3181
Announcing Free and Automated SSL Certs
We are excited to announce that Automated Certificate Management is generally available, at no additional charge, for all applications running on Hobby...
New
The latest blog posts to take off on Hacker News. 4,441 posts.
3182
JSON Web Tokens should be avoided
JWT, JWE, JWS, etc. are terrible designs and need to be scrapped, not resuscitated.
3183
3184
We will no longer use the phrase “zero knowledge” to describe our software
Space Cybersecurity has become a prominent topic in the news, particularly when it comes to protecting space-related assets and technologies.
3185
EFF Applauds Amazon for Pushing Back on Request for Echo Data
The number of Internet-enabled sensors in homes across the country is steadily increasing. These sensors are collecting personal information about what’s going on inside the home, and they are doing so in a volume and detail never before possible. The law, of course, has not kept up. There are no...
3186
The Senators that introduced a bill to let telecoms sell your internet history
Protection of your Internet history is up in the air thanks to new, pending legislation. A new bill coming before Senate aims to completely dismantle the
3187
The Frequency of Known Vulnerabilities in JavaScript
An interesting whitepaper was released at the 2017 NDSS Symposium discussing a large-scale attempt at determining just how vulnerable client-side JavaScript libraries are. We wanted to share some of our thoughts on the report.
3188
Digital Privacy at the U.S Border: A New How-To Guide from EFF
San Francisco - Increasingly frequent and invasive searches at the U.S. border have raised questions for those of us who want to protect the private data on our computers, phones, and other digital devices. A new guide released today by the Electronic Frontier Foundation (EFF) gives travelers the...
3189
3190
Congress Is Trying to Roll Back Internet Privacy Protections
Call congress now! Back in 2014 over 3 million Internet users told the U.S. government loudly and clearly: we value our online security, we value our online privacy, and we value net neutrality. Our voices helped convince the FCC to enact smart net neutrality regulations—including long-needed...
3191
What happens when you swipe a credit card
Ninety percent of Americans have used a credit card, but far fewer understand the underlying systems enabling their payments. So let’s dive…
3192
Sandstorm gets a security review
Take control of your web by running your own personal cloud server with Sandstorm.
3193
Containers Come to Firefox Test Pilot
The Containers feature in Firefox Nightly gives users the ability to place barriers on the flow of data across sites by isolating cookies, indexedDB, localStorage, and caches within discrete browsing ...
3194
3195
Quantifying the Impact of “Cloudbleed”
Last Thursday we released details on a bug in Cloudflare's parser impacting our customers. It was an extremely serious bug that caused data flowing through Cloudflare's network to be leaked onto the Internet.
3196
ReBreakCaptcha: Breaking Google’s ReCaptcha v2 Using Google
TL;DR A logic vulnerability, dubbed ReBreakCaptcha, which lets you easily bypass Google’s ReCaptcha v2 anywhere on the web. Overview Back in 2016, I started poking around to see how hard it w…
3197
3198
3199
Vulnerabilities in Password-Manager Apps
There are different policies for the generation of secure passwords. However, one of the biggest challenges is to memorize all these complex passwords. Password manager applications are a promising way of storing all sensitive passwords cryptographically secure. Accessing these passwords is only possible if the user…
3200
Critical vulnerabilities in JSON Web Token libraries
Which libraries are vulnerable to attacks and how to prevent them.
3201
Lessons from the History of Attacks on Secure Hash Functions
This document is a work-in-progress. Please contact the author if you see errors or omissions. Most of the secure hash functions ever designed have turned out to be vulnerable to collision attacks.
3202
3203
Monzo’s Response to Cloudbleed
Your salary sorted into Pots. Your spare change turned into savings. Your money, doing what it should with Monzo.
3204
5 Problems with National ID Cards
The terrorist attacks of September 11have revived proposals for a national identity card system as a way to verify the identity of airline passengers and prevent terrorists from entering the country. For example, the Chairman and CEO of Oracle Corp., Larry Ellison, recently called for the creation of a national ID…
3205
S2n Is Now Handling 100 Percent of SSL Traffic for Amazon S3
In June 2015, we introduced s2n, an open-source implementation of the TLS encryption protocol, making the source code publicly available under the terms of the Apache Software License 2.0 from the s2n GitHub repository. One of the key benefits to s2n is far less code surface, with approximately 6,000 lines of code…
3206
Incident report on memory leak caused by Cloudflare parser bug
Last Friday, Tavis Ormandy from Google’s Project Zero contacted Cloudflare to report a security problem with our edge servers. He was seeing corrupted web pages being returned by some HTTP requests run through Cloudflare.
3207
The Internet Archive Pushes Back on “Notice and Staydown”
The US Copyright Office sought comments in its ongoing study of the Digital Millennium Copyright Act (DMCA) Section 512 safe harbor study. They are generally looking to find out how well the notice and takedown system is working for everyone—Internet platforms and users, as well as creators and copyright holders. We…
3208
Announcing the first SHA-1 collision
Posted by Marc Stevens (CWI Amsterdam), Elie Bursztein (Google), Pierre Karpman (CWI Amsterdam), Ange Albertini (Google), Yarik Markov (Goog...
3209
Securitybot: Open Sourcing Automated Security at Scale
Dash knows your context, your team, and your work, so your team can stay organized, easily find and share knowledge, and keep projects secure, all from one place.
3210