3271
New
The latest blog posts to take off on Hacker News. 4,337 posts.
3272
3273
When Undercover Credit Card Buys Go Bad
I recently heard from a source in law enforcement who had a peculiar problem. The source investigates cybercrime, and he was reaching out for advice after trying but failing to conduct undercover buys of stolen credit cards from a well-known underground card market. Turns out, the cybercrime bazaar’s own security…
3274
The Moral Character of Cryptographic Work
Abstract: Cryptography rearranges power: it configures who can do what, from what. This makes cryptography an inherently political tool, and it confers on the field an intrinsically moral dimension. The Snowden revelations motivate a reassessment of the political and moral positioning of cryptography. They lead one to…
3275
Let’s encrypt automation on Debian
NOTE: This article is old, this hack is no longer necessary, as Debian includes dehydrated that makes all the work. Free SSL certificates for everyone! the https://letsencrypt.org/ initiative backed by Akamai, Cisco, Mozilla and EFF, is going to offer free certificates. On this post I am going to explain how I have…
3276
3277
Faking the TCP handshake
Update: This article has been superseded by a new post which hopefully explains it more clearly: Spoofing TCP connections without sequence number prediction
3278
Why FPGA manufacturers keep their bitstream formats secret
Every FPGA vendor keeps the bitstream format for their device secret. Only the tools provided in binary-only format by the vendor (and a select few third parties under NDA) can generate these bitstreams.
3279
3280
Telegram stalking
Update 20151216: This quick post got far more attention than expected. I regret not mentioning that the leakage can easily be prevented via a setting. In practice the problem remains, users in general will have no idea about this being a relevant setting to change and will stay with the default. The best discussion on…
3281
Hostnames and usernames to reserve
If you're setting up a service where people can register their own usernames to be used as a hostname (username.example.com), email address (username@example.com), or URL path (example.com/username) within your domain, there are some common names you should avoid letting the general public register. Many …
3282
UUIDs generally do not meet security requirements
Some time ago, I was doing a web application penetration test, and noticed that the authentication tokens were UUIDs. This I knew was risky, and in fact if you read the UUID rfc, section 6 of it wa…
3283
How botnets are created with hijacked Worpess, fake Flash downloads and Node.js
I just noticed the website of an old employer has been hacked and some JavaScript is injected into their corporate website that runs on WordPress. Ouch. Of course I notified them about it and they’re just trying to figure out what happened and how to fix it.
3284
United Airlines Bug Bounty: An experience in reporting a serious vulnerability
About six months ago, United Airlines announced their Bug Bounty program and, almost immediately, it received a ton of press. Though I initially wasn’t interested in pursuing the program (mainly due to its popularity), I decided to take a look a week or two after its launch despite being late to the party. Shortly…
3285
Break a dozen secret keys, get a million more for free
[An in-depth blog post by Daniel J. Bernstein, crossposted between the ECRYPT blog and the cr.yp.to blog .]
3286
ARRIS Cable Modem Has a Backdoor in the Backdoor
A couple of months ago, some friends invited me to give a talk at NullByte Security Conference . I started to study about some embedded devi...
3287
Patronizing Passwords
Passwords suck. Let’s make them better.
3288
Even the LastPass Will Be Stolen
How to obtain encryption keys to decrypt the LastPass vault in different scenarios
3289
The most popular curl download – by a malware
During October 2015 the curl web site sent out 1127 gigabytes of data. This was the first time we crossed the terabyte limit within a single month. Looking at the stats a little closer, I noticed that in July 2015 a particular single package started to get very popular. The exact URL was…
3290
Teensy weensy crypto
As the UK's politicians continue to fail to understand what "strong cryptography" or "banning" even mean, I thought I would have a look at how simple strong cryptography can be.
3291
ImperialViolet
Thomas Ptacek laid out a number of arguments against DNSSEC recently (and in a follow up ). We don't fully agree on everything, but it did prompt me to write why, even if you assume DNSSEC, DANE (the standard for speaking about the intersection of TLS and DNSSEC) is not a foregone conclusion in web browsers.
3292
Why the Tor attack matters
Earlier today, Motherboard posted a court document filed in a prosecution against a Silk Road 2.0 user, indicating that the user had been de-anonymized on the Tor network thanks to research conduct…
3293
How the new Gmail image proxy works and what this means for you
Google recently announced that images in emails will be displayed automatically by default to Gmail users, thanks to an anonymizing proxy operated by them.
3294
The sad state of SMTP encryption
This is a quick recap of why I’m sad about SMTP encryption. It explains how TLS certificate verification in SMTP is useless even if you force it.
3295
3296
3297
3298
PuTTY 0.66 fixes security vulnerability
Home | FAQ | Feedback | Licence | Updates | Mirrors | Keys | Links | Team Download: Stable · Snapshot | Docs | Privacy | Changes | Wishlist
3299
3300
