1
CrowdStrike’s work with the Democratic National Committee: Setting the record straight
Get the key facts about CrowdStrike's work with the Democratic Natiional Committee in 2016 and debunk the false claims that have been made about our work.
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 113 posts.
2
The Trouble with Tor
The Tor Project makes a browser that allows anyone to surf the Internet anonymously. Tor stands for "the onion router" and that describes how the service works. Traffic is routed through a number of relays where each relay only knows the next hop, not the ultimate destination.
3
The Difficulty of Private Contact Discovery
Building a social network is not easy. Social networks have value proportional to their size, so participants aren’t motivated to join new social networks which aren’t already large. It’s a paradox where if people haven’t already joined, people aren’t motivated to join. The trouble is that whi...
4
Reflections: The ecosystem is moving
At Open Whisper Systems, we’ve been developing open source “consumer-facing” software for the past four years. We want to share some of the things we’ve learned while doing it. As a software developer, I envy writers, musicians, and filmmakers. Unlike software, when they create something, it is...
5
How Plex is doing HTTPS for all its users
This week Plex , a self-hosted media server, announced that they now offer TLS to secure all connections, including those to the user’s servers. This is actually pretty interesting.
6
What’s the matter with PGP?
Last Thursday, Yahoo announced their plans to support end-to-end encryption using a fork of Google’s end-to-end email extension. This is a Big Deal. With providers like Google and Yahoo onboa…
7
Data is a Toxic Asset
Thefts of personal information aren’t unusual. Every week, thieves break into networks and steal data about people, often tens of millions at a time. Most of the time it’s information that’s needed to commit fraud, as happened in 2015 to Experian and the IRS. Sometimes it’s stolen for purposes of embarrassment or…
8
The Linux Kernel, CDDL and Related Issues
The Software Freedom Law Center provides legal representation and other law related services to protect and advance Free and Open Source Software.
9
10
WhatsApp's Signal Protocol integration is now complete
At Open Whisper Systems, our goal is to make private communication simple. A year ago, we announced a partnership with WhatsApp and committed to integrating the Signal Protocol into their product, moving towards full end-to-end encryption for all of their users by default. Over the past year, we...
11
How Safe Browsing Works in Firefox
Firefox has had support for Google's Safe Browsing since 2005 when it started as a stand-alone Firefox extension . At first it was only available in the USA, but it was opened up to the rest of the world in 2006 and moved to the Google Toolbar . It then got integrated directly into Firefox 2.0 before the public launch…
12
LastPass autofill exploit
Mathias Karlsson decided to check out the security of the LastPass browser extensions. Here's what he found.
13
Apple can comply with the FBI court order
Earlier today, a federal judge ordered Apple to comply with the FBI’s request for technical assistance in the recovery of the San Bernadino gunmen’s iPhone 5C. Since then, many have argued whether these requests from the FBI are technically feasible given the support for strong encryption on iOS devices. Based on my…
14
Distrusting New WoSign and StartCom Certificates
Mozilla has discovered that a Certificate Authority (CA) called WoSign has had a number of technical and management failures. Most seriously, we discovered they were backdating SSL certificates in order ...
15
My Experience With the Great Firewall of China
When I recently visited China for the first time,as an InfoSec professional I was very curious to finally be able to poke at theGreatFirewall of China with m...
16
Blocking-resistant communication through domain fronting
David Fifield, University of California, Berkeley Chang Lan, University of California, Berkeley Rod Hynes, Psiphon Inc Percy Wegmann, Brave New Software Vern Paxson, University of California, Berkeley and the International Computer Science Institute
17
Is curl|bash insecure?
Take control of your web by running your own personal cloud server with Sandstorm.
18
Sustaining Digital Certificate Security
Posted by Ryan Sleevi, Software Engineer This post updates our previous notification of a misissued certificate for google.com Followin...
19
NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender
Ahmed Mansoor was targeted by NSO Group, an Israel-based “cyber war” company that sells Pegasus, a government-exclusive “lawful intercept” spyware product.
20
Grand jury subpoena for Signal user data
In the “first half of 2016” (the most specific we’re permitted to be), we received a subpoena from the Eastern District of Virginia. The subpoena required us to provide information about two Signal users for a federal grand jury investigation. We’ve designed the Signal service to minimize the dat...
21
“Subject: Urgent Warning”
Back in December I got a desperate email from this person. A woman who said her Instagram had been hacked and since she found my contact info in the app she mailed me and asked for help. I of course replied and said that I have nothing to do with her being hacked but I … Continue reading “Subject: Urgent Warning” →
22
Counterfeit Macbook charger teardown: convincing outside but dangerous inside
What's inside a counterfeit Macbook charger? After my Macbook charger teardown , a reader sent me a charger he suspected was counterfeit. ...
23
Threat Group 4127 Targets Hillary Clinton Presidential Campaign
Learn how Sophos CTU researchers tracked the activities of a Russian-based threat group targeting the Hillary Clinton Presidential Campaign.
24
I would like Debian to stop shipping XScreenSaver
If any of you reading this have decision-making ability along those lines, I would appreciate your assistance in making this happen. If you're wondering why: they are still shipping a version of my software that I released in 2014. Since that's roughly a decade in software years, it recently began popping up a single…
25
Typosquatting programming language package managers
Edit: It seems that the blog post and the thesis caused quite some interest. Please contact me under the following mail address: admin [|[at]|] incolumitas [[|dot|]] com In this blog post, it is demonstrated how 17000 computers were forced to execute arbitrary code by typosquatting programming language…
26
Zero Knowledge Proofs: An illustrated primer (2014)
One of the best things about modern cryptography is the beautiful terminology. You could start any number of punk bands (or Tumblrs) named after cryptography terms like ‘hard-core predicate&#…
27
Cryptographic Agility
( These are notes that I wrote up from a talk that I gave at the National Academies Forum on Cyber Resilience . You can tell that it was in Washington, DC because of the “cyber”.
28
NIST is No Longer Recommending Two-Factor Authentication Using SMS
NIST is no longer recommending two-factor authentication systems that use SMS, because of their many insecurities. In the latest draft of its Digital Authentication Guideline, there’s the line: [Out of band verification] using SMS is deprecated, and will no longer be allowed in future releases of this guidance.
29
The MIT License, Line by Line
171 words every programmer should understand
30
How Dropbox hacks your mac
Update: also see Discovering how Dropbox hacks your mac If you have Dropbox installed, take a look at System Preferences > Security & Privacy > Accessibility tab (see …