1951
Don't use third party auth to sign in
If a website offers you to sign-in using Google (or any third-party service, say Facebook, Github, etc.), don’t use that feature.
New
The latest blog posts to take off on Hacker News. 4,335 posts.
1952
PokéWalker hacking: A complete device takeover and ROM dump using infrared
Dmitry.GR: Complete device takeover by blinking at it!
1953
Hunting for Malicious Packages on PyPI
I installed every package on PyPI to look for malicious content. This is what I found.
1954
Your Computer Isn't Yours
There have been several updates appended to this page as of 2020-11-16, please see below. Also available in: Türkçe Français Español Português Português…
1955
Body found in Canada identified as neo-nazi spam king
The body of a man found shot inside a burned out vehicle in Canada three years ago has been identified as that of Davis Wolfgang Hawke , a prolific spammer and neo-Nazi who led a failed anti-government march on Washington, D.C. in 1999, according to news reports.
1956
1957
GitHub Source Code Leak
Straight talk on Canadian online privacy, open-source software, PIPEDA, browser extension security, and practical tools to protect your personal data.
1958
DKIM: Show Your Privates
If you’re like most people, there’s a good chance that it’s been years since you’ve sent an email that wasn’t cryptographically signed. You don’t use PGP, you say? Well, even if you are…
1959
You might not need to store plaintext email addresses
Earlier this year, when I went from having only Facebook-login on Wishy.gift to allow registrations with email address and password, one of my concerns was how to implement this is a way that protects the data and privacy of my users. I don’t have any ads or analytics on the site, the users can select whatever display…
1960
Danish military intelligence uses XKEYSCORE to tap cables in co-op with the NSA
A weblog about Signals Intelligence, Communications Security and top level telecommunications equipment
1961
NAT Slipstreaming
exploit NAT/firewalls to access TCP/UDP services bound to any system behind victim's NAT
1962
Image Scaling Attacks
This post is part of a series about machine learning and artificial intelligence. Click on the blog tag “huskyai” to see related posts. Overview: …
1963
FBI, DHS, HHS Warn of Imminent Ransomware Threat Against U.S. Hospitals
On Monday, Oct. 26, KrebsOnSecurity began following up on a tip from a reliable source that an aggressive Russian cybercriminal gang known for deploying ransomware was preparing to disrupt information technology systems at hundreds of hospitals, clinics and medical care facilities across the United States. Today…
1964
How to Dual-Boot Ubuntu 20.04 and Windows 10 with Encryption
When you run the Ubuntu installer, there’s an option to dual-boot Ubuntu with an existing Windows installation. There’s also an option to encrypt your Ubuntu...
1965
1966
Gitlab Blocked Iranians’ Access
Ahmad Haghighi’s personal page.
1967
Penetration testing and low-cost freelancing
Penetration testing is complex. For it to be successful, the tester needs to possess a variety of different abilities and skills. Some testers rely only on automated tools, while others focus more on manual analysis. While a creative and unconventional way of thinking is necessary, it is also important for the tester…
1968
The Now-Defunct Firms Behind 8chan, QAnon
Some of the world’s largest Internet firms have taken steps to crack down on disinformation spread by QAnon conspiracy theorists and the hate-filled anonymous message board 8chan . But according to a California-based security researcher, those seeking to de-platform these communities may have overlooked a simple legal…
1969
Whose Computer Is It?
Patrick Wardle highlighted a tweet by Maxwell (" Some Apple apps bypass some network extensions and VPN Apps. Maps for example can directly access the internet bypassing any NEFilterDataProvider or NEAppProxyProviders you have running "), sparking an extensive HN discussion on Apple's ham-fisted tactics (not unlike…
1970
Many of the root certificates on Windows are not needed
As of today, Windows trusts 322 root certificates issued by 122 different organizations from 47 countries. This number is quite high, and has been steadily growing over the last few years. And it turns out many of those certificates are not needed at all by the vast majority of Windows users, can be distrusted with no…
1971
Discord Desktop App RCE
A few months ago, I discovered a remote code execution issue in the Discord desktop application and I reported it via their Bug Bounty Prog...
1972
Chrome exempts Google sites from user site data settings
In Google Chrome's "Cookies and site data" settings, accessible via the Preferences menu item or directly with chrome://settings/cookies in the address bar, you can enable the setting "Clear cookies and site data when you quit Chrome". However, I've discovered that Chrome exempts Google's own sites, such as Search and…
1973
1974
Uninstall Nano Defender
Straight talk on Canadian online privacy, open-source software, PIPEDA, browser extension security, and practical tools to protect your personal data.
1975
Reverse Engineer Amazon's Whispersync
I am a big fan of my Kindle. This is the device I’d bring over to a desert island. I am also a fairly frequent user of the highlight feature where you can select a bit of text you like and save it. One thing is bothering me though: the lack of open API on the Kindle to retrieve the data about me. Amazon provides the…
1976
1977
Microsoft Uses Trademark Law to Disrupt Trickbot Botnet
Microsoft Corp. has executed a coordinated legal sneak attack in a bid to disrupt the malware-as-a-service botnet Trickbot , a global menace that has infected millions of computers and is used to spread ransomware. A court in Virginia granted Microsoft control over many Internet servers Trickbot uses to plunder…
1978
Please stop using CDNs for external JavaScript libraries
I want to discuss a (minor) antipattern that I think is (slightly) harmful. Lots of websites use large Javascript libraries. They often include them by using a 3rd party Content Delivery Network like so: Copied HTML to 📋⧉ HTML<script src="https://cdn.example.com/js/library-v1.2.3.js"></script> There are, supposedly, a…
1979
Memory safe ‘curl’ for a more secure internet
tldr: work has started to make Hyper work as a backend in curl for HTTP. curl and its data transfer core, libcurl, is all written in C. The language C is known and infamous for not being memory safe and for being easy to mess up and as a result accidentally cause security problems. At … Continue reading rust in curl…
1980
We Hacked Apple for 3 Months
Between the period of July 6th to October 6th myself, Brett Buerhaus, Ben Sadeghipour, Samuel Erb, and Tanner Barnes worked together and hacked on the Apple bug bounty program.