4561
New
The latest blog posts to take off on Hacker News. 8,771 posts.
4562
Sendy Is Insecure: How Not to Implement ReCAPTCHA
Sendy's reCAPTCHA implementation doesn't do anything.
4563
Ransomware, Data Breaches at Hospitals Tied to Uptick in Fatal Heart Attacks
Hospitals that have been hit by a data breach or ransomware attack can expect to see an increase in the death rate among heart patients in the following months or years because of cybersecurity remediation efforts, a new study posits. Health industry experts say the findings should prompt a larger review of how…
4564
Security assessment techniques for Go projects
The Trail of Bits Assurance practice has received an influx of Go projects, following the success of our Kubernetes assessment this summer. As a result, we’ve been adapting for Go projects some of the security assessment techniques and tactics we’ve used with other compiled languages. We started by understanding the…
4565
Bypassing GitHub's OAuth Flow with a Head Request
For the past few years, security research has been something I’ve done in my spare time. I know there are people that make a living off of bug bounty programs, but I’ve personally just spent a few hours here and there whenever I feel like it.
4566
Biometric YubiKey
Learn more about what's happening within the tech and cybersecurity industry and the developments in our business and security keys within our Yubico Blog.
4567
DNS Wars
NANOG is now quite an institution in the Internet, particularly in the North American Internet community. It was an offshoot of the Regional Techs meetings, which were part of the NSFNET framework of the late 80s and early 90s. NANOG has thrived since then and is certainly one of the major network operational forums…
4568
Audio Fingerprinting using the AudioContext API
Audio fingerprinting takes advantage of device performance specs to build up an identifying fingerprint of a user. It uses the AudioContext API for this
4569
Adding Client-Side Scanning Breaks End-to-End Encryption
Recent attacks on encryption have diverged. On the one hand, we’ve seen Attorney General William Barr call for “lawful access” to encrypted communications, using arguments that have barely changed since the 1990’s. But we’ve also seen suggestions from a different set of actors for more purportedly...
4570
Stuxnet was embarrassing, not amazing (2011)
As the New York Times posts yet another breathless story about Stuxnet, I’m surprised that no one has pointed out its obvious deficiencies. Everyone seems to be hyperventilating about its pur…
4571
SSH Handshake Explained
Secure Shell (SSH) is a widely used Transport Layer Protocol to secure connections between clients and servers. In this post we explain how SSH handshake works.
4572
Chrome 0-day exploit used in Operation WizardOpium
Recently, we caught a new unknown exploit for Chrome browser. After reviewing of the PoC we provided, Google confirmed there was a zero-day vulnerability and assigned it CVE-2019-13720.
4573
Setting up a home VPN server with WireGuard
Motivation For a moderately security conscious geek like myself, there can be a number of reasons to want to set up a home VPN server: Accessing your home computer via screen sharing without exposing it to the Internet (and thereby to potential evil-doers). Accessing servers with IP white lists (common case for…
4574
DKIM Demystified
DKIM is a way to secure your email, increasing deliverability and avoiding fraud. A 20i Senior Systems Administrator explains DKIM in depth.
4575
Destroying x86_64 instruction decoders with differential fuzzing
TL;DR: x86_64 decoding is hard, and the number and variety of implementations available for it makes it uniquely suited to differential fuzzing. We’re open sourcing mishegos, a differential fuzzer for instruction decoders. You can use it to discover discrepancies in your own decoders and analysis tools! In the…
4576
Getting Started with Security Keys
How to stay safe online and prevent phishing with FIDO2, WebAuthn and security keys. A look into YubiKeys, TOTP authenticator apps, passwordless and more.
4577
ProtonMail iOS app goes open source
We have released the Proton Mail iOS app as open source software as part of our commitment to transparency and supporting the developer community.
4578
Xfinity Is Man-in-the-Middle Attacking My Internet
Xfinity injected 581 lines of JavaScript into unencrypted traffic as a data-cap warning, creating MITM risks, accessibility failures, and slower loads.
4579
Mass cellphone surveillance experiment in Spain
Spanish Statistics Institute will track all cellphones for eight days (2 min, link in Spanish, via) A few facts first: Carriers geotrack all users by default, using cell tower triangulation. They also store logs of your calls and sms, but that is
4580
4581
4582
7M Adobe Creative Cloud Accounts Exposed to the Public
A data exposure of 7 million Adobe Creative Cloud account records could put users at risk of targeted phishing.
4583
Tor Browser 9.0
We want everyone in the world to be able to enjoy the privacy and freedom online Tor provides, and that's why over the past couple years, we've been working hard to boost our UX and localization efforts, with the biggest gains first visible in Tor Browser 8.0. In Tor Browser 9.0, we continue to build upon those…
4584
Why EdDSA held up better than ECDSA against Minerva
"Minerva attack can recover private keys from smart cards, cryptographic libraries" , says the ZDNet headline. "The Czech team found a problem in the ECDSA and EdDSA algorithms used by the Atmel Toolbox crypto library to sign cryptographic operations on Athena IDProtect cards."
4585
4586
Get Ready for New SameSite=None; Secure Cookie Settings
UPDATE (10/28/2019): We've revised the 2nd and 3rd bullet points in the section "How to Prepare; Known Complexities" below. In May, Chrome ...
4587
An Intern's Experience with Rust
Over the course of my internship at the Microsoft Security Response Center (MSRC), I worked on the safe systems programming languages (SSPL) team to promote safer languages for systems programming where runtime overhead is important, as outlined in this blog . My job was to port a security critical network processing…
4588
Latest Firefox Brings Privacy Protections Front and Center
Our push this year has been building privacy-centric features in our products that are on by default. With this move, we’re taking the guesswork out of h
4589
4590
