2311
Trust is good, control is better: Reproducible builds at F-Droid
Free Software is a great thing, because it allows users to check that apps are doing what they pretend to do. But almost nobody compiles apps themselves.
New
The latest blog posts to take off on Hacker News. 4,335 posts.
2312
2313
QuickBooks Cloud Hosting Firm iNSYNQ Hit in Ransomware Attack
Cloud hosting provider iNSYNQ says it is trying to recover from a ransomware attack that shut down its network and has left customers unable to access their accounting data for the past three days. Unfortunately for iNSYNQ, the company appears to be turning a deaf ear to the increasingly anxious cries from its users…
2314
2315
Authentication and the Have I Been Pwned API
The very first feature I added to Have I Been Pwned after I launched it back in December 2013 was the public API [https://www.troyhunt.com/have-i-been-pwned-you-can-now-ask-api/]. My thinking at the time was that it would make the data more easily
2316
XSS attacks on Googlebot allow search index manipulation
Googlebot is based on Google Chrome version 41 (2015), and therefore it has no XSS Auditor, which later versions of Chrome use to protect the user from XSS attacks…
2317
2318
How I Could Have Hacked Any Instagram Account
This article is about how I found a vulnerability on Instagram that allowed me to hack any Instagram account without consent permission. Facebook and Instagram security team fixed the issue and rewarded me $30000 as a part of their bounty program. Facebook is working constantly to improve its security controls on all…
2319
HTTP Security Headers – A Complete Guide
A description of each security header, why it is important, and how to configure your website in a secure way.
2320
Github became the web's largest font piracy site (2017)
Front-end antics and typographic mischievousness
2321
Cracking My Windshield and Earning $10k on the Tesla Bug Bounty Program
One of the more interesting things I've had the opportunity to hack on is the Tesla Model 3. It has a built in web browser, free premium LTE, and over-the-air software updates. It's a network connected computer on wheels that drives really fast.
2322
2323
A problem worse than Zoom?
On macOS, an app can register to handle URL schemes. Web browsers such as Safari, Chrome, and Firefox register to handle the schemes for web pages, http or https . Non-browser apps may register to handle other URL schemes; for example, an email client may register to handle the well known mailto scheme. When a URL is…
2324
x86 API Hooking Demystified (2012)
Simak Live Draw SDY Tercepat Hari Ini, Hasil Live SDY, Live Result Sidney, Dan Rekap Togel SDY Lengkap Dan Akurat Hanya Di Sini.
2325
2326
Strong_password Rubygem hijacked
I recently updated minor and patch versions of the gems our Rails app uses. We want to keep dependencies fresh, bugs fixed, security vulnerabilities addressed while maintaining a high chance ...
2327
Cryptography Dispatches: Hello World, and OpenPGP Is Broken
This is the inaugural issue of Cryptography Dispatches, meant to be quick, frequent and lightly edited discussions of cryptographic topics. Longer form can be found at blog.filippo.io. If you are not reading this in your email client, you can subscribe here .
2328
2329
A better zip bomb
This article shows how to construct a non-recursive zip bomb that achieves a high compression ratio by overlapping files inside the zip container. "Non-recursive" means that it does not rely on a decompressor's recursively unpacking zip files nested within zip files: it expands fully after a single round of…
2330
Firefox Local Files Theft – Not Patched Yet
Recently, I was performing a research on Same Origin Policy attacks, I managed to realize that the la version of Firefox (currently 67) is vulnerable to local files theft attack (on any supported OS), due to improper implementation of Same Origin Policy for file scheme URIs. Let’s go over the PoC details then I will…
2331
Superhuman embeds tracking pixels in user emails
Over the past 25 years, email has weaved itself into the daily fabric of life. Our inboxes contain everything from very personal letters, to work correspondence, to unsolicited inbound sales pitches. In many ways, they are an extension of our …
2332
Freeing My Phone from Google
Phones are so full of ads that you don’t even notice them anymore. Suggestions and notifications you didn’t ask for, tracking mechanisms you don’t even know are there, services over which you have no control. It’s absurd how much smartphones, a large extension of our private and social lives, are controlled and…
2333
I was seven words away from being spear-phished
Three weeks ago I received a very flattering email from the University of Cambridge, asking me to judge the Adam Smith Prize for Economics:
2334
iPhone Apps Surreptitiously Communicated with Unknown Servers
Long news article (alternate source) on iPhone privacy, specifically the enormous amount of data your apps are collecting without your knowledge. A lot of this happens in the middle of the night, when you’re probably not otherwise using your phone: IPhone apps I discovered tracking me by passing information to third…
2335
Trinity: PSP Emulator Escape
Trinity is a fully chained exploit for the PS Vita™ consisting of six unique vulnerabilities. It is based on a decade of knowledge and research. The source code of Trinity can be found here.
2336
2337
2338
FBI agent accidentally reveals own 8chan posts
Updated August 4, 2019: Added link to “A.C.L.U. Says F.B.I. Funded ‘Army’ To Terrorize Young War Dissidents” The unsealing of an application for a search warrant by the federal governme…
2339
2340
Project Svalbard: The Future of Have I Been Pwned
Back in 2013, I was beginning to get the sense that data breaches were becoming a big thing. The prevalence of them seemed to be really ramping up as was the impact they were having on those of us that found ourselves in them, myself included. Increasingly, I was writing