481
Keeping secrets out of logs (2024)
There's no silver bullet, but if we put some "lead" bullets in the right places, we have a good shot at keeping sensitive data out of logs.
New
The latest blog posts to take off on Hacker News. 4,333 posts.
482
483
Kernel-hack-drill and exploiting CVE-2024-50264 in the Linux kernel
Some memory corruption bugs are much harder to exploit than others. They can involve race conditions, crash the system, and impose limitations that make a researcher's life difficult. Working with such fragile vulnerabilities demands significant time and effort. CVE-2024-50264 in the Linux kernel is one such hard bug…
484
Passkeys and Modern Authentication
Some thoughts in support of simple solutions.
485
Unfortunately, the ICEBlock app is activism theater
At this summer's HOPE conference, Joshua Aaron spoke about ICEBlock, his iPhone app that allows users to anonymously report ICE sightings within a 5 mile radius, and to get notifications when others report ICE sightings near them. You can see the full talk, and the lively/infuriating Q&A,
486
De-Googling TOTP Authenticator Codes
I've been slowly removing Google apps from my life, and one of the last ones left is Authenticator. In this post I look at migrating codes out of Authenticator to a command-line OTP tool, and the steps involved.
487
Reverse engineering Solos smart glasses
First and foremost: If you’ve got any documentation on this hardware, please contact me! I would love to read the actual specs for this protocol.
488
Affiliates flock to scam gambling machine
Last month, KrebsOnSecurity tracked the sudden emergence of hundreds of polished online gaming and wagering websites that lure people with free credits and eventually abscond with any cryptocurrency funds deposited by players. We’ve since learned that these scam gambling sites have proliferated thanks to a new Russian…
489
The Default Trap: Why Anthropic's Data Policy Change Matters
A quick note on the importance of reading the terms of service!
490
Is it possible to allow sideloading and keep users safe?
In which I attempt to be pragmatic. Are you allowed to run whatever computer program you want on the hardware you own? This is a question where freedom, practicality, and reality all collide into a mess. Google has recently announced that Android users will only be able to install apps which have been digitally signed…
491
Hardening Firefox – a checklist for improved browser privacy
A checklist for configuring Mozilla Firefox for a more private browsing experience.
492
I'll only buy devices with GrapheneOS
Authoritarianism is on the rise throughout the globe. Governments wants to monitor your social media accounts so they can make you disappear if you engage in wrongthink such as opposing wars or genocide. This is worsened by misguided laws like Chat control that would mandate scanning of all digital communication…
493
Lesser known mobile adtech domains where data is sent
AppGoblin has now run over 40k apps in an emulator, tracking millions of API calls thousands of advertising domains. Unfortunately, some of them are dark, meaning they have no landing page of any kind, and I’m unclear who controls these domains.
494
Uncomfortable Questions About Android Developer Verification
Google announced a program that is proving to be unpopular among Android app development experts. I have questions.
495
SSL certificate requirements are becoming obnoxious
SSL requirements are quickly becoming obnoxious.
496
An illustrated guide to OAuth
OAuth was first introduced in 2007.
497
How to check if your Apple Silicon Mac is booting securely
How to check your Mac is booting in Full Security, and how to read its log to verify all the key steps involved in that process.
498
Ghrc.io appears to be malicious
A simple typo of ghcr.io to ghrc.io would normally be a small goof. You’d typically get a 404 or similar error, finally work out the issue, fix it, and move along. But in this case, that typo appears to be doing something very malicious, stealing GitHub credentials. What’s ghcr.io? First, a quick bit of background…
499
Internet Access Providers Aren't Bound by DMCA Unmasking Subpoenas–In Re Cox
The DMCA online safe harbor is a notice-and-takedown scheme. Web hosts aren’t liable for copyright-infringing third-party uploads unless and until the copyright owner submits a proper takedown notice to the host, at which point the web host can remain legally...
500
A German ISP changed their DNS to block my website
One of Germany's biggest ISPs changed how their DNS works, right after I exposed an organization that they’re part of.
501
502
Leaving Gmail for Mailbox.org
This was a tough decision, having used Gmail since 2007/2008. However, I had to draw the line and stop giving Google my data for free. The problem with email is …
503
The issue of anti-cheat on Linux (2024)
Why are developers so hesitant to bring anti-cheat solutions to Linux?
504
Burner Phone 101
Hosted by the Brooklyn Public Library, this Burner Phone 101 workshop introduced participants to phone-related risk modeling, privacy-protective smartphone practices, the full spectrum of burner phone options, and when to leave phones behind entirely.
505
Why are anime catgirls blocking my access to the Linux kernel?
Hey… quick question, why are anime catgirls blocking my access to the Linux kernel?
506
Acronis True Image costs performance when not used
Over two years ago I installed Acronis True Image for Crucial in order to migrate my data to a new SSD I had just purchased. It worked. I then left True Image installed “just in case”, and what har…
507
LLMs and coding agents are a security nightmare
Things are about to get wild
508
Using AI to secure AI
One of Anthropic's quieter releases recently was their "Security Review," where Claude Code can identify and fix security issues in your code. But how good is it really? In my case, will it find issues with code it helped me write for my newsletter service…
509
"Privacy preserving age verification" is bullshit
I don't think that it's impossible for politicians, even nontechnical politicians, to make good tech policy. After all, the fact that no one in Congress is a microbiologist doesn't stop federal standards from delivering potable water (and it doesn't excuse the ghastly failures, such as Flint, MI):
510
That 16B password story (a.k.a. "data troll")
Spoiler: I have data from the story in the title of this post, it's mostly what I expected it to be, I've just added it to HIBP where I've called it "Data Troll", and I'm going to give everyone a lot more context below. Here goes: