271
When it comes to composition and length, passwords mostly don't matter
When it comes to composition and length, your password (mostly) doesn’t matter.
New
The latest blog posts to take off on Hacker News. 579 posts.
272
x86 API Hooking Demystified (2012)
Simak Live Draw SDY Tercepat Hari Ini, Hasil Live SDY, Live Result Sidney, Dan Rekap Togel SDY Lengkap Dan Akurat Hanya Di Sini.
273
Camera and microphone require HTTPS in Firefox 68
As of Firefox 68—releasing next week—camera and microphone will require an https connection to work. Access from insecure http will cease to work, matching how Chrome works. Camera and microhone are powerful features, and Firefox will now only expose them in secure contexts, a security and privacy improvement. Largely…
274
275
276
RSA is a fragile cryptosystem
Here at Trail of Bits we review a lot of code. From major open source projects to exciting new proprietary software, we’ve seen it all. But one common denominator in all of these systems is that for some inexplicable reason people still seem to think RSA is a good cryptosystem to use. Let me save […]
277
Strong_password Rubygem hijacked
I recently updated minor and patch versions of the gems our Rails app uses. We want to keep dependencies fresh, bugs fixed, security vulnerabilities addressed while maintaining a high chance ...
278
Cryptography Dispatches: Hello World, and OpenPGP Is Broken
This is the inaugural issue of Cryptography Dispatches, meant to be quick, frequent and lightly edited discussions of cryptographic topics. Longer form can be found at blog.filippo.io. If you are not reading this in your email client, you can subscribe here .
279
280
281
A better zip bomb
This article shows how to construct a non-recursive zip bomb that achieves a high compression ratio by overlapping files inside the zip container. "Non-recursive" means that it does not rely on a decompressor's recursively unpacking zip files nested within zip files: it expands fully after a single round of…
282
Attunity Data Leak: Vendor for half the Fortune 100 exposed terabyte of backups
Backups ensure data continuity, but they're also a surface of risk. See how Fortune 100 vendor Attunity exposed nearly a terabyte of internal backups.
283
Firefox Local Files Theft – Not Patched Yet
Recently, I was performing a research on Same Origin Policy attacks, I managed to realize that the la version of Firefox (currently 67) is vulnerable to local files theft attack (on any supported OS), due to improper implementation of Same Origin Policy for file scheme URIs. Let’s go over the PoC details then I will…
284
Superhuman embeds tracking pixels in user emails
Over the past 25 years, email has weaved itself into the daily fabric of life. Our inboxes contain everything from very personal letters, to work correspondence, to unsolicited inbound sales pitches. In many ways, they are an extension of our …
285
Tightening up Privacy in Matrix
Matrix, the open protocol for secure decentralised communications
286
Attempts to Censor AntiPolygraph.org
AntiPolygraph.org has received a rather unpleasant letter from James D’Loughy, a lawyer representing NITV Federal Services, LLC (NITV), which markets a scientifically baseless voice-based lie detector called the “Computer Voice Stress Analyzer,” and its president, self-described “Renaissance Man” “Dr.” Charles Humble…
287
Open Letter from the OpenID Foundation to Apple Regarding Sign in with Apple
June 27, 2019Mr. Craig Federighi Apple Senior Vice President of Software Engineering One Apple Park Way Cupertino, CA 95014RE: Open Letter from the OpenID Foundation to Apple Regarding Sign In with AppleDear Mr. Federighi,The OpenID Foundation applauds Apple’s efforts to allow users to login to third-party mobile and…
288
Freeing My Phone from Google
Phones are so full of ads that you don’t even notice them anymore. Suggestions and notifications you didn’t ask for, tracking mechanisms you don’t even know are there, services over which you have no control. It’s absurd how much smartphones, a large extension of our private and social lives, are controlled and…
289
AMD Responds to WSJ ‘Keys to the Kingdom’ Story
A AMD oferece soluções de computação adaptativa e de alto desempenho de liderança para promover IA de data center, PCs com IA, dispositivos de borda inteligentes, jogos e muito mais.
290
OS X/Linker: New Mac malware attempts zero-day Gatekeeper bypass
Last week, Intego researchers discovered new Mac malware, OSX/Linker, that attempts to leverage a recently disclosed zero-day flaw in macOS' Gatekeeper protection. Let's examine what we know about this latest Mac malware campaign. What is the back story? Before digging into the OSX/Linker malware, it would be helpful…
291
EC2 Instance Connect
Discover more about what's new at AWS with Introducing Amazon EC2 Instance Connect
292
I was seven words away from being spear-phished
Three weeks ago I received a very flattering email from the University of Cambridge, asking me to judge the Adam Smith Prize for Economics:
293
Hey advertisers, track this
If it feels like the ads chasing you across the internet know you a little too well, it’s because they do (unless you’re an avid user of ad blockers, i
294
AWS VPC Traffic Mirroring
Running a complex network is not an easy job. In addition to simply keeping it up and running, you need to keep an ever-watchful eye out for unusual traffic patterns or content that could signify a network intrusion, a compromised instance, or some other anomaly. VPC Traffic Mirroring Today we are launching VPC…
295
iPhone Apps Surreptitiously Communicated with Unknown Servers
Long news article (alternate source) on iPhone privacy, specifically the enormous amount of data your apps are collecting without your knowledge. A lot of this happens in the middle of the night, when you’re probably not otherwise using your phone: IPhone apps I discovered tracking me by passing information to third…
296
AWS Control Tower
Earlier this month I met with an enterprise-scale AWS customer. They told me that they are planning to go all-in on AWS, and want to benefit from all that we have learned about setting up and running AWS at scale. In addition to setting up a Cloud Center of Excellence, they want to set up […]
297
Trinity: PSP Emulator Escape
Trinity is a fully chained exploit for the PS Vita™ consisting of six unique vulnerabilities. It is based on a decade of knowledge and research. The source code of Trinity can be found here.
298
AMP for email is bad
The US antitrust complaint against Google shows that the claim 'to improve speed with AMP' was false from the start. It is simply a measure to increase ad revenue.
299
Making Containers More Isolated: An Overview of Sandboxed Container Technologies
Currently available container-based infrastructure has limitations because containers are not truly sandboxed and share the host OS kernel. The root of the problem is the weak separation between containers when the host OS creates a virtualized userland for each container. This blog covers four unique projects from…
300
