391
TLS 1.3 approved
Search IETF mail list archives
New
The latest blog posts to take off on Hacker News. 556 posts.
392
Our suite of Ethereum security tools
Two years ago, when we began taking on blockchain security engagements, there were no tools engineered for the work. No static analyzers, fuzzers, or reverse engineering tools for Ethereum. So, we invested significant time and expertise to create what we needed, adapt what we already had, and refine the work…
393
With SESTA/FOSTA, lawmakers failed to separate good intentions from bad law
In Passing SESTA/FOSTA, Lawmakers Failed to Separate Their Good Intentions from Bad LawToday was a dark day for the Internet.The U.S. Senate just voted 97-2 to pass the Allow States and Victims to Fight Online Sex Trafficking Act (FOSTA, H.R. 1865), a bill that silences online speech by forcing...
394
Responsibility Deflected, the CLOUD Act Passes
UPDATE, March 23, 2018: President Donald Trump signed the $1.3 trillion government spending bill—which includes the CLOUD Act—into law Friday morning. “People deserve the right to a better process.”Those are the words of Jim McGovern, representative for Massachusetts and member of the House of...
395
Protecting Security Researchers
Dash knows your context, your team, and your work, so your team can stay organized, easily find and share knowledge, and keep projects secure, all from one place.
396
The Legitimisation of Have I Been Pwned
There's no way to sugar-coat this: Have I Been Pwned [https://haveibeenpwned.com/] (HIBP) only exists due to a whole bunch of highly illegal activity that has harmed many individuals and organisations alike. That harm extends all the way from those in data breaches feeling a sense of
397
Breaking the Ledger Security Model
In this post, I’m going to discuss a vulnerability I discovered in Ledger hardware wallets. The vulnerability arose due to Ledger’s use of a custom architecture to work around many of the limitations of their Secure Element.
398
A picture got my PostgreSQL database to start mining Monero
A Deep Dive into Database Attacks [Part III]: Why Scarlett Johansson’s Picture Got My Postgres Database to Start Mining Monero
399
400
401
Suspending Cambridge Analytica and SCL Group from Facebook
Protecting people’s information is at the heart of everything we do.
402
GrayKey iPhone unlocker poses serious security concerns
Ever since the case of the San Bernadino shooter pitted Apple against the FBI over the unlocking of an iPhone, opinions...
403
Protecting Against HSTS Abuse
HTTP Strict Transport Security (HSTS) is a security standard that provides a mechanism for web sites to declare themselves accessible only via secure connections, and to tell web browsers where to go to get that secure version.
404
405
De-anonymizing programmers from executable binaries
When coding style survives compilation: de-anonymizing programmers from executable binaries Caliskan et al., NDSS’18 As a programmer you have a unique style, and stylometry techniques can be used t…
406
ProtonMail blocked by Vodafone Turkey
Turkey has a track record of blocking certain websites. Here's how you can bypass Turkey's online censorship and access any site (such as Proton Mail).
407
Private Internet Access Goes Open Source
Private Internet Access is the world's best open-source VPN, with open-source VPN protocols, tons of advanced features, and apps for all devices.
408
The 600+ Companies PayPal Shares Your Data With
One of the effects of GDPR—the new EU General Data Protection Regulation—is that we’re all going to be learning a lot more about who collects our data and what they do with it. Consider PayPal, that just released a list of over 600 companies they share customer data with. Here’s a good visualization of that data. Is…
409
Qualcomm, National Security, and Patents
The Trump administration blocked Broadcom’s acquisition of Qualcomm, and I think it was the right move. Understanding why means understanding Qualcomm and Broadcom’s plan for the compan…
410
Attacking Merkle Trees with a second preimage attack
Hacking, hardware, software, and general curiosities of computing machinery! Docendo discumus.
411
Potent malware that hid for six years spread through routers
While analyzing some memory dumps suspicious of being infected with a keylogger, we identified a library containing strings to interact with a virtual file system. This turned out to be a malicious loader internally named “Slingshot”.
412
TLS 1.3 and Proxies
I'll generally ignore the internet froth in a given week as much as possible, but when Her Majesty's Government starts repeating misunderstandings about TLS 1.3 it is necessary to write something, if only to have a pointer ready for when people start citing it as evidence.
413
Secure Access to 100 AWS Accounts
Explore technical topics, solutions, and resources for building with Twilio – and beyond.
414
How Ethereum can be stolen through DNS rebinding
The Post has been moved here
415
Master password in Firefox or Thunderbird? Do not bother
There is a weakness common to any software letting you protect a piece of data with a password: how does that password translate into an encryption key? If that conversion is a fast one, then you better don’t expect the encryption to hold. Somebody who gets hold of that encrypted data will try to guess the password…
416
417
Getting any Facebook user's friend list and partial payment card details
I enjoy breaking websites.
418
How to dismantle a compiler bomb
You have heard of “zip bombs” (a tiny ZIP file that decompresses to multiple gigabytes) and “XML bombs” (small XML file abusing the entities to consume lots of memory), and …
419
OpenPGPjs v3.0
We're happy to announce a major new version of OpenPGPjs, the world's most widely used JavaScript PGP encryption library. Version 3.0 brings many enhancements to the hundreds of applications and millions of users who rely on OpenPGPjs.
420
Famous cryptographers’ tombstone cryptogram decrypted
The Sophos Blog