2161
How many users block Google analytics? (2017)
Comparing Google Analytics with server logs
New
The latest blog posts to take off on Hacker News. 4,335 posts.
2162
A mysterious bug in the firmware of Google's Titan M chip
Starting with the release of the Pixel 3, all of Google's Pixel Android smartphones come with the Titan M security chip on board. When I realized the Pixel 3a XL I purchased also had it, I decided to try to take advantage of it in an app I work on. It turned out that using the Titan M chip through the Android Keystore…
2163
FCC Proposes to Fine Wireless Carriers $200M for Selling Customer Location Data
The U.S. Federal Communications Commission (FCC) today proposed fines of more than $200 million against the nation’s four largest wireless carriers for selling access to their customers’ location information without taking adequate precautions to prevent unauthorized access to that data. While the fines would be among…
2164
Google's Abandoned Android Authenticator App
The news has just broken that Google's Authenticator App can have its codes stolen by malware. I doubt Google will ever release a fix for this issue - their 2FA app hasn't been updated since September 2017. Update! 3 months after I published this post, Google updated their app For two-and-a-half years, Google hasn't…
2165
Don’t try to sanitize input – escape output
Why you should escape output correctly, but generally not sanitize user input.
2166
2167
Jailed Just-in-Time Compilation on iOS
Saagar Jha's website.
2168
Inrupt, Tim Berners-Lee's Solid, and Me
For decades, I have been talking about the importance of individual privacy. For almost as long, I have been using the metaphor of digital feudalism to describe how large companies have become central control points for our data. And for maybe half a decade, I have been talking about the world-sized robot that is the…
2169
Guessing smart phone PINs by monitoring the accelerometer
“Practicality of Accelerometer Side Channels on Smartphones,” by Adam J. Aviv. Benjamin Sapp, Matt Blaze, and Jonathan M. Smith. Abstract: Modern smartphones are equipped with a plethora of sensors that enable a wide range of interactions, but some of these sensors can be employed as a side channel to surreptitiously…
2170
Stop adding email tracking links to phone numbers
My Chinese takeaway delivery was late. Very late. I flipped open the confirmation email sent by Just-Eat to double-check I had all the details correct. At the bottom was a "click to call" link. Hurrah! I clicked dial, and this is what filled my screen: An absurdly long phone number. Bemused, I went to inspect the link…
2171
Hackers Were Inside Citrix for Five Months
Networking software giant Citrix Systems says malicious hackers were inside its networks for five months between 2018 and 2019, making off with personal and financial data on company employees, contractors, interns, job candidates and their dependents. The disclosure comes almost a year after Citrix acknowledged that…
2172
Learn Authentication the Hard Way: Part Three
This is the final installment of a three part series in which we dive into modern application authentication solutions - the hard way. Part One: The Hard Way Part Two: The Hard Way, Continued Part Three: The Hard Way: Return Of The Specification The Hard Way: Return Of The Specification We are continuing our quest to…
2173
JWT is Awesome
Here’s my take on JWT* and why I think it’s amazing, after having migrated hundreds of applications in JP Morgan from a legacy authentication solution. *JWT = JSON Web Token 1) Pro: JWT…
2174
Don't touch my clipboard
Looking for an em dash I was recently trying to find an em dash character to use in a piece of writing. Since I don’t have the shortcut memorized—for future reference, shift+option+minus on Mac—I did a quick search for it. I didn’t see one on the search results page to copy, so I clicked into the first result: “The…
2175
Pay up or we’ll make Google ban your ads
A new email-based extortion scheme apparently is making the rounds, targeting Web site owners serving banner ads through Google’s AdSense program. In this scam, the fraudsters demand bitcoin in exchange for a promise not to flood the publisher’s ads with so much bot and junk traffic that Google’s automated anti-fraud…
2176
Let's Encrypt: an automated certificate authority to encrypt the entire web
Let’s encrypt: an automated certificate authority to encrypt the entire web, Aas et al., CCS’19 This paper tells the story of Let’s Encrypt, from it’s early beginnings in 20…
2177
Tracking systems of TV streaming devices
Watching you watch: the tracking ecosystem of over-the-top TV streaming devices, Moghaddam et al., CCS’19 The results from this paper are all too predictable: channels on Over-The-Top (OTT) s…
2178
2179
2180
Dangerous domain corp.com goes up for sale
As an early domain name investor, Mike O’Connor had by 1994 snatched up several choice online destinations, including bar.com, cafes.com, grill.com, place.com, pub.com and television.com. Some he sold over the years, but for the past 26 years O’Connor refused to auction perhaps the most sensitive domain in his stable…
2181
Your New Medical Credit Score Could Deny You Care
There is now a number, that you can't see, that follows you wherever you go.
2182
2183
Wacom tablets track every app you open
I have a Wacom drawing tablet. I use it to draw cover illustrations for my blog posts, such as this one.
2184
Anatomy of a Rental Phishing Scam
I was recently the (unsuccessful) target of a very well-crafted phishing scam. As part of a housing search a few weeks ago, I was trawling craigslist and zillow for rental opportunities in the SF bay area. I reached out to a beautiful looking rental place to inquire about a tour. Despite my experience as a security…
2185
How to decrypt WhatsApp end-to-end media files
At the center of the "Saudis hacked Bezos" story is a mysterious video file investigators couldn't decrypt, sent by Saudi Crown Prince MBS t...
2186
2187
“Why Using WhatsApp Is Dangerous“
telegra.ph/why-using-whatsapp-is-dangerous-01-30-42020381 points234 commentscited by 3Security & Privacy details
A few months ago I wrote about a WhatsApp backdoor that allowed hackers to access all data on any phone running WhatsApp [1]. Facebook, its parent company, claimed at the time that they had no proof the flaw had ever been used by attackers [2]. Last week it became clear that this backdoor had been exploited to extract…
2188
De-Anonymization via Clickjacking in 2019
This blog post is about my journey to understand the current practice of de-anonymization via the clickjacking technique whereby a malicious website is able to uncover the identity of a visitor, including his full name and possibly other personal information. I don’t present any new information here that isn’t already…
2189
How Popular Is “Sign in with Apple”?
Link to: https://benpackard.github.io/blog/2020-01-28-sign-in-with-apple/
2190
Anatomy of a Scam
There is a lot of material about the not-so-nice VCs who take advantage of young and inexperienced founders. But the reverse also happens, founders that try to get money out of VCs for projects that have zero chance of every coming to fruit. Or worse still, founders that pretend to have something on the go when they…