1561
An Open Letter to Pixsy CEO Kain Jones, Who Keeps Sending Me Legal Threats
Once is happenstance. Twice is coincidence. Three times is enemy action.
New
The latest blog posts to take off on Hacker News. 4,333 posts.
1562
Consent, GDPR and Google Analytics
A discussion about the Austrian Google Analytics case, and if consent of the user would have made the difference.
1563
CORS is not meant to secure an API endpoint
CORS does not secure your API: why browser-side API keys are unsafe, and how to protect Drupal JSON:API endpoints with proper authentication.
1564
Attacking an Ethereum L2 with Unbridled Optimism
On 2/2/2022, I reported a critical security issue to Optimism—an "L2 scaling solution" for Ethereum—that would allow an attacker to replicate money on any chain using their "OVM 2.0" fork of go-ethereum (which they call l2geth).
1565
BeyondCorp is dead, long live BeyondCorp
No organization has fully implemented zero trust architecture. Many advocates, including the US government, overlook devices as a key BeyondCorp component.
1566
Breaking 256-Bit Elliptic Curve Encryption with a Quantum Computer
Researchers have calculated the quantum computer size necessary to break 256-bit elliptic curve public-key cryptography: Finally, we calculate the number of physical qubits required to break the 256-bit elliptic curve encryption of keys in the Bitcoin network within the small available time frame in which it would…
1567
The Plausibly Deniable DataBase (PDDB)
The problem with building a device that is good at keeping secrets is that it turns users into the weakest link.
1568
IRS to ditch biometric requirement for online access
The Internal Revenue Service (IRS) said today it will be transitioning away from requiring biometric data from taxpayers who wish to access their records at the agency’s website. The reversal comes as privacy experts and lawmakers have been pushing the IRS and other federal agencies to find less intrusive methods for…
1569
Europe: The end of the privacy of digital correspondence
The End of the Privacy of Digital Correspondence The EU wants to oblige providers to search all private chats, messages, and emails automatically for suspicious content - generally and indiscriminately. The stated aim: To prosecute child pornography. The result: Mass surveillance by means of full
1570
Bitcoin's fungibility graveyard
Where the pipe-dream of Bitcoin’s real-world fungibility goes to die.
1571
I hacked SONOS and YouTube the same day
Or how to play YouTube videos on you SONOS, easy and for free.
1572
Who keeps an eye on clipboard access?
If there is any feature that “universally” describes the usage of computers, it is the copy/paste pattern. We are used to it, practically all the common graphical user interfaces have support for it, and it magically works.
1573
1574
1575
Scary fraud ensues when ID theft and usury collide
What’s worse than finding out that identity thieves took out a 546 percent interest payday loan in your name? How about a 900 percent interest loan? Or how about not learning of the fraudulent loan until it gets handed off to collection agents? One reader’s nightmare experience spotlights what can happen when ID…
1576
Hacking the Apple Webcam (Again)
$100,500 Apple Bug Bounty for hacking the webcam via a Safari Universal Cross-Site Scripting (UXSS) bug. CVE-2021-30861, CVE-2021-30975
1577
Scam Alert: Fake DMCA Takedown for Link Insertion
There are a lot of scams out there, but one that's been plaguing bloggers like me lately is a novel twist: A fake DMCA takedown notice that's actually a link insertion scam! Beware: The notices I'm getting are very convincing-looking, complete with a fake law firm website!
1578
LogJ4 Security Inquiry – Response Required
On Friday January 21, 2022 I received this email. I tweeted about it and it took off like crazy. The email comes from a fortune-500 multi-billion dollar company that apparently might be using a product that contains my code, or maybe they have customers who do. Who knows? My guess is that they do this … Continue…
1579
An ad plugin was stealing revenue for a year and I didn't even notice
Anyone can build their own amusement park here, or find one that's just right for them. A city of parks by Levan Kvirkvelia.
1580
The most backdoor-looking bug I’ve ever seen (2021)
This is the story of a bug that was discovered and fixed in Telegram’s self-rolled cryptographic protocol about seven years ago. The bug didn’t get any press, and no one seems to know about it, probably because it was only published in Russian.
1581
IRS Will Soon Require Selfies for Online Access
If you created an online account to manage your tax records with the U.S. Internal Revenue Service (IRS), those login credentials will cease to work later this year. The agency says that by the summer of 2022, the only way to log in to irs.gov will be through ID.me , an online identity verification service that…
1582
Systemd service sandboxing and security hardening (2020)
The systemd-analyze security command gives your systemd service units an automated security rating. This is a good starting point for security hardening.
1583
The curious case of the Raspberry Pi in the network closet (2019)
Personal Blog of Christian Haschek
1584
Big Time Public License
a FRAND-ly license for software
1585
What NPM should do to stop a new colors attack
Over the weekend, a developer named Marak Squires intentionally sabotaged his popular NPM package colors and his less popular package faker . As I write this, NPM claims 18,971 direct dependents for colors and 2,751 for faker . Open Source Insights counts at least 42,000 more indirect dependents for colors . Many…
1586
1587
1588
Hashing is not encryption
Encryption, encoding, and hashing are three related but distinct concepts. It’s important for you to understand all three.
1589
500M Avira antivirus users introduced to cryptomining
Many readers were surprised to learn recently that the popular Norton 360 antivirus suite now ships with a program which lets customers make money mining virtual currency . But Norton 360 isn’t alone in this dubious endeavor: Avira antivirus — which has built a base of 500 million users worldwide largely by making the…
1590
Fixing the Unfixable: Story of a Google Cloud SSRF
David Schütz's bug bounty writeups