301
NSA in P/poly: The Power of Precomputation
Even after the Snowden revelations, there remained at least one big mystery about what the NSA was doing and how. The NSA’s classified 2013 budget request mentioned, as a priority item, R…
New
The latest blog posts to take off on Hacker News. 473 posts.
302
Report on FBI’s Use of Patriot Act Highlights Need for Intelligence Reform
The Justice Department’s Office of the Inspector General (OIG) yesterday released another report on the Federal Bureau of Investigation’s use of Section 215 of the Patriot Act between 2007 and 2009. The report was long delayed due to declassification and redaction issues, but the timing is...
303
304
305
About the supposed factoring of a 4096 bit RSA key
This blog is written by Hanno Böck. Unless noted otherwise, its content is licensed as CC0 .
306
AEADs: getting better at symmetric cryptography
I gave a talk a couple of weeks ago at the Yahoo Unconference . The conference was at the end of a particually hard week for a bunch of reasons and I fear that the talk wasn't that great. (Afterwards I got home about 3pm and pretty much slept until the following morning.) This post is a, hopefully clearer…
307
308
The Day Google Decided HttpWatch Was ‘Unwanted Software’
This blog post isn’t about HTTP performance or HttpWatch itself but you may find it useful if you advertise a software product with Google Adwords. Hopefully, you’ll also find our conversation with Google amusing! What Happened ? We received an email like this: Subject: Your AdWords account: Ads...
309
310
Secure yourself, Part 1: Air-gapped computer, GPG and smartcards
This blog entry is part of a series covering: Logging into your laptop and decrypting it automatically Encrypting and decrypting any passwords or secure info you have Sending and receiving encrypted mails Providing 2-step authentication codes for your web logins Doing all of the above on your mobile phone…
311
Why your 'A' grade SSL is 'outdated cryptography' on Chrome
Get EV SSL certificates in hours, not days. Prechecks before you pay. We do the hard work for you.
312
313
Stupid certificate tricks
Sometimes I do things for no real reasons other than “because I can” and/or “it amuses me”. For example, embedding a snarky message into my HTTPS certificate.
314
Mysterious Planes Over Baltimore Spark Surveillance Suspicions
It all started with a simple Twitter query from a Baltimore man: “Anyone know who has been flying the light plane in circles above the city for the last few nights?” This was several days after the death of Freddie Gray in police custody, and the subsequent riots and protests. Pete Cimbolic, an aviation buff and…
315
Go crypto: bridging the performance gap
It is no secret that we at CloudFlare love Go. We use it, and we use it a LOT. There are many things to love about Go, but what I personally find appealing is the ability to write assembly code!
316
317
SendGrid employee’s account was compromised and used to access internal systems
Explore the latest company news, product updates, technical tutorials, and best practices from Twilio, the industry-leading customer engagement platform.
318
Deprecating Non-Secure HTTP
Today we are announcing our intent to phase out non-secure HTTP. There's pretty broad agreement that HTTPS is the way forward for the web. In recent months, there have been ...
319
The Problem with Mobile Phones
Mobile phones have become ubiquitous and basic communications tools—now used not only for phone calls, but also for accessing the Internet, sending text messages, and documenting the world. Unfortunately, mobile phones were not designed for privacy and security. Not only do they do a poor job of protecting your…
320
The New USA Freedom Act: A Step in the Right Direction, but More Must Be Done
A bipartisan group of congressional leaders has reintroduced the USA Freedom Act. The bill is an attempt to rein in the intelligence community's "Collect It All" strategy, and passing USA Freedom is a first, small step in the right direction. However, it has serious faults that should be addressed...
321
An introduction to JavaScript-based DDoS
CloudFlare protects millions of websites from online threats. One of the oldest and most pervasive attacks launched against websites is the Distributed Denial of Service (DDoS) attack.
322
323
Aaron’s Law Reintroduced: Computer Fraud and Abuse Act Didn’t Fix Itself
Aaron’s law, the proposed law named in honor of Internet hero Aaron Swartz was reintroduced last week by Rep. Zoe Lofgren (D-Calif.) and Senator Wyden (D-Ore.), with new co-sponsor Senator Rand Paul (R-Ky.). This bill is the same as the one introduced in 2013 and we call upon Congress to move it...
324
EFF's Updated SSL Configuration
EFF recently updated our SSL certificate and configuration. This gave us an A+ rating on SSL Labs, a great jumping off point for reviewing a site's secure connection. What follows is a quick, technical guide to how we achieved this. Generating a Certificate First we generate an 4096-bit RSA private...
325
Tor Browser 4.5 is released
The Tor Browser Team is proud to announce the first stable release in the 4.5 series. This...
326
Vault – A tool for managing secrets
Vault is a platform for centralized secrets management, encryption as a service, and identity-based access.
327
Surveillance forces journalists to think and act like spies
Once upon a time, a journalist never gave up a confidential source. When someone comes forward, anonymously, to inform the public, it's better to risk time incarcerated than give them up. This ethical responsibility was also a practical and professional necessity. If you promise anonymity, you're obliged to deliver…
328
Race conditions on Facebook, DigitalOcean and others (fixed)
Hello, Lately I have been looking into race condition bugs affecting websites/web-applications. Here is a good resource to learn about th...
329
EFF to Congress: Stop the Cybersurveillance Bills
EFF joined over 50 privacy and civil society organizations that sent two letters to Congress demanding it vote against the Senate Intelligence Committee's cybersecurity "information sharing" bill, the Cybersecurity Information Sharing Act of 2015 (CISA, S. 754) and the House Intelligence Committee’...
330
Magento eCommerce PHP Remote Code Execution
Critical remote code execution vulnerability in Magento (SUPEE-5344). Patch immediately. Affects 200,000 stores. Includes patch download and analysis.