2431
Skype contact lists may have been exposed (2017)
UPDATE: February 14, 2019: Since writing this article in late 2017, Microsoft seems to have made a change that makes it a bit harder to reverse
New
The latest blog posts to take off on Hacker News. 4,335 posts.
2432
2433
Blockchain and Trust
In his 2008 white paper that first proposed bitcoin, the anonymous Satoshi Nakamoto concluded with: “We have proposed a system for electronic transactions without relying on trust.” He was referring to blockchain, the system behind bitcoin cryptocurrency. The circumvention of trust is a great promise, but it’s just…
2434
2435
2436
How to fight the surveillance economy
Stop supporting data harvesting business models by picking alternative services and ad channels. Also, please don’t share this on Facebook.
2437
I scanned Austria
Personal Blog of Christian Haschek
2438
DNS servers that offer privacy and filtering
If you’re a programmer, a systems administrator, or really any type of IT worker, you probably have your favorite go-to IP addresses for troubleshooting.
2439
2440
2441
Obfuscated JavaScript, scam emails, and American Express
Reverse-engineering an obfuscated American Express phishing campaign from email to exfiltration endpoint.
2442
2443
2444
Everything you ever wanted to know about building a secure password reset (2012)
This content is now available in the Pluralsight course "Secure Account Management Fundamentals" [http://www.pluralsight.com/courses/secure-account-management-fundamentals] Recently I’ve had a couple of opportunities to think again about how a secure password reset function should operate, firstly whilst building this…
2445
2446
2447
The Day I Fell in Love with Fuzzing
In 2007 I wrote a pair of modding tools, binitools , for a space trading and combat simulation game named Freelancer . The game stores its non-art assets in the format of “binary INI” files, or “BINI” files. The motivation for the binary format over traditional INI files was probably performance: it’s faster to load…
2448
We value your privacy now, but maybe not later
Everybody knows these modal dialogs when visiting a website for the first time that ask you to accept cookies and consent to being tracked by third-party advertising networks. It actually became a habit for me to always click through these things and reject any kind of tracking or use of my personal information except…
2449
Remote code execution vulnerability in apt/apt-get
tl;dr I found a vulnerability in apt that allows a network man-in-the-middle (or a malicious package mirror) to execute arbitrary code as root on a machine i...
2450
2451
773M Password ‘Megabreach’ Is Years Old
My inbox and Twitter messages positively lit up today with people forwarding stories from Wired and other publications about a supposedly new trove of nearly 773 million unique email addresses and 21 million unique passwords that were posted to a hacking forum. A story in The Guardian breathlessly dubbed it “the…
2452
The 773M Record “Collection #1” Data Breach
Many people will land on this page after learning that their email address has appeared in a data breach I've called "Collection #1". Most of them won't have a tech background or be familiar with the concept of credential stuffing so I'm going to write this post
2453
Airbnb and security camera disclosure
This post got *a lot* of attention. I’m super happy about that because I had been afraid that we had reached a point where we collectively didn’t care about cameras or meaningful disclosure. Although, to that point here’s a comment someone posted: "I just assume that there will be camera constantly recording when I…
2454
Reverse engineering GoDaddy's tracking script
An article by Igor Kromin has provided an insight into a practice by GoDaddy involving injecting Javascript into customer sites. Several people expressed interest in a breakdown of the script - so here it is. Please review Igor’s original blog for further background
2455
The curious case of the Raspberry Pi in the network closet
Personal Blog of Christian Haschek
2456
An Almost-Secret Algorithm Researchers Used to Break Thousands of RSA Keys
RSA encryption allows for anyone to send me messages that only I can decode. To set this up, I select two large random primes $latex p$ and $latex q$ (each of which is hundreds of bits long), and r…
2457
2458
2459
2460
GoDaddy injecting JavaScript into websites and how to stop it
I recently started having issues with the admin interface of a website I run and decided to check the browser console to see if any errors were being displayed there. There were and among them was an error stating that a JavaScript map file being loaded (and failing) that I did not recognise. This meant that the…