zurich, Google and Microsoft is an excellent addition to the literature on prompt injection and LLM security. …
Greetings! Today I'm happy to announce a new era in Tor implementation. Over the past year or so, we've been working on "Arti", a project to rewrite Tor in Rust. Thanks to funding from Zcash Open Major Grants (ZOMG), we can finally put the Arti project up in our priorities list, and devote more time to it. Below I'll…
We have identified a vulnerability in the Internet Public Key Infrastructure (PKI) used to issue digital certificates for secure websites. As a proof of concept we executed a practical attack scenario and successfully created a rogue Certification Authority (CA) certificate trusted by all common web browsers. This…
Petr Švenda, Matúš Nemec, Peter Sekan, Rudolf Kvašňovský, David Formánek, David Komárek, and Vashek Matyáš, Masaryk University
