1
Myths about /dev/urandom
Randomness, entropy, and the Linux kernel.
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 74 posts.
2
Verizon Injecting Perma-Cookies to Track Mobile Customers, Bypassing Privacy Controls
Verizon users might want to start looking for another provider. In an effort to better serve advertisers, Verizon Wireless has been silently modifying its users' web traffic on its network to inject a cookie-like tracker. This tracker, included in an HTTP header called X-UIDH, is sent to every...
3
Open Whisper Systems partners with WhatsApp to provide end-to-end encryption
At Open Whisper Systems, our goal is to make private communication simple. For the past three years, we’ve been developing a modern, open source, strong encryption protocol for asynchronous messaging systems, designed to make seamless end-to-end encrypted messaging possible. Today we’re excited ...
4
Apple's SSL/TLS bug
Yesterday, Apple pushed a rather spooky security update for iOS that suggested that something was horribly wrong with SSL/TLS in iOS but gave no details. Since the answer is at the top of the Hacker News thread, I guess the cat's out of the bag already and we're into the misinformation-quashing stage now.
5
How To Safely Generate A Random Number
Use urandom. That is the whole answer. Why the entropy-depletion story is a myth, and why userspace CSPRNGs are behind most of the last decade's randomness disasters.
6
The Linux Security Circus: On GUI isolation
There certainly is one thing that most Linux users don't realize about their Linux systems... this is the lack of GUI-level isolation, and ...
7
You Don't Want XTS
XTS is the de-facto standard disk encryption mode, which makes it look like a good general-purpose one. It isn't. What disk encryption actually promises, and why XTS's guarantees don't travel.
8
Warrant Canary Frequently Asked Questions
What is a warrant canary? A warrant canary is a colloquial term for a regularly published statement that a service provider has not received legal process that it would be prohibited from saying it had received. Once a service provider does receive legal process, the speech prohibition goes into...
9
No, don't enable revocation checking
Revocation checking is in the news again because of a large number of revocations resulting from precautionary rotations for servers affected by the OpenSSL heartbeat bug. However, revocation checking is a complex topic and there's a fair amount of misinformation around. In short, it doesn't work and you are no more…
10
Pulling JPEGs out of thin air
This is an interesting demonstration of the capabilities of afl ; I was actually pretty surprised that it worked! $ mkdir in_dir $ echo ' h...
11
sean cassidy : Don't Pipe to your Shell
It's everywhere . Sometimes they tell you to ignore certificates as well (looking at you, Salt). That's dumb.
12
Sophos News - The Sophos Blog
The Sophos Blog
13
Huawei and Cisco's Source Code: Correcting the Record
Last week, I wrote about statements made by Charles Ding, Huawei’s Senior Vice President and Chief Representative in the U.S., Mr. Ding explained the
14
Downloading Software Safely Is Nearly Impossible
Let’s say you have a brand-new Windows laptop and you’re just oh, so happy. You’re pretty sure the NSA did not interdict it during shipment , and thus that it comes only with the flaky goatware Microsoft, Lenovo, and any number of Lenovo’s business partners intended for it to have. Now all you need is an SSH client so…
15
Tor security advisory: “relay early” traffic confirmation attack
This advisory was posted on the tor-announce mailing list. SUMMARY: On July 4 2014 we found a...
16
Keyless SSL: The Nitty Gritty Technical Details
We announced Keyless SSL yesterday to an overwhelmingly positive response. We read through the comments on this blog, Reddit, Hacker News, and people seem interested in knowing more and getting deeper into the technical details.
17
The New Normal: 200-400 Gbps DDoS Attacks
Over the past four years, KrebsOnSecurity has been targeted by countless denial-of-service attacks intended to knock it offline. Earlier this week, KrebsOnSecurity was hit by easily the most massive and intense such attack yet — a nearly 200 Gbps assault leveraging a simple attack method that industry experts say is…
18
19
GnuPG - What’s new in 2.1
A possibly revised version of this article can be found at: https://gnupg.org/faq/whats-new-in-2.1.html
20
How printers and Photoshop detect and refuse to process images of currency
Professor Steven J. Murdoch
21
How to design an elliptic-curve signature system
Earlier this month a new paper by Naomi Benger, Joop van de Pol, Nigel Smart, and Yuval Yarom hit the news . The paper explains how to recover secret keys from OpenSSL's implementation of ECDSA-secp256k1 using timing information from "as little as 200 signatures"; ECDSA-secp256k1 is the signature system used by…
22
Technical Details Behind a 400Gbps NTP Amplification DDoS Attack
On Monday we mitigated a large DDoS that targeted one of our customers. The attack peaked just shy of 400Gbps. We've seen a handful of other attacks at this scale, but this is the largest attack we've seen that uses NTP amplification.
23
Don't run 'strings' on untrusted files
Many shell users, and certainly most of the people working in computer forensics or other fields of information security, have a habit of ru...
24
$300k for Cracking Telegram Encryption
$300,000 for cracking #Telegram encryption
25
The Sad State of Mobile XMPP in 2014
blog about networking, cameras, old gear, and xmpp
26
Launching in 2015: A Certificate Authority to Encrypt the Entire Web
Today EFF is pleased to announce Let’s Encrypt, a new certificate authority (CA) initiative that we have put together with Mozilla, Cisco, Akamai, IdenTrust, and researchers at the University of Michigan that aims to clear the remaining roadblocks to transition the Web from HTTP to HTTPS.Although...
27
28
LibreSSL: More Than 30 Days Later
LibreSSL was officially announced to the world just about exactly five months ago. Bob spoke at BSDCan about the first 30 days. For those who weren't there, I'll quickly rehash some of that material. Also, it's always best to start at the beginning, but then I'll try to focus on some new material and updates.
29
Why can't Apple decrypt your iPhone?
Last week I wrote about Apple’s new default encryption policy for iOS 8. Since that piece was intended for general audiences I mostly avoided technical detail. But since some folks (and appar…
30