2941
New
The latest blog posts to take off on Hacker News. 4,441 posts.
2942
2943
Detailed Financial Histories Exposed for Thousands
111 GB of internal customer information from National Credit Federation was left exposed in a publicly downloadable data repository. This is its story.
2944
Officials Don't Get to Choose Who Gets to Receive, Comment, and Reply to Tweets
We’ve taken a stand for the First Amendment rights of individuals to receive and comment on social media posts from governmental officials and agencies. We’ve received a lot of good questions about why we believe that public servants—mayors, sheriffs, senators, even President Donald Trump—can’t...
2945
Reproducible Signal builds for Android
As of our latest Android release, Signal builds are reproducible. Reproducible builds help to verify that the source code in our GitHub repository is the exact source code used to build the compiled Signal APK being distributed through Google Play.
2946
iOS 11 Horror Story: The Rise and Fall of iOS Security
We loved what Apple used to do about security. During the past years, the company managed to build a complete, multi-layer system to secure its hardware and sof
2947
2948
Blocking Top-Level Navigations to Data URLs for Firefox 58
End users rely on the address bar of a web browser to identify what web page they are on. However, most end users are not aware of the concept of ...
2949
Why (blank) gets you root
tracking down the cause of a serious authentication flaw
2950
Amazon GuardDuty – Continuous Security Monitoring and Threat Detection
Threats to your IT infrastructure (AWS accounts & credentials, AWS resources, guest operating systems, and applications) come in all shapes and sizes! The online world can be a treacherous place and we want to make sure that you have the tools, knowledge, and perspective to keep your IT infrastructure safe & sound…
2951
Cloudflare Reports Massive Slowdown in Network Level DDoS Attacks
News outlets and blogs will frequently compare DDoS attacks by the volume of traffic that a victim receives. Surely this makes some sense, right? The greater the volume of traffic a victim receives, the harder to mitigate an attack - right?
2952
Security Guidelines for Congressional Campaigns
Thank you for attending a training session! We covered a lot of ground, so these notes are meant to serve as a reference and reminder of the advice we gave you.
2953
Don't Feed Them After Midnight: Reverse-Engineering the Furby Connect
A Accenture oferece oportunidades que surgem a partir da disrupção tecnológica em todas as indústrias, em todos os países, todos os dias. Saiba mais!
2954
Better Random Number Generation for OpenSSL, Libc, and Linux Mainline
中文版 In 2015, AWS introduced s2n, a new open source implementation of the TLS/SSL protocols that protect the privacy and integrity of data moving over a network. s2n was designed to be secure, simple, small, and fast. The project is thriving, and we use it extensively. In February, our CISO Stephen Schmidt shared that…
2955
Looking at how many sites use vulnerable JavaScript libraries
Last week, we released our first annual State of Open Source Security report. One of the discoveries the report mentions is that an analysis of around 433,000 sites found that 77% of them use at least one front-end JavaScript library with a known security vulnerability. In this post, we take a deep dive into that…
2956
An in-depth security review of the Intel Management Engine
Security Center
2957
Firefox Private Browsing vs. Chrome Incognito: Which Is Faster?
With the launch of Firefox Quantum, Mozilla decided to team up with Disconnect Inc. to compare page load times between desktop versions of Chrome’s Incog
2958
Sinking container ships by hacking load plan software
In my previous article, we looked at the easiest route on to a ships network – the satcoms system. Even having compromised that, it could be a challenge to affect the ship’s navigation, propulsion and control systems – most of these networks are at least somewhat segregated from one another. That got me thinking about…
2959
2960
A Sampling of Anti-Decompilation Techniques
Traditional (assembly level) reverse engineering of software is a tedious process that has been made far more accessible by modern day decompilers. Operating...
2961
1Password X: A look at the future of 1Password in the browser
1Password X is our brand new, full-featured experience that runs entirely in your browser. Find out what it can do.
2962
No boundaries: Exfiltration of personal data by session-replay scripts
This is the first post in our “No Boundaries” series, in which we reveal how third-party scripts on websites have been extracting personal information in increasingly intrusive ways. [0] by Steven Englehardt, Gunes Acar, and Arvind Narayanan Update: we’ve released our data — the list of sites with session-replay…
2963
FreeOTP – An open-source solution for authentication soft tokens
freeOTP is a soft token authenticator that can be used for two-factor authentication, and is available as a free Android app or iOS app. Two-factor authentication — requiring a user to have “something you have”, as well as “something you know” i.e. a password — is being supported on many more services these days…
2964
2965
Target="_blank" – An underestimated vulnerability (2016)
Target="_blank" - the most underestimated vulnerability ever - Wednesday, 04 May 2016 - Alex's blog
2966
TSA Plans to Use Face Recognition to Track Americans Through Airports
The “PreCheck” program is billed as a convenient service to allow U.S. travelers to “speed through security” at airports. However, the latest proposal released by the Transportation Security Administration (TSA) reveals the Department of Homeland Security’s greater underlying plan to collect face...
2967
A penetration tester’s guide to sub-domain enumeration
Security research and technical deep dives from the Appsecco team — cloud attacks, Kubernetes security, vulnerability analysis, and AppSec engineering.
2968
How We Deliver Global SSL with Let's Encrypt
News, tips, and tricks from the team at Fly
2969
Parity Wallet security alert
We tell the story of Parity's technical roadmap with regular blogs. Read on to find out the latest on major upgrades that are delivering scalability for the Polkadot ecosystem.
2970
LavaRand in Production: The Nitty-Gritty Technical Details
As some of you may know, there's a wall of lava lamps in the lobby of our San Francisco office that we use for cryptography. In this post, we’re going to explore how that works in technical detail.