301
New
The latest blog posts to take off on Hacker News. 391 posts.
302
303
304
305
We may have witnessed a NSA "Shotgiant" TAO-like action
Last Friday, the New York Times reported that the NSA has hacked/infiltrated Huawei, a big Chinese network hardware firm. We may have witne...
306
307
How to design an elliptic-curve signature system
Earlier this month a new paper by Naomi Benger, Joop van de Pol, Nigel Smart, and Yuval Yarom hit the news . The paper explains how to recover secret keys from OpenSSL's implementation of ECDSA-secp256k1 using timing information from "as little as 200 signatures"; ECDSA-secp256k1 is the signature system used by…
308
Huawei and Cisco's Source Code: Correcting the Record
Last week, I wrote about statements made by Charles Ding, Huawei’s Senior Vice President and Chief Representative in the U.S., Mr. Ding explained the
309
310
311
Microsoft Says: Come Back with a Warrant, Unless You’re Microsoft
Update (March 28, 2014): Microsoft has announced a new policy which is described in a new post. EFF has long argued that law enforcement agencies must get a warrant when they ask Internet companies for the content of their users’ communications. In 2013, as part of our annual Who Has Your Back...
312
Npm security post-mortem
npm Blog (Archive); updates from the npm team are now published on the GitHub Blog and the GitHub Changelog
313
Los Angeles Cops Argue All Cars in LA Are Under Investigation
Do you drive a car in the greater Los Angeles Metropolitan area? According to the L.A. Police Department and L.A. Sheriff’s Department, your car is part of a vast criminal investigation. The agencies took a novel approach in the briefs they filed in EFF and the ACLU of Southern California’s...
314
Google Docs Users Targeted by Phishing Scam
Broadcom Community - VMTN, Mainframe, Symantec, Carbon Black
315
316
The newest threat on the official Android market
Google Play: Whats the newest threat on the official Android market?
317
How To Safely Generate A Random Number
Use urandom. That is the whole answer. Why the entropy-depletion story is a myth, and why userspace CSPRNGs are behind most of the last decade's randomness disasters.
318
How to steal Bitcoins that are protected by weak passphrases
Every Bitcoin address is based on a secret key, from which the public key (associated to a Bitcoin address) is calculated. Once you have the private key for an address, you have the control of that address and can use it to transfer funds.
319
Google Exploit – Steal Account Login Email Addresses
I found a bug that allowed me to find anyone with a Google+ account's login email address. This could be used to target specific people for spear phishing.
320
Myths about /dev/urandom
Randomness, entropy, and the Linux kernel.
321
322
2,000 NHS Security Vulnerabilities Disclosed
This is part 3 of a series of blog posts looking at the security of the UK Government's web infrastructure. Britain's National Health Service is riddled with old and insecure WordPress-based websites. Many of these sites have severe flaws including being vulnerable to XSS attacks. There is absolutely no suggestion…
323
Mexican Protest Site Censored by GoDaddy with the U.S. Embassy's Help
The Mexican website 1dmx.org (mirror here), was set up in the wake of a set of controversial December 1st 2012 protests against the inauguration of the new President of Mexico, Enrique Peña Nieto. For a year, the site served as a source of information, news, discussion and commentary from the point...
324
325
Downloading Software Safely Is Nearly Impossible
Let’s say you have a brand-new Windows laptop and you’re just oh, so happy. You’re pretty sure the NSA did not interdict it during shipment , and thus that it comes only with the flaky goatware Microsoft, Lenovo, and any number of Lenovo’s business partners intended for it to have. Now all you need is an SSH client so…
326
327
TLS Symmetric Crypto
At this time last year, the TLS world was mostly running on RC4-SHA and AES-CBC. The Lucky 13 attack against CBC in TLS had just been published and I had spent most of January writing patches for OpenSSL and NSS to implement constant-time CBC decoding. The RC4 biases paper is still a couple of week away, but it's…
328
Privacy Protects Bothersome People (2013)
We need to support privacy, not for those of us who have "nothing to hide", but for bothersome people like investigative journalists and activists, without which our democracy would crumble
329
German freemail sites trick Firefox and Chrome users into removing AdBlock
German freemail heavyweights web.de and gmx.net (several millions of users combined) are using deceptive techniques in order to manipulate Firefox and Chrome users into removing AdBlock and its var…
330
Surveillance Evangelist Arrested in California
FBI agents arrested a Mexican tycoon named Jose Susumo Azano Matsura at his Coronado, Calif. home on Wednesday as part of a political bribery investigation based on captured emails, seized banking records, and covertly recorded conversations. The unfolding scandal is soaked in irony: Azano is a...