1711
Apple wants to redefine what it means to violate your privacy. We mustn’t let it
Violation of privacy by proxy is still violation of privacy.
New
The latest blog posts to take off on Hacker News. 4,333 posts.
1712
1713
1714
; Echo “Shell Injection”
This is an introductory article about shell injection, a security vulnerability allowing an attacker to execute arbitrary code on the user's machine. This is a well-studied problem, and there are simple and efficient solutions to it. It's relatively easy to design library API in such a way as to shield the application…
1715
Why I Wrote PGP (1999)
"Whatever you do will be insignificant, but it is very important that you do it." -Mahatma Gandhi
1716
Apple’s New ‘Child Safety’ Initiatives, and the Slippery Slope
The stakes are incredibly high, and Apple knows it. Whatever you think of Apple’s decision to implement these features, they’re not doing so lightly.
1717
The Problem with Perceptual Hashes
Apple just announced that they will use “perceptual hashing” to detect illegal photos on iPhones. I have some experience to share on this technology.
1718
On Apple’s “Expanded Protections for Children” – A Personal Story
These efforts will evolve and expand over time. – Apple on their “Expanded Protections for Children” I am broke “non-liquid” right now. Normally, that sentence doesn&#…
1719
The Drunken Bishop Algorithm
There’s a tradition in my family that everyone takes a turn stirring a secret wish into the yearly christmas pudding . It’s important that the wishes remain secret to the wisher or the pudding magics wont work so since moving to America I’ve implemented a new way of hashing my wish so it can be stirred in via text…
1720
SAML Is Insecure by Design
What is SAML? Security Assertion Markup Language (SAML) is an open standard for exchanging authentication and authorization data between parties. Source: Wikipedia SAML is often used for single-sign on (“Sign in with Google”, “Sign in with Twitter” etc.). It means when you want to log in to example.com, example.com…
1721
Bombs vs. Bugs
I’ll be taking some time in the next months to talk about the newly hostile-by-default nature of technology, and how I deal with it.
1722
How to boost your popularity on OkCupid using CSRF and a JSON type confusion
This is a quick blog post about a security vulnerability (now fixed) that allowed me to make anyone like or message a profile on okcupid.com simply by getting them to click a link on my website. In doing so, I used one of the most boring web application security issues (CSRF) combined with a somewhat interesting JSON…
1723
Scanning your iPhone for Pegasus
Scan your iPhone for NSO Group's Pegasus malware using Mobile Verification Toolkit (MVT) by Amnesty International
1724
Cloudflare's inaccessible browser contradicts the company's mission
About four months ago, Cloudflare launched Browser Isolation during Security Week, without ensuring that the product is accessible to blind people using screen readers. Now, four months later, this problem is still not solved. Cloudflare’s neglect of accessibility in this product raises a new barrier to employment for…
1725
Probably Are Gonna Need It: Application Security Edition
My list of “Probably Are Gonna Need It” security features for your web app – things that you should build up-front, not wait until you need them (when it’s already too late).
1726
Cryptanalysis of Meow Hash
The creators of Meow hash made security claims; we break them all.
1727
The Insecurity Industry
The greatest danger to national security has become the companies claiming to protect it
1728
Autofill in password managers can allow login credentials to be stolen
Security Researcher | Ethical Hacker | Web Application Security
1729
1730
Google results for PHP tutorials contain SQL injection vulnerabilities
Today, out of curiosity, I googled for php mysql email register . This returns tutorials, how-tos, code snippets. Most results include flawed DB statements. This usually means something like
1731
Freenom, the free domains website, is a scam
Self-taught developer. Go, Rust, Python and Javascript. - hackermondev
1732
HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10
This is the story of how all non-admin users can read the registry — and so elevate privileges and access sensitive credential information…
1733
How to exfiltrate code from Bitbucket
Every year or so, something compels me to start over with a fresh OS image. Most recently, that something was an unfortunate water bottle incident. Once again, I need to pull down my digital life from the internet. The code and assets for this blog currently live in a 500 MB Git repository, which was hosted on…
1734
1735
Serial swatter who caused death gets five years in prison
A 18-year-old Tennessee man who helped set in motion a fraudulent distress call to police that led to the death of a 60-year-old grandfather in 2020 was sentenced to 60 months in prison today.
1736
NSO Group Hacked
NSO Group, the Israeli cyberweapons arms manufacturer behind the Pegasus spyware—used by authoritarian regimes around the world to spy on dissidents, journalists, human rights workers, and others—was hacked. Or, at least, an enormous trove of documents was leaked to journalists. There’s a lot to read out there…
1737
A case against security nihilism
This week a group of global newspapers is running a series of articles detailing abuses of NSO Group’s Pegasus spyware. If you haven’t seen any of these articles, they’re worth re…
1738
Don’t Wanna Pay Ransom Gangs? Test Your Backups
Browse the comments on virtually any story about a ransomware attack and you will almost surely encounter the view that the victim organization could have avoided paying their extortionists if only they’d had proper data backups. But the ugly truth is there are many non-obvious reasons why victims end up paying even…
1739
Remote code execution in cdnjs of Cloudflare
Preface (日本語版も公開されています。) Cloudflare, which runs cdnjs, is running a “Vulnerability Disclosure Program” on HackerOne, which allows hackers to perform vulnerability assessments. This article describes vulnerabilities reported through this program and published with the permission of the Cloudflare security team. So this…
1740
Online ID / age verification: the death of online search
Neil note: I’ve published this with the hope that others familiar with what this could entail will give feedback. As such, what you read now might not be the final version. If I make material changes, I’ll indicate them.