The latest blog posts to take off on Hacker News. 4,335 posts.
Cryptography code could be understandable if only we commented it. This Poly1305 implementation is an attempt to prove it. It should be readable with just an idea of what MACs are for, a beginner level of Go, and high school math.
After 4 months of waiting, that is the response I got from Widevine, Google’s DRM for web browsers, regarding a license agreement. For the last 2 years I’ve been working on a web browser that now cannot be completed because Google, the creators of the open source browser Chrome, won’t allow DRM in an open source…
Civil Rights, Criminal Justice and Homeland Security
pipdig, WordPress theme and plugin provider, caught distributing malicious code to customers and DDoSing competitors…
I use a password manager. I have 2FA set up on everything. When an organisation asks me to set a recovery question, I generate a 32 character passphrase. I don't use my mother's maiden name or my first pet's birthday on anything sensitive. I monitor my email addresses for breaches, and I regularly check my credit…
How can mass-copying pages from web publishers without a license not be mass-copyright infringement? The weird copyright law exemption that enables AMP Caches.
This article was discussed on Hacker News ( later ), on reddit ( also ), featured in BSD Now 294 . Also check out this Endlessh analysis .
Phone numbers stink for security and authentication. They stink because most of us have so much invested in these digits that they’ve become de facto identities. At the same time, when you lose control over a phone number — maybe it’s hijacked by fraudsters, you got separated or divorced, or you were way late on your…
Hundreds of millions of Facebook users had their account passwords stored in plain text and searchable by thousands of Facebook employees — in some cases going back to 2012, KrebsOnSecurity has learned. Facebook says an ongoing investigation has so far found no indication that employees have abused access to this data.
Switch up your browser and search engine, add some plugins to block surveillance, and get a little technical with DNS servers.
Let’s Encrypt is a revolutionary new certificate authority that provides free certificates in a completely automated process. These certificates are …
Most people who have frozen their credit files with Equifax have been issued a numeric Personal Identification Number (PIN) which is supposed to be required before a freeze can be lifted or thawed. Unfortunately, if you don’t already have an account at the credit bureau’s new myEquifax portal , it may be simple for…
This post shows how to process gigabytes of unstructured data with the Spark framework and using the R language.
Mark Zuckerberg’s announcement of A Privacy-Focused Vision for Social Networking is not some dramatic pivot: it is a growth opportunity for Facebook and a challenge for regulators.
I discovered a Facebook bug which allows me to identify whether a visitor is logged in to a specific Facebook account. It can check hundreds of identities per second.
OTP: One-Time Password TOTP: Time-based One-time Password algorithm 2FA: Two-factor authentication There is no shortage of OTP 2FA apps availiable for your phone, such as Google Authenticator or Duo Mobile. These apps take an initial secret code, and create a TOTP anytime you need a 2FA code for login.… …
FOSS and life. Kushal Das talks here.
Here's an interesting user-hostile pattern which could easily be avoided if programmers and business-people thought like regular humans. I have a Pioneer / Onkyo sound system. It's pretty nice and comes with a (not too crappy) Android app to let me remote control it. One day, the app updated itself. The changelog was…
After nearly a year of work from a growing community of developers, designers, and translators, I'm excited that OnionShare 2 is finally ready. You can download it from onionshare.org. OnionShare is an open source tool for securely and anonymously sending and receiving files using Tor onion services. It
Microsoft is shipping a patch to eliminate SHA-1 hashes from its update process. There’s nothing wrong with eliminating SHA-1—but their reasoning may be very interesting.
By adding two parameters to any Google Search URL, you can replace search results with a Knowledge Graph card of your choice. A malicious user can use this to generate false information or ‘fake news’.
Did your last Yubikey just break? Perhaps you forgot an offline backup password. Maybe you’re just tired of living like a spy and never using smartphones. Whatever it is, you’re here, and you’re finally ready to give up on PGP. That’s great! We’re here to help! No one was sending you encrypted emails anyway, so that’s…
After a while, I decided a write a short blog post about Linux binary reversing CTFs in general. How to approach a binary and solving for beginners. I personally am not a fan of Linux reverse engin…
