391
The Mitto AG surveillanve case – or why we must never backdoor encryption
A single employee leaked sensitive data to secret services, potentially also to Russia.
New
The latest blog posts to take off on Hacker News. 642 posts.
392
Chat control: EU Commission presents mass surveillance plan on May 11
Next week on Wednesday (May 11), the EU Commission will present an EU draft law on mandatory chat control to the public for the first time. Similar to Apple's highly controversial "SpyPhone" plans, the Commission wants to oblige all providers of email, chat and messaging services to search for susp
393
Yahoo Japan's password-free authentication reduced inquiries, sped up sign-in
Yahoo! JAPAN achieved a passwordless identity system. Learn their approach and the consequences of the effort.
394
Apple, Google, and Microsoft commit to expanded support for FIDO standard
Faster, easier, and more secure sign-ins will be available to consumers across leading devices and platforms.
395
Adding code to an existing ELF file
Recently I was reverse-engineering an Android app [ a ] . The relevant details are as follows:
396
397
Scapy: Low level packet hacking toolkit for Python
Code level discussion of web scraping, gray hat automation, growth hacking and bounty hunting
398
Your phone may soon replace many of your passwords
Apple , Google and Microsoft announced this week they will soon support an approach to authentication that avoids passwords altogether, and instead requires users to merely unlock their smartphones to sign in to websites or online services. Experts say the changes should help defeat many types of phishing attacks and…
399
400
Home Made TPM2.0 Module
Introduction With the recent launch of Windows 11 Microsoft also made having a hardware TPM module mandatory. Although this technology is not new (it was introduced in Windows 10 and Windows Server…
401
402
Tailscale Authentication for Nginx
Use Tailscale's nginx-auth for secure Single Sign-On (SSO) to internal services, reducing the need for internal account systems.
403
GitHub will require 2FA by the end of 2023
GitHub will require all users who contribute code on GitHub.com to enable one or more forms of two-factor authentication (2FA) by the end of 2023.
404
Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard
Faster, easier and more secure sign-ins will be available to consumers across leading devices and platforms
405
What we can deduce from a leaked PDF
Matthew Butterick
406
Privacy Friendly Apps – improved privacy protection on the smartphone
We use our smartphone for private conversations, store our contacts and organise our meetings with it. The access to all this sensitive data is handled with the so-called permissions. It means, for example, that each app that requires the smartphone camera needs to get the corresponding permission first. Many of the…
407
You can now ask Google to remove your phone number, email or address from search
Google said this week it is expanding the types of data people can ask to have removed from search results, to include personal contact information like your phone number, email address or physical address. The move comes just months after Google rolled out a new policy enabling people under the age of 18 (or a…
408
Gnome patent troll stripped of patent rights
A recent decision at the US patent office may well give patent trolls cause to steer clear of open source projects – even more than the fierce resistance the community impressively funded and mount…
409
SELinux is unmanageable; just turn it off if it gets in your way
I’ve been an SELinux complexity apologist for years. Lately, I’ve concluded that every implementation with difficult-to-configure policies is just unmanageable.
410
Reversing a 2.4GHz Remote Control
I have an old project on Github called rf-car for controlling a radio car with HackRF. A few months ago, my daughter received a new RC car made by Dickie Toys :
411
High-Security Mechanical Locks (2020)
Outside of a very few specialized fields high-security locks are almost totally unknown. Even in the field of locksmithing where high-security locks are known, they are often misunderstood. Today I am going to offer you a primer on the fascinating world of high-security mechanical locks, the securit
412
Apple’s Private Relay can cause the system to ignore firewall rules
Apple’s Private Relay (Beta) feature calls home to Apple servers without respecting the firewall rules of the system, creating a leak that neither we, nor you, can stop without disabling the entire Private Relay feature.
413
Beginners Guide to 0day/CVE AppSec Research
A while ago I took up the challenge to get Offensive Security Web Expert (OSWE) certified. During this journey I learned many awesome things. The most important lesson learned was that with source code and a debugger, I could find vulnerabilities exponentially faster than by using traditional Blackbox/Bug-Bounty…
414
Internet spring cleaning: How to delete Instagram, Facebook and other accounts
So you’ve washed your sheets and vacuumed under the couch in the name of spring cleaning. But what about your online clutter? Apps that delight, inform a
415
Extracting WhatsApp Messages from an iOS Backup
Find where WhatsApp chats live in an iPhone backup, decrypt an encrypted iOS backup with Python, and read your messages from ChatStorage.sqlite.
416
417
How SHA-256 Works Step-by-Step
SHA-2 (Secure Hash Algorithm 2), of which SHA-256 is a part, is one of the most popular hash algorithms around. A cryptographic hash, also often referred to as a "digest", "fingerprint" or "signature", is an almost perfectly unique string of characters that is generated from a separate piece of input text. SHA-256…
418
Leaked Chats Show Lapsus$ Stole T-Mobile Source Code
KrebsOnSecurity recently reviewed a copy of the private chat messages between members of the LAPSUS$ cybercrime group in the week leading up to the arrest of its most active members last month. The logs show LAPSUS$ breached T-Mobile multiple times in March, stealing source code for a range of company projects…
419
GitHub: Private Profiles beta
Users now have the ability to turn their GitHub profile “private”, which gives users controls over features that share user data across the GitHub platform. To enable this setting, visit…
420
I'm a security engineer and I still almost got scammed
I was in the park with my son and his best friend. I saw 2 missed calls from a number I didn’t recognise. I Googled it - it was my bank. I told the other adults that I should call back in case it was important.