2581
New
The latest blog posts to take off on Hacker News. 4,335 posts.
2582
Chinese Government Fabricates Social Media Posts for Strategic Distraction
The Chinese government has long been suspected of hiring as many as 2,000,000 people to surreptitiously insert huge numbers of pseudonymous and other deceptive writings into the stream of real social media posts, as if they were the genuine opinions of ordinary people. Many academics, and most journalists and…
2583
GDPR: Don't Panic
In another week the GDPR , or the General Data Protection Regulation will become enforceable and it appears that unlike any other law to date this particular one has the interesting side effect of causing mass hysteria in the otherwise rational tech sector.
2584
Tracking Firm LocationSmart Leaked Location Data for Customers of All Major U.S. Mobile Carriers Without Consent in Real Time Via Its Web Site
LocationSmart , a U.S. based company that acts as an aggregator of real-time data about the precise location of mobile phone devices, has been leaking this information to anyone via a buggy component of its Web site — without the need for any password or other form of authentication or authorization — KrebsOnSecurity…
2585
LocationSmart Leaked Location Data for All Major U.S. Carriers in Real Time
On May 16th, I found a vulnerability in the LocationSmart website which allowed anyone, with no prior authentication or consent, to obtain the realtime location of any cellphone in the US to within…
2586
Yubico sent marketing email to address submitted for product replacement
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
2587
2588
2589
Think You’ve Got Your Credit Freezes Covered? Think Again
I spent a few days last week speaking at and attending a conference on responding to identity theft. The forum was held in Florida, one of the major epicenters for identity fraud complaints in United States. One gripe I heard from several presenters was that identity thieves increasingly are finding ways to open new…
2590
A Recycled IP Address Caused Me to Pirate Books by Accident
Let me tell you a story on how a subdomain of mine managed to serve 390,000+ PDF books without any of my servers being compromised.
2591
2592
De-Googling my phone
I’ve been a professional Free Software developer in the GNU/Linux area for 14 years now, and a hobbyist developer and user for much longer. For some reason that never extended much to the smartphone world, beyond running LineageOS on my older phones (my current Sony Xperia is still under warranty and I’m fine with the…
2593
7-Zip: From Uninitialized Memory to Remote Code Execution
Blog about anti-virus software vulnerabilities.
2594
Yubikey/Smartcard backed TLS servers
It has become clear that storing secrets in computers is hard. The best demo to the world that storing secrets on “online” computers is hard and sometimes devastating, is the large amounts of cryptocurrency theft due to critical keys being in memory of systems directly or indirectly connected to the internet.
2595
A Call of Duty exploit
A few years ago, I became aware of a security issue in most Call of Duty games. Although I did not discover it myself, I thought it might be interesting to see what it could be used for. Without going into detail, this security issue allows users playing a Call of Duty match to cause a buffer overflow on the host’s…
2596
86% of CrashCrate subscribers used passwords already leaked in other breaches
A couple of months ago, I launched version 2 of Pwned Passwords [https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/]. This is a collection of over half a billion passwords which have previously appeared in data breaches and the intention is that they're used as a
2597
Making art with SSH key randomart
SSH is everywhere in the development or operations world now. For development it’s what allows you to push to GitHub. For operations it’s what allows you to reasonably securely log into Linux servers.
2598
Unprivileged Docker Builds – A Proof of Concept
I work at a very ‘locked-down’ enterprise, where direct access to Docker is effectively verboten.
2599
The NSA is not made of magic (2014)
I am regularly asked what is the most surprising thing about the Snowden NSA documents. It’s this: the NSA is not made of magic. Its tools are no different from what we have in our world, it’s just better-funded. X-KEYSCORE is Bro plus memory. FOXACID is Metasploit with a budget. QUANTUM is AirPwn with a seriously…
2600
A Few Thoughts on Ray Ozzie’s “Clear” Proposal
Yesterday I happened upon a Wired piece by Steven Levy that covers Ray Ozzie’s proposal for “CLEAR”. I’m quoted at the end of the piece (saying nothing much), so I knew the piece was coming. …
2601
Credit card fraud warning signs
Avoid accepting fraudulent credit card orders by paying attention to these warning signs.
2602
Fully Homomorphic Encryption: Secret Key Homomorphic Encryption Over Integers
In the previous post we discussed homomorphic encryption in it’s most abstract terms we presented Paillier as a partially homomorphic encryption . Thank you @mortendahlcs for making a clarification about the terms described :
2603
The Power to Revoke Lies with the Certificate Authority
For those that read my blog often you may have seen me talk about EV certificates before. From a technical perspective there are many things that I don't agree with about EV certificates and from a non-technical perspective there are many things I don't like about the
2604
2605
A more privacy-friendly blog
Over the years, I have implemented some changes to this blog to make it more privacy-friendly.
2606
Hijack of Amazon’s domain service used to reroute web traffic for two hours
Between 11am until 1pm UTC today, DNS traffic — the phone book of the internet, routing you to your favourite websites — was hijacked by an…
2607
2608
Fake ad blockers in Chrome Web Store
People searching for a Google Chrome ad blocking extension have to choose from dozens of similarly named extensions. Only few of these are legitimate, most are forks of open source ad blockers trying to attract users with misleading extension names and descriptions. What are these up to? Thanks to Andrey Meshkov we…
2609
GitHub Pages generated a TLS cert for my own domain
How the hell is this blog served over HTTPS by GitHub Pages?
2610
Reverse Engineering the Soundcloud API
Hi guys, in this post we will learn how to bypass downloading restrictions on Soundcloud. We will create a Python script which will allow us to download even…