1
Why Deleting Sensitive Information from GitHub Doesn't Save You
Security and Programming Blog
New
The latest blog posts to take off on Hacker News. 204 posts.
2
On the new Snowden documents
If you don’t follow NSA news obsessively, you might have missed yesterday’s massive Snowden document dump from Der Spiegel. The documents provide a great deal of insight into how the NSA brea…
3
sean cassidy : Don't Pipe to your Shell
It's everywhere . Sometimes they tell you to ignore certificates as well (looking at you, Salt). That's dumb.
4
When security goes right
A few weeks ago, I heard that my slow and unreliable ISP was raising their prices, and I decided to look around for a better ISP. I found one in the form of Novus , which has fibre runs to towers around the Vancouver area. I signed up; they came to the building and placed the necessary patch cable in the basement…
5
Did North Korea Really Attack Sony?
I am deeply skeptical of the FBI’s announcement on Friday that North Korea was behind last month’s Sony hack. The agency’s evidence is tenuous, and I have a hard time believing it. But I also have trouble believing that the US government would make the accusation this formally if officials didn’t believe it. Clues in…
6
Docker Image Insecurity
Docker's report that a downloaded image is "verified" is based solely on the presence of a signed manifest, and Docker never verifies the image checksum from the manifest.
7
8
9
Why the Sony hack is unlikely to be the work of North Korea
Everyone seems to be eager to pin the blame for the Sony hack on North Korea. However, I think it’s unlikely. Here’s why:1. The broken English looks deliberately bad and doesn’t e…
10
CSRF in Doorkeeper OAuth2 gem
I read a post about CSRF on DigitalOcean (in Russian) by Sergey Belove . My first reaction was, obviously, how come ? DigitalOcean is not k...
11
12
Comments on the Sony Hack
I don’t have a lot to say about the Sony hack, which seems to still be ongoing. I want to highlight a few points, though. At this point, the attacks seem to be a few hackers and not the North Korean government. (My guess is that it’s not an insider, either.) That we live in the world where we aren’t sure if any given…
13
Yik Yak Hack
Yik Yak is an anonymous, controversial social media application that allows people to make posts that are visible to other users within ~2 miles. Often landing a top 10 spot in the iOS App Store, this app has become increasingly popular with high school and college students. Due to the anonymous nature of the app…
14
New Paypal gateway UI susceptible to spoofing
Hey. I decided to get a paid plan on Github and Paypal looked like a good payment option to me. Click the blue button here : This looks ...
15
The No CAPTCHA problem
When I read about No CAPTCHA for the first time I was really excited. Did we finally find a better solution? Hashcash? Or what? Finally it...
16
Hacking PayPal Accounts with one click
Today I am going to publicly disclose a critical vulnerability I have found during my research in PayPal, This vulnerability enabled me to completely bypass the CSRF Prevention System implemented by PayPal, The vulnerability is patched very fast and PayPal paid me the maximum bounty they give ;).
17
“Invalid username or password” is a useless security measure
Login attempts fail because computer users can't remember their email or didn't input the right password. Most websites on the Internet won't tell you which one is actually incorrect.
18
How NSA and GCHQ are tapping internet cables
A weblog about Signals Intelligence, Communications Security and top level telecommunications equipment
19
Nobody expects CDATA sections in XML
I made a very explicit, pragmatic design decision with afl-fuzz : for performance and reliability reasons, I did not want to get into stati...
20
Inline PGP signatures considered harmful
People often suggest that inline PGP signatures in e-mail are somehow more compatible or more acceptable than using PGP/MIME . This is a mistake. Inline PGP signatures are prone to several failure modes, up to and including undetectable message tampering.
21
Zero Knowledge Proofs: An illustrated primer
One of the best things about modern cryptography is the beautiful terminology. You could start any number of punk bands (or Tumblrs) named after cryptography terms like ‘hard-core predicate&#…
22
The Increasing Trend of Online Extortion
I heard about this guy, walked into a federal bank with a portable phone, handed the phone to the teller, the guy on the other end of the phone said: “We got this guy’s little girl, and if you don’t give him all your money, we’re gonna
23
24
25
26
Google disables SSL search at BT’s request
Update – Since this was posted, Max Allan and Damion Yates have investigated further and found that BT are intercepting DNS queries and replying with doctored DNS results, which I didn’…
27
Unraveling NSA's TURBULENCE Programs
The NSA TURBULENCE program was first revealed in 2007 by the Baltimore Sun for being over-budget and poorly-managed 1 2 . Many documents from the Snowden trove from the past two years reference parts of this program, but no coherent story or overview of how these programs operate together has been described. This is…
28
What does the NSA think of academic cryptographers?
Brighten Godfrey was one of my officemates when we were grad students at Berkeley. He’s now a highly-successful computer networking professor at the University of Illinois Urbana-Champaign, …
29
All cameras are police cameras
Welcome to The Nor, a series of essays by James Bridle commissioned by the Hayward Gallery in 2014/5. In order, the essays are: All Cameras Are Police Cameras , Living in the Electromagnetic Spectrum , and Low Latency , as well as an Epilogue . These are accompanied by photographs and a map , and additional content…
30
Pulling JPEGs out of thin air
This is an interesting demonstration of the capabilities of afl ; I was actually pretty surprised that it worked! $ mkdir in_dir $ echo ' h...