4291
New
The latest blog posts to take off on Hacker News. 4,337 posts.
4292
4293
Peter Selinger: MD5 Collision Demo
C:\TEMP> md5sum hello.exe cdc47d670159eef60916ca03a9d4a007 C:\TEMP> .\hello.exe Hello, world! (press enter to quit) C:\TEMP>
4294
Cryptographic Right Answers
Encrypting data: Use AES in CTR (Counter) mode, and append an HMAC . AES is about as standard as you can get, and has done a good job of resisting cryptologic attacks over the past decade. Using CTR mode avoids the weakness of ECB mode, the complex (and bug-prone) process of padding and unpadding of partial blocks (or…
4295
Corrupted Word Files for Sale
On one hand, this is clever: We offer a wide array of corrupted Word files that are guaranteed not to open on a Mac or PC. A corrupted file is a file that contains scrambled and unrecoverable data due to hardware or software failure. Files may become corrupted when something goes wrong while a file is being saved e.g…
4296
4297
Microsoft Update Quietly Installs Firefox Extension
Breaking news, live coverage, investigations, analysis, video, photos and opinions from The Washington Post. Subscribe for the latest on U.S. and international news, politics, business, technology, climate change, health and wellness, sports, science, weather, lifestyle and more.
4298
Nate Lawson Breaks Google Keyczar's HMAC Crypto Signatures
I recently found a security flaw in the Google Keyczar crypto library. The impact was that an attacker could forge signatures for data that was “signed” with the SHA-1 HMAC algorithm (t…
4299
4300
Creative anti-debugger technique in Spotify for Windows
Spotify for Windows contains code so awesome that OllyDbg can't look at it without crashing.
4301
Schneier on Security: Software Problems with a Breath Alcohol Detector
This is an excellent lesson in the security problems inherent in trusting proprietary software: After two years of attempting to get the computer based source code for the Alcotest 7110 MKIII-C, defense counsel in State v. Chun were successful in obtaining the code, and had it analyzed by Base One Technologies, Inc…
4302
4303
Bcrypt is now obsolete
I am speaking today at BSDCan'09 about my work on the scrypt key derivation function. In the context of hardware brute-force attacks, scrypt is thousands of times more secure than existing "best practice" solutions such as bcrypt and PBKDF2; in fact, under reasonable assumptions it is provably as strong as possible…
4304
4305
4306
4307
4308
Dear Mozilla community: I screwed up. Big time.
I screwed up. Big time. Not just with Adblock Plus users but with the Mozilla community at large.
4309
4310
Diceware Passphrase Home
This page offers a better way to create a strong, yet easy to remember, passphrase for use with encryption and security programs. Weak passwords and passphrases are one of the most common flaws in computer security. Take a few minutes and learn how to do it right. The information presented here can be used by anyone…
4311
How 4chan hacked ReCAPTCHA to win the TIME 100 Poll
This morning Time.com published the final result for their annual TIME 100 Poll. Time reports that the new owner of the title ‘Worlds’s most influential person, is moot’. What T…
4312
4313
4314
4315
4316
Faking votes on Hacker News
Hacker News is a site where users vote on links. When someone clicks on an up or down vote, their browser sends a GET request that looks like this: GET /vote?by= joesmith dir=upfor=8765309 A user can only vote if the by parameter matches their Hacker News login cookie. So for a third…
4317
Datacenter Security: A Cautionary Tale from Last.fm
Last.fm has presence in three datacenters in the London area - this is currently more because of necessity than redundancy; datacenter space is at a real premium in the UK and we can’t fulfill our power growth needs at just one site. We operate our own 20 gigabit fibre ring between these, which means we can basically…
4318
4319
4320
Creating a rogue CA certificate with MD5 hash collisions
We have identified a vulnerability in the Internet Public Key Infrastructure (PKI) used to issue digital certificates for secure websites. As a proof of concept we executed a practical attack scenario and successfully created a rogue Certification Authority (CA) certificate trusted by all common web browsers. This…