1231
Who reads your email?
A look at diversity of MX records across all gTLDs and the Top 1M domains, indicating where SMTP is concentrated and what organizations might have broad access to the world's emails.
New
The latest blog posts to take off on Hacker News. 4,333 posts.
1232
How to Yubikey
How to use and configure a Yubikey
1233
How secure is merely discarding (TRIMing) all of a SSD's blocks?
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
1234
Sued by Meta, Freenom halts domain registrations
The domain name registrar Freenom , whose free domain names have long been a draw for spammers and phishers, has stopped allowing new domain name registrations. The move comes after the Dutch registrar was sued by Meta , which alleges the company ignores abuse complaints about phishing websites while monetizing…
1235
1236
Hacking the Nintendo DSi Browser
I managed to exploit the Nintendo DSi browser 15 years after it was released in Japan. This post will go over the journey and the technical details.
1237
Live2D Is a Security Trainwreck
derailed by dangling pointers
1238
I quit infosec and I couldn't be happier
This article aims at providing you some insights about the experience I had in the “infosec world” for the past few years. I had an amazing journey and grateful for everything that happened. Don’t get me wrong with the title, even if the road was sometimes “bumpy” (aka ‘bad’ experiences), I got some good lessons…
1239
How SMS fraud works and how to guard against it
or why Twitter disabled SMS 2FA 💬
1240
Hackers claim they breached T-Mobile more than 100 times in 2022
Three different cybercriminal groups claimed access to internal networks at communications giant T-Mobile in more than 100 separate incidents throughout 2022, new data suggests. In each case, the goal of the attackers was the same: Phish T-Mobile employees for access to internal company tools, and then convert that…
1241
1242
Lessons from the Debian/OpenSSL Fiasco (2008)
Last week, Debian announced that in September 2006 they accidentally broke the OpenSSL pseudo-random number generator while trying to silence a Valgrind warning. One effect this had is that the ssh-keygen program installed on recent Debian systems (and Debian-derived systems like Ubuntu) could only generate 32,767…
1243
My daughter's school took over my personal Microsoft account
This weekend I wanted to create a new App in Azure so I could help a local nonprofit automate one of their donor relations processes via email through Office 365. So I tried registering an app by visiting the App Registration Portal. I signed in to my personal Microsoft account, clicked 'New registration', then was…
1244
How to date a recording using background electrical noise
Three men were accused of selling firearms to South London gangs. At their 2012 trial in Croydon Crown Court, the prosecution played the jury a recording, taken undercover, of the trio allegedly arranging a sale. But the men’s lawyers claimed that the recording was a fake, and that the police had fabricated it by…
1245
1246
Let's build a Chrome extension that steals as much data as possible
Today's adventure: DIY whole hog data exfiltration
1247
What is the randomart image for?
When you generate an SSH key (like I did when looking at signing commits with SSH keys ), you get a “randomart image” from ssh-keygen . These things:
1248
Down the Cloudflare / Stripe / OWASP Rabbit Hole
I found myself going down a previously unexplored rabbit hole recently, or more specifically, what I thought was "a" rabbit hole but in actual fact was an ever-expanding series of them that led me to what I refer to in the title of this post as "6 rabbits deep"
1249
1250
Google’s fully homomorphic encryption compiler – a primer
Back in May of 2022 I transferred teams at Google to work on Fully Homomorphic Encryption (newsletter announcement). Since then I’ve been working on a variety of projects in the space, including being the primary maintainer on github.com/google/fully-homomorphic-encryption, which is an open source FHE compiler for…
1251
The retaliation: Pranking my roommate with targeted Facebook ads (2014)
Ghost Influence by Brian Swichkow2023335 points75 commentscited by 37Society, Policy & Culture details
This is the chronicle of the most epic retaliation and how I pranked my roommate with targeted Facebook Ads to the point of complete paranoia and delusion.
1252
Can sanitizers find the two bugs I wrote in C++?
A few days ago I published a short post about two bugs I wrote while developing the C++ external scanner for my TLA⁺ tree-sitter grammar. Reactions were mixed! Many people were supportive, but there were of course the usual drive-by claims by developers that the bugs were trivial, they would’ve found & fixed them…
1253
Hardware trojans under a microscope (2022)
Table of Contents
1254
Voice.ai: GPL Violations with a Side of DRM
the one good use of copyright is prying things open
1255
Weakening TLS protection, South Korean style
TLS protocol is fundamental to internet security. All South Korean security applications add their own “trusted” Certificate Authorities however, weakening this protocol severely.
1256
Finland’s most-wanted hacker nabbed in France
Julius “Zeekill” Kivimäki, a 25-year-old Finnish man charged with extorting a local online psychotherapy practice and leaking therapy notes for more than 22,000 patients online, was arrested this week in France. A notorious hacker convicted of perpetrating tens of thousands of cybercrimes, Kivimäki had been in hiding…
1257
I use C when I believe in memory safety
I am using C for a professional project. I believe in memory safety. Yes, I'm a hypocrite, but please, let me explain.
1258
Reverse-Engineering YouTube: Revisited
Back in 2017 I wrote an article in which I attempted to explain how YouTube works under the hood, how it serves streams to the client, and also how you can exploit that knowledge to download videos from the site. The primary goal of that write-up was to…
1259
Want anonymity? Make a persona not a mystery
Derek Sivers official site. Thoughts on philosophy, culture, self-improvement. Author of Useful Not True, How to Live, Hell Yeah or No, Anything You Want.
1260
Reversing UK mobile rail tickets
The UK has used small credit-card sized tickets to pay for train travel for years and years, since long before I was born — originally theAPTIS ticket1,which...