4861
Post-mortem and remediations for the Matrix.org security breach
Matrix, the open protocol for secure decentralised communications
New
The latest blog posts to take off on Hacker News. 8,772 posts.
4862
Improving privacy and security on the web
In 2008, we launched Chrome with the goal of building a speedy, simple, secure and stable web for everyone, everywhere. Ten years later, use...
4863
Cybersecurity Checklist for Political Campaigns
Short-lived political campaigns rarely build formal security programs and often assume they're too small to attract serious attackers, but campaigns across the United States have been targeted by document theft and credential phishing. Six observed attacker tactics map to a short list of defensive priorities, starting…
4864
ProtonMail is dropping support for Internet Explorer 11
If you still use Internet Explorer, you will need to switch to a more secure, modern web browser to access Proton Mail.
4865
Google AdWords Exploit Seen in the Wild
See the ad for ebay at the top of the results? Not particularly interesting, right?…
4866
WordPress 5.2: Mitigating Supply-Chain Attacks
We wrote a cryptography library entirely in PHP to make your WordPress site secure against supply-chain attacks.
4867
Protecting democratic elections through secure, verifiable voting
Today, at the Microsoft Build developer conference, CEO Satya Nadella announced ElectionGuard, a free open-source software development kit (SDK) from our Defending Democracy Program. ElectionGuard will make voting secure, more accessible, and more efficient anywhere it’s used in the United States or in democratic…
4868
Modeling Adversaries with TLA+
A common question I get about specs is how to model bad actors. Usually this is one of two contexts: The spec involves several interacting agents sharing a protocol, but some of the nodes are faulty or malicious: they will intentionally try to subvert the system. The spec involves an agent subject to outside forces…
4869
Repositories held for ransom by using valid credentials
We’ve learned of suspicious Git activity on GitLab. Affected users have been notified.
4870
Reverse Engineering a Xinjiang Police Mass Surveillance App
This report presents new evidence about the surveillance state in Xinjiang, where the government has subjected 13 million Turkic Muslims to heightened repression as part of its “Strike Hard Campaign against Violent Terrorism.” Between January 2018 and February 2019, Human Rights Watch was able to reverse engineer the…
4871
Android App Reverse Engineering 101
Learn to reverse engineer Android applications!
4872
Writing Exploit-Resistant Code with OpenBSD
On April 27, 2019, I gave a talk on how to use OpenBSD to write better software at CarolinaCon 15 in Charlotte.
4873
Remote Code Execution on Most Dell Computers
What computer do you use? Who made it? Have you ever thought about what came with your computer? When we think of Remote Code Execution (RCE) vulnerabilities in mass, we might think of vulnerabilities in the operating system, but another attack vector to consider is "What third-party software came with
4874
DHS Asserting Unconstitutional Authority to Search Travelers’ Phones and Laptops
BOSTON — The Electronic Frontier Foundation (EFF) and the ACLU today asked a federal court to rule without trial that the Department of Homeland Security violates the First and Fourth Amendments by searching travelers’ smartphones and laptops at airports and other U.S. ports of entry without a...
4875
Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)
Read the latest thinking, news and research from the team at Container Solutions in our Cloud Native Blog.
4876
4877
Belgian programmer solves MIT’s 20-year-old time capsule cryptographic puzzle
This week MIT’s Computer Science and Artificial Intelligence Laboratory (CSAIL) announced that a 20-year-old cryptographic puzzle was just solved by a self-taught programmer from Belgium, 15 years earlier than MIT scientists expected.
4878
4879
So You Want to Be a Penetration Tester?
This is an old and outdated version of the blog. If you haven’t read this post yet, then please see the new one for the most up-to-date content: “So You Want To Work in Cyber Security?”. This version is kept here for archival purposes only.
4880
4881
The inception bar: a new phishing method
A new phishing technique that displays a fake URL bar in Chrome for mobile. A key innovation is the "scroll jail" that traps the user in a fake browser.
4882
Setting Up an Ad-Blocking VPN with WireGuard and Pihole
This guide will walk you through the setup of a remote machine that will act as a personal VPN server at the cost of 3 to 5 USD per month. We will also configure it to act as a DNS resolver that will automatically block spam, tracking, advertising and malware domains on all of your connected devices.
4883
ProtonMail now offers elliptic curve cryptography
Proton Mail has become the first and only encrypted email provider to support elliptic curve cryptography (ECC), providing more security and performance.
4884
VPN services blocked in Sri Lanka as information controls tighten
Internet providers in Sri Lanka are in the vanguard of blocking access to digital security tools that allow users to work around censorship, according to new NetBlocks network measurement data. ...
4885
Massachusetts Court Blocks Warrantless Access to Real-Time Location Data
There's heartening news for our location privacy out of Massachusetts this week. The Supreme Judicial Court, the state's highest court, ruled that police access to real-time cell phone location data—whether it comes from a phone company or from technology like a cell site simulator—intrudes on a...
4886
4887
Reasons not to reveal your DNA
With over two decades of global impact, Mozilla Foundation continues to lead the movement for a better technology future—powered by people, open by design, and fueled by imagination.
4888
V8: A Year with Spectre
The V8 team details their analysis and mitigation strategy for Spectre, one of the top computer security issues of 2018.
4889
Modern C++ Won't Save Us
I’m a frequent critic of memory unsafe languages, principally C and C++, and how they induce an exceptional number of security vulnerabilities. My conclusion, based on reviewing evidence from numerous large software projects using C and C++, is that we need to be migrating our industry to memory safe by default…
4890
Vendors must start adding physical on/off switches to devices that can spy on us
Update (May 15, 2019): This post was linked and its author quoted as a source in this Fast Company article on the same subject. Where's my webcam's off switch? Have you ever noticed that your webcam doesn't have an "off" switch? I looked on Amazon, and I couldn't find any webcams for sale that