3481
New
The latest blog posts to take off on Hacker News. 4,337 posts.
3482
Comments on the Sony Hack
I don’t have a lot to say about the Sony hack, which seems to still be ongoing. I want to highlight a few points, though. At this point, the attacks seem to be a few hackers and not the North Korean government. (My guess is that it’s not an insider, either.) That we live in the world where we aren’t sure if any given…
3483
Yik Yak Hack
Yik Yak is an anonymous, controversial social media application that allows people to make posts that are visible to other users within ~2 miles. Often landing a top 10 spot in the iOS App Store, this app has become increasingly popular with high school and college students. Due to the anonymous nature of the app…
3484
New Paypal gateway UI susceptible to spoofing
Hey. I decided to get a paid plan on Github and Paypal looked like a good payment option to me. Click the blue button here : This looks ...
3485
The No CAPTCHA problem
When I read about No CAPTCHA for the first time I was really excited. Did we finally find a better solution? Hashcash? Or what? Finally it...
3486
Hacking PayPal Accounts with one click
Today I am going to publicly disclose a critical vulnerability I have found during my research in PayPal, This vulnerability enabled me to completely bypass the CSRF Prevention System implemented by PayPal, The vulnerability is patched very fast and PayPal paid me the maximum bounty they give ;).
3487
“Invalid username or password” is a useless security measure
Login attempts fail because computer users can't remember their email or didn't input the right password. Most websites on the Internet won't tell you which one is actually incorrect.
3488
How NSA and GCHQ are tapping internet cables
A weblog about Signals Intelligence, Communications Security and top level telecommunications equipment
3489
Nobody expects CDATA sections in XML
I made a very explicit, pragmatic design decision with afl-fuzz : for performance and reliability reasons, I did not want to get into stati...
3490
Inline PGP signatures considered harmful
People often suggest that inline PGP signatures in e-mail are somehow more compatible or more acceptable than using PGP/MIME . This is a mistake. Inline PGP signatures are prone to several failure modes, up to and including undetectable message tampering.
3491
Zero Knowledge Proofs: An illustrated primer
One of the best things about modern cryptography is the beautiful terminology. You could start any number of punk bands (or Tumblrs) named after cryptography terms like ‘hard-core predicate&#…
3492
The Increasing Trend of Online Extortion
I heard about this guy, walked into a federal bank with a portable phone, handed the phone to the teller, the guy on the other end of the phone said: “We got this guy’s little girl, and if you don’t give him all your money, we’re gonna
3493
3494
3495
3496
Google disables SSL search at BT’s request
Update – Since this was posted, Max Allan and Damion Yates have investigated further and found that BT are intercepting DNS queries and replying with doctored DNS results, which I didn’…
3497
Unraveling NSA's TURBULENCE Programs
The NSA TURBULENCE program was first revealed in 2007 by the Baltimore Sun for being over-budget and poorly-managed 1 2 . Many documents from the Snowden trove from the past two years reference parts of this program, but no coherent story or overview of how these programs operate together has been described. This is…
3498
What does the NSA think of academic cryptographers?
Brighten Godfrey was one of my officemates when we were grad students at Berkeley. He’s now a highly-successful computer networking professor at the University of Illinois Urbana-Champaign, …
3499
All cameras are police cameras
Welcome to The Nor, a series of essays by James Bridle commissioned by the Hayward Gallery in 2014/5. In order, the essays are: All Cameras Are Police Cameras , Living in the Electromagnetic Spectrum , and Low Latency , as well as an Epilogue . These are accompanied by photographs and a map , and additional content…
3500
Pulling JPEGs out of thin air
This is an interesting demonstration of the capabilities of afl ; I was actually pretty surprised that it worked! $ mkdir in_dir $ echo ' h...
3501
How I reverse-engineered Google Docs to play back any document's keystrokes
How James Somers reverse-engineered Google Docs to play back any document's keystrokes
3502
How I created two images with the same MD5 hash
I posted the following images the other day which although looking totally different have exactly the same MD5 hash ( e06723d4961a0a3f950e...
3503
3504
Don't run 'strings' on untrusted files
Many shell users, and certainly most of the people working in computer forensics or other fields of information security, have a habit of ru...
3505
How Verizon's Advertising Header Works
Over the past couple of days, there’s been an outpouring of concern about Verizon’s advertising practices. Verizon Wireless is injecting a unique identifier into web requests, as data transits the network. On my phone, for example, here’s the extra HTTP header. 1
3506
Hey Paypal, why do you need access to my microphone, camera and photos?
Who actually checks the permissions of applications they’re installing? A little while ago a Paypal update stalled because it required extra permissions. This is what happens if an app you have already installed wants more power. I was more than a little surprised with what I found.
3507
Why Samsung Knox Isn't Really a Fort Knox
UPDATE #2: Apparently Samsung said in their press release that user should try out My Knox, as Knox Personal is deprecated. I just tried t...
3508
FFS SSL
wingolog: article: ffs ssl
3509
3510