2761
New
The latest blog posts to take off on Hacker News. 4,335 posts.
2762
Exploding Git Repositories
The git bomb. Crafting compact repos that can't be cloned.
2763
CircleCI trusts 8 analytics companies with your source code and API tokens
When you navigate to your project in CircleCI's UI, Javascript from eight different analytics companies gets loaded and executed in your browser.
2764
iOS Privacy: Easily get a user's Apple ID password, just by asking
I work with U.S. law firms as a non-testifying technical consulting expert on matters involving the Apple platform and iOS apps. Learn more about my litigation consulting.
2765
OnePlus OxygenOS built-in analytics
We take a look at the analytics built into the OxygenOS, the flavour of Android built by phone manufacturer OnePlus.
2766
Elliptic Curve Cryptography for Beginners
A description of ECC without using advanced math
2767
Dangers of CSV Injection
I’ve been doing the local usergroup circuit with this lately and have been asked to write it up.
2768
Equifax Breach Fallout: Your Salary History
In May, KrebsOnSecurity broke a story about lax security at a payroll division of big-three credit bureau Equifax that let identity thieves access personal and financial data on an unknown number of Americans. Incredibly, this same division makes it simple to access detailed salary and employment history on a large…
2769
Tracking friends and strangers using WhatsApp
You and your good buddy, Steve Steveington, are in training for an arduous charity walk. You signed up together on the spur of the moment and pledged to hold each other accountable whilst you got in shape for the big day. However, you have developed reason to suspect that Steve Steveington is losing his commitment to…
2770
2771
Cypherpunk Desert Bus: My Role in the 2016 Zcash Trusted Setup Ceremony
Update: taking this down for now until some questions about the deterministicbuilds are answered; currently I do not believe the Zcash trusted setup shouldbe...
2772
Disqus Demonstrates How to Do Breach Disclosure Right
We all jumped on "the Equifax dumpster fire bandwagon" recently and pointed to all the things that went fundamentally wrong with their disclosure process. But it's equally important that we acknowledge exemplary handling of data breaches when they occur because that's behaviour that should be encouraged. Last week,
2773
2774
Testing FIDO U2F security keys
Last time I reviewed various security keys at a fairly superficial level: basic function, physical characteristics etc. This post considers lower-level behaviour.
2775
USPS ‘Informed Delivery’ Is Stalker’s Dream
A free new service from the U.S. Postal Service that provides scanned images of incoming mail before it is slated to arrive at its destination address is raising eyebrows among security experts who worry about the service’s potential for misuse by private investigators, identity thieves, stalkers or abusive…
2776
TLS 1.2 Session Tickets
Session Tickets, specified in RFC 5077 , are a technique to resume TLS sessions by storing key material encrypted on the clients. In TLS 1.2 they speed up the handshake from two to one round-trips.
2777
Breach at Sonic Drive-In May Have Impacted Millions of Credit, Debit Cards
Sonic Drive-In , a fast-food chain with nearly 3,600 locations across 45 U.S. states, has acknowledged a breach affecting an unknown number of store payment systems. The ongoing breach may have led to a fire sale on millions of stolen credit and debit card accounts that are now being peddled in shadowy underground…
2778
2779
Disqus comments adding third-party ad-tracking
I'm killing Disqus comments on my blog. Here's why.
2780
Equifax or Equiphish?
More than a week after it said most people would be eligible to enroll in a free year of its TrustedID identity theft monitoring service, big three consumer credit bureau Equifax has begun sending out email notifications to people who were able to take the company up on its offer. But in yet another security stumble…
2781
The Ethics of Running a Data Breach Search Service
No matter how much anyone tries to sugar coat it, a service like Have I been pwned [https://haveibeenpwned.com/] (HIBP) which deals with billions of records hacked out of other peoples' systems is always going to sit in a grey area. There are degrees, of course; at one end
2782
Mac OS High Sierra automatically checks EFI firmware each week
Every week, Macs running High Sierra will check the integrity of their EFI firmware, in a bid to detect tampering by malware.
2783
Duck Duck Go: Illusion of Privacy (2013)
There have been several articles in the press recently about users flocking to DuckDuckGo in the wake of the recent NSA snooping revel...
2784
Post a boarding pass on Facebook, get your account stolen
Article removed for legal reasons, sorry. After receiving a Czech version of a cease and desist letter from a legal representative of A. F., I've removed the article. You'll find articles based on my story in “Recommended reading” below, go read them.
2785
Experian Site Can Give Anyone Your Credit Freeze PIN
An alert reader recently pointed my attention to a free online service offered by big-three credit bureau Experian that allows anyone to request the personal identification number (PIN) needed to unlock a consumer credit file that was previously frozen at Experian.
2786
Zero-knowledge proofs, Zcash, and Ethereum
Part 3 of a series on “Privacy on the Blockchain”.
2787
2788
2789
How the Bitcoins Were Stolen from Mt. Gox [video]
The thought “I know PHP! How hard could running an exchange be?” never goes anywhere good.
2790
Chrome to force .dev domains to HTTPS via preloaded HSTS
Google bought the .dev gTLD and Chrome 63 started force-redirecting every .dev domain to HTTPS via preloaded HSTS, breaking local dev setups. Here's why, and …