4471
Always Review Your Dependencies, AGPL Edition
Before adding a dependency to one of my software projects, I do some basic vetting of the dependency. Among the things I check are:
New
The latest blog posts to take off on Hacker News. 8,771 posts.
4472
KeePassXC 2.5.2
KeePassXC Password Manager
4473
Promiscuous cookies and their impending death via the SameSite policy
Cookies like to get around. They have no scruples about where they go save for some basic constraints relating to the origin from which they were set. I mean have a think about it: If a website sets a cookie then you click a link to another page on that
4474
Microsoft Edge (Chromium) – Elevation of Privilege to Potential RCE
With some luck and a couple of XSS bugs I was able to break the new Edge
4475
Scammers registering date-based domain names
Yesterday, January 2nd, my wife received a billing alert from her phone provider. Luckily, she's not with EE - because it's a pretty convincing text. That domain name is specifically designed to include the day's date. If you're stood up on a crowded train, with your phone screen cracked, would you notice that a . is…
4476
4477
Matrix' answer to Moxie: On privacy versus freedom
Matrix, the open protocol for secure decentralised communications
4478
4479
BusKill: A kill cord for your laptop
BusKill is a Kill Cord for your laptop implementing a Dead Man Switch using $20 in USB hardware + udev rule to trigger your laptop self-destruct if stolen.
4480
Exploiting Wi-Fi Stack on Tesla Model S
In the past two years, Keen Security Lab did in-depth research on the security of Tesla Cars and presented our research results on Black Hat 2017 and Black Hat 2018. Our research involves many in-veh
4481
How to stay private when using Android
Android is one of Google’s most important tools for collecting data on users. This guide will help you improve your privacy on Android devices.
4482
ProtonCalendar beta
The Proton Calendar uses an innovative encryption model to deliver the high level of security Proton users expect.
4483
One Year After ‘The Big Hack’
Today marks the one-year anniversary of Bloomberg’s publication of a story about Chinese intelligence intercepting the supply chain of Supermicro, a company which has built and sold servers to Amazon, Apple, the U.S. Department of Defense, and dozens of other companies. Apparently, they developed a chip that looked…
4484
The StingRay Is Why the 4th Amendment Was Written (2017)
The drafters of the Constitution recognized that restricting the government from violating privacy is essential for a free society. That's why the Fourth Amendment exists. The StingRay clearly violates these standards.
4485
Behind the One-Way Mirror: A Dive into the Technology of Corporate Surveillance
It's time to shed light on the technical methods and business practices behind third-party tracking. For journalists, policy makers, and concerned consumers, this paper will demystify the fundamentals of third-party tracking, explain the scope of the problem, and suggest ways for users and legislation to fight back…
4486
4487
NPM lockfiles can be a security blindspot for injecting malicious modules in PRs
In this post, we show you how easy it is to introduce back doors that are easily missed by project owners… leaving your code insecure.
4488
Flight stats, entertainment, and trying to crack Widevine
Investigating onboard flight entertainment APIs, flight telemetry, and Widevine-protected media.
4489
The investigation into ToTok
triaging a massively popular iOS application, with a dark side
4490
Windows 0-day exploit used in Operation WizardOpium
During our investigation, we discovered that yet another 0-day exploit (CVE-2019-1458) was used in Operation WizardOpium attacks.
4491
NSA's Backdoor Key from Lotus Notes (2002)
Before the US crypto export regulations were finally disolved the export version of Lotus Notes used to include a key escrow / backdoor feature called differential cryptography. The idea was that they got permission to export 64 bit crypto if 24 of those bits were encrypted for the NSA's public key. The NSA would then…
4492
Use GitHub actions at your own risk
Malicious code can be inserted into any GitHub action, even those which are tagged.
4493
On Linux's Random Number Generation
Cutting-edge cyber security research from NCC Group. Find public reports, technical advisories, analyses, & other novel insights from our global experts.
4494
267M Facebook users IDs and phone numbers exposed online
Databases exposed by a criminal group leaked more than 300 million Facebook user IDs, names, and phone numbers on the web.
4495
Google Cloud Platform Security Best Practices
A walkthrough of a couple of Google Cloud Platform (GCP) features with security recommendations and advice on how to configure your GCP environments.
4496
Technology Preview for secure value recovery
At Signal, we want to make privacy simple. From the beginning, we’ve designed Signal so that your information is in your hands rather than ours. Technologies like Signal Protocol secure your messages so that they are never visible by anyone but you and the intended recipients. Technologies like p...
4497
Cisco devices must regenerate self-signed certificates before 2020
Self-signed X.509 PKI certificates (SSC) that were generated on devices that run affected Cisco IOS® or Cisco IOS XE software releases expire on 2020-01-01 00:00:00 UTC. New self-signed certificates cannot be created on affected devices after 2020-01-01 00:00:00 UTC. Any service that relies on these self-signed…
4498
4499
PIA open-sources and announces audit plans
The VPN industry looks just like the world of religion - everyone has their different beliefs on who to trust. However, even the diamond in the rough lied
4500
NextDNS Joins Firefox’s Trusted Recursive Resolver
NextDNS Joins Firefox’s Trusted Recursive Resolver Program Committing to Data Retention and Transparency Requirements that Respect User Privacy Firefox a