451
What3Words – The Algorithm
What3Words is a widely promoted system that is used for sharing a location using just three words. For example, ///wedge.drill.mess is located in Hyde Park.The globe is divided into 3m squares, eac…
New
The latest blog posts to take off on Hacker News. 678 posts.
452
453
The Gates to Hell: Apple’s Notarizing
NeoFinder is a powerful and very fast disk cataloging tool for songs, videos, photos, all your digital documents
454
455
RotaJakiro: A long live secret backdoor with 0 VT detection
Overview On March 25, 2021, 360 NETLAB's BotMon system flagged a suspiciousELF file (MD5=64f6cfe44ba08b0babdd3904233c4857) with 0 VT detection, the sample communicates with 4 domains on TCP 443 (HTTPS), but the traffic is not of TLS/SSL. A close look at the sample revealed it to be a backdoor targeting
456
457
DPA blocks facial recognition system in Italy and MP proposes moratorium
Italian DPA argues the SARI Real Time facial recognition system lacks a legal basis and, as designed, it would implement a form of mass surveillance. On 14 April, a member of the Italian Parliament, Filippo Sensi, proposed a moratorium on the use of video surveillance tools that use Facial Recognition.
458
GitHub blocks FLoC across all of GitHub Pages
All GitHub Pages sites served from the github.io domain will now have a Permissions-Policy: interest-cohort=() header set. Pages sites using a custom domain will not be impacted. Learn more about…
459
Grand jury subpoena for Signal user data, Central District of California
It’s the first half of 2021 – nearly five years since the “first half of 2016” – but in many ways not much has changed. The United Kingdom is still trying to figure out Brexit, another Justin Bieber song hit #1 on the charts (is it too late now to say sorry?), and Signal still doesn’t really know...
460
Experian’s credit freeze security is still a joke
In 2017, KrebsOnSecurity showed how easy it is for identity thieves to undo a consumer’s request to freeze their credit file at Experian , one of the big three consumer credit bureaus in the United States. Last week, KrebsOnSecurity heard from a reader who had his freeze thawed without authorization through Experian’s…
461
macOS gatekeeper and file quarantine bypass
bypassing macOS's file quarantine, gatekeeper, and notarization requirements
462
Project Jengo Redux: Cloudflare’s Prior Art Search Bounty Returns
On March 15th, 2021, Cloudflare was sued by a patent troll called Sable Networks. Today, we are launching our efforts to fight back.
463
464
465
Remote code execution in Homebrew by compromising the official Cask repository
この記事は日本語でも投稿されています: https://blog.ryotak.net/post/homebrew-security-incident/ (もし日本語が読める場合、筆者は英語がそこまで得意ではないため、日本語の記事を読むことをお勧めします。) (Official blog post about this incident is available here: https://brew.sh/2021/04/21/security-incident-disclosure/) Preface Homebrew project is running a “Vulnerability Disclosure Program”…
466
GitHub Actions update: Helping maintainers combat bad actors
The trustworthiness of our platform is crucial, and our team is committed to developer productivity and Actions performing the way we intended.
467
EFF sues Proctorio on behalf of student falsely DMCA'd
Phoenix, Arizona—The Electronic Frontier Foundation (EFF) filed a lawsuit today against Proctorio Inc. on behalf of college student Erik Johnson, seeking a judgment that he didn’t infringe the company’s copyrights when he linked to excerpts of its software code in tweets criticizing the software...
468
Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer
Cellebrite makes software to automate physically extracting and indexing data from mobile devices. They exist within the grey – where enterprise branding joins together with the larcenous to be called “digital intelligence.” Their customer list has included authoritarian regimes in Belarus, Russi...
469
470
Tracking the WhatsApp habits of random smartphones
Scaling the WhatsApp online-status hack from a single contact to 5000 random phone numbers — what the data says about phone usage habits.
471
Reading the AGPL
a guided introduction for first-timers
472
Preparing Rustls for Wider Adoption
It’s time for the Internet to move on to more secure software, and that’s why our Memory Safety Initiative is coordinating work to make further improvements to the Rustls TLS library.
473
Bug in Notepad Involving Asterisk in Title Bar
Back in May 27, 2020 Microsoft published a blog post describing a new feature in Notepad:
474
Remote Code Execution Found in CocoaPods
tl;dr CocoaPods is a popular package manager used by lots of iOS apps (among other Swift and Objective-C Cocoa applications). I found a remote code execution...
475
Representing SHA-256 Hashes as Avatars
How to turn 256 bits of entropy into a beautiful, avatar-friendly circular SVG: the Hashvatar.
476
Proposal: Treat FLoC as a security concern
Google is rolling out Federated Learning of Cohorts (FLoC) for the Chrome browser. TL;DR: FLoC places people in groups based on their browsing habits to target advertising. Why is this bad? As the …
477
478
What I Wish I Knew About U2F and Other Hardware MFA Protocols
We revamped the second-factor authentication in Teleport 6.0. This post provides a birds-eye view of U2F and other cryptographic hardware standards.
479
480
Luca App: CCC calls for a moratorium
Dubious business model, defective software, irregularities in the awarding of contracts: The Chaos Computer Club (CCC) demands an immediate end to states' alimentation of Smudo's million-dollar tax...