3091
CSS mix-blend-mode is bad for your browsing history
Up until mid-2010, any rogue website could get a good sense of your browsing habits by specifying a distinctive :visited CSS pseudo-class ...
New
The latest blog posts to take off on Hacker News. 4,335 posts.
3092
Frequent Password Changes Is a Bad Security Idea
I’ve been saying for years that it’s bad security advice, that it encourages poor passwords. Lorrie Cranor, now the FTC’s chief technologist, agrees: By studying the data, the researchers identified common techniques account holders used when they were required to change passwords. A password like “tarheels#1”, for…
3093
PlayStation Vita Exploit Reverse Engineering Challenge
We released HENkaku a week ago and were blown away by the reception. There has been over 25k unique installs and every day new homebrew are being announced. This is all thanks to those who contributed to the SDK project back when Rejuvenate was announced. Without a working toolchain for developers and a couple of…
3094
What Apple should tell you when you lose your iPhone
Two weeks ago, I was on holiday in Turin, Italy and made a boo boo. I forgot my phone in our rental car for a two hour visit to a local…
3095
Reverse engineering and removing Pokémon GO’s certificate pinning
A deep dive into Pokémon GO’s certificate pinning.
3096
Cracking the Adventure Time cipher
I recently read “Adventure Time: Volume 1”, a comic book based on the smart animated series of the same name. In the comic, I found some odd looking messages at the …
3097
3098
Obtaining Wildcard SSL Certificates from Comodo via Dangling Markup Injection
A Hacker's Blog of Unintended Use and Insomnia.
3099
High frequency security bug hunting: 120 days, 120 bugs
1) Intro & Motivations At the start of of this year, I set myself a personal goal of finding 365 bugs in 365 days. This was entirely motivated by wanting to challenge myself to find more security issues as I felt I'd been slacking off. I thought back to things
3100
How the United Arab Emirates Intelligence Tried to Hire Me to Spy on Its People
Recently, we’ve been overwhelmed with news of horrors, attacks, monsters who murder the innocent in the name of a faith they don’t truly know. I’m publishing t…
3101
3102
My Experience With the Great Firewall of China
When I recently visited China for the first time,as an InfoSec professional I was very curious to finally be able to poke at theGreatFirewall of China with m...
3103
Fuzzing with AFL is an Art
Using one of the test cases from the previous post , I examine what affects AFL's ability to find a bug placed by LAVA in a program. Along ...
3104
Usenet Tradecraft: Survival in an Extremely Adversarial Environment (2013)
Survival in an Extremely Adversarial Environment If your secure communications platform isn’t being used by terrorists and pedophiles, you&# …
3105
Stealing Facebook access_tokens using CSRF in device login flow
I enjoy breaking websites.
3106
3107
Malware in the browser: how you might get hacked by a Chrome extension
A case study of a Chrome extension that turned out to be some nasty botnet malware.
3108
Cyberpower crushes coup
Rewriting the rulebook on coups, time to add cyberpower
3109
How I Could Steal Money from Instagram, Google and Microsoft
TL;DR: Instagram ($2000), Google ($0) and Microsoft ($500) were vulnerable to direct money theft via premium phone number calls. They all offer services to supply users with a token via a computer-voiced phone call, but neglected to properly verify whether supplied phone numbers were legitimate, non-premium numbers…
3110
Is duckduckgo.com partially enforcing the “celebrity threesome injunction”?
The "celebrity threesome injuction" forbids publication in England and Wales of the identities of a famous married couple who reportedly had sex with someone else. In other words, nothing bad, or important.
3111
3112
3113
3114
3115
Race conditions on the web
I enjoy breaking websites.
3116
3117
Securing a travel iPhone
These are dry notes I took in the process of setting up a burner iPhone SE as a secure travel device. They are roughly in setup order.
3118
3119
3120
Mozilla shouldn't copy Chrome's permission prompt for extensions
As Mozilla’s Web Extensions project is getting closer towards being usable, quite a few people seem to expect some variant of Chrome’s permission prompt to be implemented in Firefox. So instead of just asking you whether you want to trust an add-on Firefox should list exactly what kind of permissions an add-on needs…