3091
Running a private mail server for six years, easy peasy
Motivation The Right Reasons Tech Stack Implementation Mail rate and Spaminess Ongoing Maintenance Alternatives Conclusion
New
The latest blog posts to take off on Hacker News. 8,771 posts.
3092
Find You: Building a stealth AirTag clone
We built an AirTag clone capable of silently and continuously tracking someone. The device accomplishes this by sending just one beacon per generated public key, thereby staying invisible to tracking notifications for iOS users and Apple’s Tracker Detect Android app.
3093
3094
A pentester gets root - step by step example
DevOops is a retired machine on HackTheBox. This write-up is a walk through the methodology that leads to root shell.
3095
Compromising Angular via expired NPM publisher email domains
A Hacker's Blog of Unintended Use and Insomnia.
3096
3097
3098
Plausibly deniable encryption (2020)
It is safe to assume that in any useful cryptosystem C k there exists at least one person with access to the key k . An adversary with sufficient leverage can bypass the computational cost of a conventional attack by exerting their influence on this person.
3099
3100
Who is squatting IPv4 addresses?
It’s an established fact on the internet that we have ran out of IP(v4) addresses , and we are starting to see the pressure on obtaining IPv4 space. For example if you want to get a /24 block from RIPE NCC when you sign up as a member, then you are currently looking at a 2 month wait for a recycled IPv4 /24 block .
3101
NSA's Backdoor of the PX1000-Cr
In 1983, the PX-1000 pocket telex used DES encryption. But with help of Philips, the NSA managed to replace DES with an alternative (weaker) algorithm that they could break. That NSA algorithm is now broken.
3102
Current MFA fatigue attack campaign targeting Microsoft Office 365 users
We provide around-the-clock threat detection and incident response, backed by expert consulting to keep your organization secure.
3103
Study: Effectiveness of Apple's app tracking transparency
Does it stop third-party tracking? Or is it just an illusion of privacy?
3104
Aserto: Developer API for permissions and RBAC
No one should build permissions and RBAC on their own. Aserto's authorization-as-a-service platform is here to make sure of it!
3105
Everything we're told about website identity assurance is wrong
I have a vehement dislike for misleading advertising. We see it every day; weight loss pills, make money fast schemes and if you travel in the same circles I do, claims that extended validation (EV) certificates actually do something useful: > Why are you still claiming this @digicert [https://twitter.com/
3106
SendGrid appends a tracking pixel even when disabled
Commenting, venting, or ranting. Usually about entrepreneurship, tech, or self-reflection.
3107
How can you be fooled by the U+202E trick? (2013)
Ethical Hacking, Malware Analysis, Disinfection…2022254 points140 commentsSecurity & Privacy details
Ethical Hacking, Malware Analysis, Disinfection Techniques, Information Security, Pentesting Techniques and all related with Computer Security.
3108
Don't use text pixelation to redact sensitive information
See why you should never use pixelation for redacting text and why it is a surefire way to get your data leaked. Learn from security researcher Dan Petro.
3109
MikroTik authentication revealed
A deep-dive into MikroTik's hand-rolled Elliptic Curve Secure Remote Protocol (EC-SRP) cryptography used in client-server authentication
3110
The harmful consequences of the robustness principle
The robustness principle, often phrased as "be conservative in what you send, and liberal in what you accept", has long guided the design and implementation of Internet protocols. The posture this statement advocates promotes interoperability in the short term, but can negatively affect the protocol ecosystem over…
3111
An Open Letter to Pixsy CEO Kain Jones, Who Keeps Sending Me Legal Threats
Once is happenstance. Twice is coincidence. Three times is enemy action.
3112
Consent, GDPR and Google Analytics
A discussion about the Austrian Google Analytics case, and if consent of the user would have made the difference.
3113
CORS is not meant to secure an API endpoint
CORS does not secure your API: why browser-side API keys are unsafe, and how to protect Drupal JSON:API endpoints with proper authentication.
3114
Privacy preserving attribution for advertising
Advertising provides critical support for the Web. We’ve been looking to apply privacy preserving advertising technology to the attribution problem, so t
3115
Lasershark: Fast, bidirectional communication into air-gapped systems
We present a novel approach to infiltrate data to air-gapped systems without any additional hardware on-site.
3116
Key senators have voted for the anti-encryption EARN IT act
Earlier today, the Senate Judiciary Committee voted to advance the dangerous EARN IT bill. We’re disappointed to see the committee advance this misguided bill. If enacted, EARN IT will put massive legal pressure on internet companies both large and small to stop using encryption and instead scan...
3117
An update on AirTag and unwanted tracking
Apple announced it has identified even more ways to update AirTag safety warnings and help guard against unwanted tracking of people and property.
3118
Attacking an Ethereum L2 with Unbridled Optimism
On 2/2/2022, I reported a critical security issue to Optimism—an "L2 scaling solution" for Ethereum—that would allow an attacker to replicate money on any chain using their "OVM 2.0" fork of go-ethereum (which they call l2geth).
3119
Use of Google Analytics declared illegal by French data protection authority
In reaction to the invalidation of the Privacy Shield in July 2020 by the Court of Justice of the European Union (CJEU), US President Joe Biden adopted on 7 October 2022 a new legal framework (Executive Order) to strengthen safeguards on the collection and use of personal data by US intelligence agencies.
3120
Web hacking techniques of 2021
Welcome to the Top 10 (new) Web Hacking Techniques of 2021, the latest iteration of our annual community-powered effort to identify the most significant web security research released in the last year