2611
Mythology About Security
Ed Felton tweeted a few days ago: “Often hear that the reason today’s Internet is not more secure is that the early designers failed to imagine that security could ever matter. That is a myth…
New
The latest blog posts to take off on Hacker News. 4,335 posts.
2612
OkCupid's “Removed” Visitor API
A blog about programming, the tech industry, and tech education.
2613
Don't give away historic details about yourself
Social media sites are littered with seemingly innocuous little quizzes, games and surveys urging people to reminisce about specific topics, such as “What was your first job,” or “What was your first car?” The problem with participating in these informal surveys is that in doing so you may be inadvertently giving away…
2614
2615
Publishers Haven't Realized How Big a Deal GDPR Is
Baekdal is your premium site for media reports and trend analysis. Subscribe from €7.55/month
2616
2617
The dots do matter: how to scam a Gmail user
Gmail's "dots don't matter" feature lets scammers create an account on, say, Netflix, with your email address but different dots. Results in convincing phishing emails.
2618
Hash-based Signatures: An illustrated Primer
Over the past several years I’ve been privileged to observe two contradictory and fascinating trends. The first is that we’re finally starting to use the cryptography that researchers h…
2619
Apple’s New Ad Conversion Tracking Will Benefit User Privacy
Apple has released new developer APIs that will allow mobile advertising conversion tracking while protecting individual user privacy. The new APIs are part of the StoreKit framework and include a …
2620
2621
Secret Service Warns of Chip Card Scheme
The U.S. Secret Service is warning financial institutions about a new scam involving the temporary theft of chip-based debit cards issued to large corporations. In this scheme, the fraudsters intercept new debit cards in the mail and replace the chips on the cards with chips from old cards. When the unsuspecting…
2622
Google bug bounty for security exploit that influences search results
Short version: For the $12 cost of a domain, I was able to rank in Google search results against Amazon, Walmart etc. for high value money terms in the US. The…
2623
2624
2625
Panera Bread did nothing about its customer data vulnerability for eight months
tl;dr: In August 2017, I reported a vulnerability to Panera Bread that allowed the full name, home address, email address, food/dietary…
2626
Panerabread.com leaks millions of customer records
Panerabread.com , the Web site for the American chain of bakery-cafe fast casual restaurants by the same name, leaked millions of customer records — including names, email and physical addresses, birthdays and the last four digits of the customer’s credit card number — for at least eight months before it was yanked…
2627
APFS encrypted plaintext password found in another log file
UPDATE: PLEASE HELP ME TEST At some point you just need to stop looking and be blissfully ignorant...this was not one of those days. In and update to my previously updated blog article , I have found another instance where the plaintext password was written to system logs. Thi
2628
Reversing a MacOS Kernel Extension
In my last post I covered the basics of kernel debugging in macOS. In this post we will put some of that to use and work through the process of reversing a macOS kernel module. As I said in my last post, in macOS there is a kernel module named “Don’t Steal Mac OS X” (DSMOS) which registers a function with the Mach-O…
2629
2630
Have I Been Pwned Is Now Partnering with 1Password
The penny first dropped for me just over 7 years ago to the day: The only secure password is the one you can't remember [https://www.troyhunt.com/only-secure-password-is-one-you-cant/]. In an era well before the birth of Have I Been Pwned [https://haveibeenpwned.
2631
VPN leaks users’ IPs via WebRTC
VPN leaks users’ IPs via WebRTC: I’ve tested hundred VPN and Proxy providers and 19 of them leaks users’ IPs via WebRTC (16%)
2632
Windows 7 patch for Meltdown enabled arbitrary reads and writes in kernel memory
Did you think Meltdown was bad? Unprivileged applications being able to read kernel memory at speeds possibly as high as megabytes per seco...
2633
Logs in High Sierra Show Plaintext Password for APFS Encrypted External Volumes
UPDATE: PLEASE HELP ME TEST UPATE TO THE UPDATE: Similar log entries are now found in another system log that is more persistent, see the article here . UPDATE: This is still vulnerable on current versions of macOS 10.13.3 when encrypted an ALREADY EXISTING unencrypted APFS volume
2634
Who and what is Coinhive?
Multiple security firms recently identified cryptocurrency mining service Coinhive as the top malicious threat to Web users, thanks to the tendency for Coinhive’s computer code to be used on hacked Web sites to steal the processing power of its visitors’ devices. This post looks at how Coinhive vaulted to the top of…
2635
2636
The Legitimisation of Have I Been Pwned
There's no way to sugar-coat this: Have I Been Pwned [https://haveibeenpwned.com/] (HIBP) only exists due to a whole bunch of highly illegal activity that has harmed many individuals and organisations alike. That harm extends all the way from those in data breaches feeling a sense of
2637
Breaking the Ledger Security Model
In this post, I’m going to discuss a vulnerability I discovered in Ledger hardware wallets. The vulnerability arose due to Ledger’s use of a custom architecture to work around many of the limitations of their Secure Element.
2638
2639
De-anonymizing programmers from executable binaries
When coding style survives compilation: de-anonymizing programmers from executable binaries Caliskan et al., NDSS’18 As a programmer you have a unique style, and stylometry techniques can be used t…
2640
The 600+ Companies PayPal Shares Your Data With
One of the effects of GDPR—the new EU General Data Protection Regulation—is that we’re all going to be learning a lot more about who collects our data and what they do with it. Consider PayPal, that just released a list of over 600 companies they share customer data with. Here’s a good visualization of that data. Is…