331
Firefox Now Available with Enhanced Tracking Protection by Default
It’s been several weeks since I was promoted to Senior Vice President of Firefox, responsible for overall Firefox product and web platform development. A
New
The latest blog posts to take off on Hacker News. 579 posts.
332
TSA-style body scanners are coming to public spaces
Civil Rights, Criminal Justice and Homeland Security
333
Abuses show Assange case was never about law
It is astonishing how often one still hears well-informed, otherwise reasonable people say about Julian Assange: “But he ran away from Swedish rape charges by hiding in Ecuador’s embassy in London.” That short sentence includes at least three factual errors. In fact, to repeat it, as so many people do, you would
334
335
Information Security Mental Models
Mental models frame how we think about the world. This article describes how they work and why we need more of them in information security.
336
337
Block Fingerprinting with Firefox
Browser fingerprinting is a hidden way websites and third parties can identify your web browser based on a mix of device details, settings, and system characteristics. Firefox helps prevent browser fingerprinting with built-in protections designed to reduce that tracking and give you more control over your online…
338
339
Public DNS in Taiwan the Latest Victim of BGP Hijack
Guest Post: Traffic going through a public DNS in Taiwan was rerouted to an entity in Brazil for about three and a half minutes.
340
Should Failing Phish Tests Be a Fireable Offense?
Would your average Internet user be any more vigilant against phishing scams if he or she faced the real possibility of losing their job after falling for one too many of these emails? Recently, I met someone at a conference who said his employer had in fact terminated employees for such repeated infractions. As this…
341
The sorry state of OpenSSL usability (2017)
OpenSSL's inadequate documentation, confusing key formats, and deprecated interfaces make it difficult to use, despite its importance.
342
ProtonMail Voluntarily Offers Assistance for Real-Time Surveillance?
Proton Mail disputed some of the content of the post originally published at this location. We will continue the discussion directly with Proton Mail, in particular at a meeting in …
343
Building Facebook's Service Encryption Infastructure
We run one of the largest microservices deployments in the world, with thousands of services that perform billions of requests per second. Keeping information secure as these services communicate g…
344
I can see your local web servers
How many web servers are running on your machine right now? Do all of those development web servers have a secure login, and restrictive CORS permissions? You don’t know? Allow me to check for you:
345
What I Learned Trying to Secure Congressional Campaigns
You know how it happens. You try to secure one Congressional campaign, and then another, and pretty soon you can't stop. You'll fly across the country just to brief a Green Party candidate in a district the Republicans carried by 60 points. You want more, more, always looking for that next fix.
346
347
The Definitive Guide on Win32 to NT Path Conversion (2016)
Posted by James Forshaw, path’ological reverse engineer.How the Win32 APIs process file pat...
348
Twitter accounts are being hijacked for spam
It seems that Twitter has lost control of its advertising system. This blog post will show you why it is dangerous to click on any Twitter advertising. Twitter ads have always been a bit crap, but I've seen a recent influx in outright scams. Let me step you through a couple of examples. A typical click-bait headline…
349
350
First American Financial Corp. Leaked Hundreds of Millions of Insurance Records
The Web site for Fortune 500 real estate title insurance giant First American Financial Corp. [ NYSE:FAF ] leaked hundreds of millions of documents related to mortgage deals going back to 2003, until notified this week by KrebsOnSecurity. The digitized records — including bank account numbers and statements, mortgage…
351
PayPal's Beautiful Demonstration of Extended Validation FUD
Sometimes the discussion around extended validation certificates (EV) feels a little like flogging a dead horse. In fact, it was only September that I proposed EV certificates are already dead [https://www.troyhunt.com/extended-validation-certificates-are-dead/] for all sorts of good reasons that have only been…
352
Google faces first investigation by its European lead authority over GDPR
Today, Ireland’s Data Protection Commission (DPC) has announced a major GDPR probe into “suspected infringement” by Google’s DoubleClick/Authorized Buyers advertising business. The probe was triggered by a formal complaint from Dr Johnny Ryan, Chief Policy Officer at Brave, the private web browser.
353
Privacy-Preserving Ad Click Attribution for the Web
A typical website is made of numerous components coming from a wide variety of sources.
354
Fingerprinting iPhones
This clever attack allows someone to uniquely identify a phone when you visit a website, based on data from the accelerometer, gyroscope, and magnetometer sensors. We have developed a new type of fingerprinting attack, the calibration fingerprinting attack. Our attack uses data gathered from the accelerometer…
355
Tor Browser 8.5
Tor Browser 8.5 includes our first stable release for Android plus many new features.
356
Notifying administrators about unhashed password storage
Google’s policy is to store your passwords with cryptographic hashes that mask those passwords to ensure their security. However, we recently notified a subset of our enterprise G Suite customers that some passwords were stored in our encrypted internal systems unhashed. This is a G Suite issue that affects business…
357
358
Security for Elasticsearch is now free
We are thrilled to announce that the core security features of the Elastic Stack -- like TLS encryption, RBAC, and both file and native authentication -- are now free.
359
360