1111
Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop
Have you ever been told that the company’s data on laptops is protected thanks to BitLocker? Well it turns out that this depends on BitLocker’s configuration…
New
The latest blog posts to take off on Hacker News. 4,333 posts.
1112
1113
Short session expiration does not help security
When logged into a web application, the session does not remain valid forever. Typically, the session expires after a fixed time after login, or after the user has been idle for some time. How long should these times be?
1114
Bypassing YouTube video download throttling
Have you ever tried to download videos from YouTube? I mean manually without relying on software like youtube-dl, yt-dlp or one of “these” websites. It’s much more complicated than you might think.
1115
1116
1117
1118
Reverse Engineering the Apple Multipeer Connectivity Framework (2022)
Some time ago I was using Logic Pro to record some of my music and I needed a way to start and stop the recording from an iPhone, so I found about Logic Remote…
1119
Blocked by Cloudflare
Well, it finally happened to me. I was blocked out of a website I use for work because of Cloudflare. And I have no idea if or when I'll be...
1120
1121
Teach a man to phish and he’s set for life
One frustrating aspect of email phishing is the frequency with which scammers fall back on tried-and-true methods that really have no business working these days. Like attaching a phishing email to a traditional, clean email message, or leveraging link redirects on LinkedIn , or abusing an encoding method that makes…
1122
Does Cloudflare’s 1.1.1.1 DNS Block Archive.is? (2019)
Short answer: no. Quite the opposite, actually — Archive.is is intentionally blocking 1.1.1.1 users. Here's why.
1123
Help I accidently enabled HSTS on localhost
I ran into an issue after accidently enabling HSTS for a website on localhost. This was not an issue for the original website that was runni...
1124
Evading JavaScript anti-debugging techniques
Debuggers serve as invaluable tools that empower developers to halt code execution and thoroughly analyze its behavior at any given moment. By utilizing debuggers, developers can efficiently identify and resolve issues within their code, making it an indispensable part of their toolkit.
1125
1126
The Right to Lie and Google’s “Web Environment Integrity”
This is a fundamental principle of free and open source software. The World Wide Web abides by this principle, although we don’t often think of it that way. The Web is just an agreed-on set of programmatic interfaces: if you send me this, I’ll send you that. Your computer can construct the “this” by whatever means it…
1127
The Reluctant Sysadmin's Guide to Securing a Linux Server
I wrote a follow-up to this guide, which you should probably consider along with this article.
1128
1129
Zenbleed
If you remove the first word from the string "hello world" , what should the result be? This is the story of how we discovered that the answer could be your root password!
1130
ldd arbitrary code execution (2009)
The `ldd` utility is more vulnerable than you think. It's frequently used by programmers and system administrators to determine the dynamic library dependencies of executables. Sounds pretty innocent, right? Wrong! In this article I am going to show you how to create an executable that runs arbitrary code if it's...
1131
What every IT person needs to know about OpenBSD (2021)
How to have fun with the world’s most important free software project "Functional, free and secure by default", OpenBSD remains a crucial yet largely unacknowledged player in the open source field. This talk aims to highlight the project's signature security features and development practices -- razor sharp focus on…
1132
Why even let users set their own passwords?
Today we seem to be living through a war on passwords. This is manifested in various ways; in its most passive form, it takes the form of people blogging about how passwords are bad. The more material changes are the general trend towards no longer treating passwords as a sufficient condition for access in favour of…
1133
Become Ungoogleable
I've removed my website from indexing by Google . The proximate cause is Google's new effort to DRM the web ( archive ) but there is of course so much more.
1134
A framework to securely use LLMs in companies – Part 1: Overview of Risks
Part 1 of a multi-part series on using LLMs securely within your organisation. This post provides a framework to categorize risks based on different use cases and deployment type.
1135
Tiffin Tom: Fish, chips and a side of identity theft
Apart from leaking everything, there's been "no breech". Avoid Tiffin Tom.
1136
Unauthenticated RCE on a RIGOL oscilloscope
I work in a company that uses custom electronic boards, so there are plenty of instruments floating around that electrical engineers employ to debug faulty connections and solderings. One kind of tools used are the oscilloscopes, tools that measure signals and plot them in a graphically understandable way. We have a…
1137
Tor is not just for anonymity (2022)
Tech, Pets, and Vettes
1138
Passkeys will come at a cost
Firstyear's blog
1139
2048 Bit RSA and the Year 2030
The Call of the Open Sidewalk [The Call of the Open…2023239 points149 commentsSecurity & Privacy details
Update: NIST released a draft that modified their recommendations (Oct 2024) 1) . RSA 2048 is to be only considered “deprecated” after 2030. The draft states:
1140
ProtonMail Rewrites Your Emails
I switched to ProtonMail a few years back after getting fed up with Google. It’s been mostly acceptable, but a few months ago the Android client started mangling emails – if I hit “send” too soon, it would send out only part of what I’d typed; I had to wait 10 seconds or so after I finished typing before hitting send…