3031
The Sad State of HTML Email Input Fields and IDNs
Chrome and Firefox disagree on IDN addresses in type=email inputs: punycode, validity and the value JavaScript sees. Feature detection is the workaround.
New
The latest blog posts to take off on Hacker News. 4,335 posts.
3032
NIST is No Longer Recommending Two-Factor Authentication Using SMS
NIST is no longer recommending two-factor authentication systems that use SMS, because of their many insecurities. In the latest draft of its Digital Authentication Guideline, there’s the line: [Out of band verification] using SMS is deprecated, and will no longer be allowed in future releases of this guidance.
3033
PayPal 2FA Bypass
Security and Vulnerability Research
3034
Exposing high-end poker cheating devices
This post exposes how real-world highly advanced poker cheating devices work.
3035
Adding a phone number to your Google account can make it less secure
Recently, account takeovers, email hacking, and targeted phishing attacks have been all over the news. Hacks of various politicians, allegedly carried out by Russian hackers, have yielded troves of data. Despite the supposed involvement of state-sponsored agents, some hacks were not reliant on complex zero-day…
3036
Implementing a Tor relay from scratch in golang (2015)
Update from the author, over a decade later: Go has improved and so have my own skills. The conclusion of this article was that Go isn't the right language for the task I gave it, and that's no longer true today, but also wasn't true when I wrote the article. This article is user error, not a language issue.
3037
3038
3039
3040
A single byte write opened a root execution exploit
Thursday, September 22nd 2016. An email popped up in my inbox. Subject: ares_create_query OOB write As one of the maintainers of the c-ares project I'm receiving mails for suspected security problems in c-ares and this was such a one. In this case, the email with said subject came from an individual who had reported a…
3041
Analyzing the Patterns of Numbers in 10M Passwords (2015)
There are many patterns for numbers in passwords, which involve surprising yet intuitive logic.
3042
What are malicious USB keys and how to create a realistic one?
This blog post shows how to create a reliable and realistic-looking malicious USB key that can be used in a drop attack.
3043
3044
EC2's most dangerous feature
A review for readers unfamiliar with this feature: Amazon IAM ( Identity and Access Management ) is a service which allows for the creation of access credentials which are limited in scope; for example, you can have keys which can read objects from Amazon S3 but cannot write any objects. IAM Roles for EC2 are a…
3045
IP Spoofing
The recording and slides are available, but for easier consumption here's a transcript.
3046
Guccifer 2.0 Hacked Clinton Foundation
Many of you have been waiting for this, some even asked me to do it. So, this is the moment. I hacked the Clinton Foundation server and downloaded hundreds of thousands of docs and donors’ da…
3047
NoScript is harmful and promotes malware
NoScript proudly calls itself a security extension advertising itself as an extension with “whitelist based pre-emptive script blocking approach prevents exploitation of security vulnerabilities (known and even not known yet!) with no loss of functionality…”
3048
Dropbox Hasn't Learned Their Lesson
You would think less than a month after a very popular HackerNews article on how Dropbox hacks your Mac, the file sharing company would be careful about their software distribution. They just distributed an update that hacks your UI and presents a Yahoo-like banner from 2004.
3049
“Why do you work in security instead of something more lasting?”
This post grew out of a friend on Facebook asking (I paraphrase) "why do you spend your time on security instead of using your brainpower f...
3050
Inside Arizona’s Pump Skimmer Scourge
Crooks who deploy skimming devices made to steal payment card details from fuel station pumps don’t just target filling stations at random: They tend to focus on those that neglect to deploy various tools designed to minimize such scams, including security cameras, non-standard pump locks and tamper-proof security…
3051
How to Crash Systemd in One Command
After running this command, PID 1 is hung in the pause system call. You can no longer start and stop daemons. inetd-style services no longer accept connections. You cannot cleanly reboot the system. The system feels generally unstable (e.g. ssh and su hang for 30 seconds since systemd is now integrated with the login…
3052
What’s the matter with PGP?
Last Thursday, Yahoo announced their plans to support end-to-end encryption using a fork of Google’s end-to-end email extension. This is a Big Deal. With providers like Google and Yahoo onboa…
3053
Two years spent spamming spammers back
I created a bot to respond to these types of emails…
3054
The Democratization of Censorship
John Gilmore , an American entrepreneur and civil libertarian, once famously quipped that “the Internet interprets censorship as damage and routes around it.” This notion undoubtedly rings true for those who see national governments as the principal threats to free speech.
3055
3056
Upgrade your SSH keys
Upgrade to faster and more secure SSH keys. I promise a smooth transition to the use of your new keys.
3057
The MIT License, Line by Line
171 words every programmer should understand
3058
Beware: Windows 10 Signature Edition Blocks Installing Linux
We help you acquire the perfect domain for your site. Affordable payment options. Quick and responsive customer support available.
3059
Roughtime: a protocol for secure, auditable time synchronisation
Security protocols often assume an accurate, local clock (e.g. TLS, Kerberos, DNSSEC and more). It's a widely accepted assumption when designing protocols but, for a lot of people, it just isn't true. We find good evidence that at least 25% of all certificate errors in Chrome are due to a bad local clock.
3060
If your code accepts URIs as input, filter out “file://”
There are many online sites that accept reading input from remote locations. For example a site might try to extract all the text from a webpage, or show you the HTTP-headers a given server sends back in response to a request.