4891
A Technical and Cultural Assessment of the Mueller Report PDF
What can we learn about the Mueller Report from the PDF file released by the Department of Justice (DoJ) on April 18, 2019?
New
The latest blog posts to take off on Hacker News. 8,772 posts.
4892
How to Track Your Kids (and Other People's Kids) with the TicTocTrack Watch
Do you ever hear those stories from your parents along the lines of "when I was young..." and then there's a tale of how risky life was back then compared to today. You know, stuff like having to walk themselves to school without adult supervision, crazy stuff like that
4893
How Not to Acknowledge a Data Breach
I’m not a huge fan of stories about stories, or those that explore the ins and outs of reporting a breach. But occasionally I feel obligated to publish such accounts when companies respond to a breach report in such a way that it’s crystal clear they wouldn’t know what to do with a data breach if it bit them in the…
4894
Let’s Encrypt to transition to ISRG root
Let's Encrypt have announced that on July 8th, 2019 they will begin issuing new certificates from their own intermediate CA and not their current cross-signed intermediate. Here's what that means and what action, if any, site operators need to take…
4895
Adventures in reverse engineering Broadcom NIC firmware
For some time now, I've been reverse engineering the firmware of the Broadcom BCM5719 Ethernet NIC chip, so that open source firmware can be produced for it. The BCM5719 is a PCIe chip which provides up to four Gigabit Ethernet ports, and is mainly intended for use in server applications. It can be used with the Linux…
4896
4897
Time protection: the missing OS abstraction
Time protection: the missing OS abstraction Ge et al., EuroSys’19 Ever since the prominent emergence of timing-based microarchitectural attacks (e.g. Spectre, Meltdown, and friends) I’ve been…
4898
Breach at IT Outsourcing Giant Wipro
Indian information technology (IT) outsourcing and consulting giant Wipro Ltd. [ NYSE:WIT ] is investigating reports that its own IT systems have been hacked and are being used to launch attacks against some of the company’s customers, multiple sources tell KrebsOnSecurity. Wipro has refused to respond to questions…
4899
Mastodon and Keybase
You're reading the Keybase blog. There are more posts . When you're done, you can install Keybase .
4900
Adblock Plus filter lists may execute arbitrary code in web pages
A new version of Adblock Plus was released on July 17, 2018. Version 3.2 introduced a new filter option for rewriting requests. A day later AdBlock followed suit and released support for the new filter option. uBlock, being owned by AdBlock, also implemented the feature. Under certain conditions the $rewrite filter…
4901
China Spying on Undersea Internet Cables
Supply chain security is an insurmountably hard problem. The recent focus is on Chinese 5G equipment, but the problem is much broader. This opinion piece looks at undersea communications cables: But now the Chinese conglomerate Huawei Technologies, the leading firm working to deliver 5G telephony networks globally…
4902
Virtually Unlimited Memory: Escaping the Chrome Sandbox
Posted by Mark Brand, Exploit Technique Archaeologist.IntroductionAfter discovering a collection ...
4903
EFF’s Tweet About a DMCA Takedown Is Now Subject to an Overzealous Takedown
Get ready for a tale as good as anything you’d see on television. Here’s the sequence of events: the website TorrentFreak publishes an article about a leak of TV episodes, including shows from the network Starz. TorrentFreak tweets its article, Starz sends a copyright takedown notice. TorrentFreak writes about the…
4904
‘Land Lordz’ Service Powers Airbnb Scams
Scammers who make a living swindling Airbnb.com customers have a powerful new tool at their disposal: A software-as-a-service offering called “ Land Lordz ,” which helps automate the creation and management of fake Airbnb Web sites and the sending of messages to advertise the fraudulent listings.
4905
CVE-2019-9193: Not a Security Vulnerability
There is widespread mention in the media of a security vulnerability in PostgreSQL, registered as [CVE-2019-9193](https://nvd.nist.gov/vuln/detail/CVE-2019-9193). The PostgreSQL Security Team …
4906
4907
EFF Statement on Assange Indictment and Arrest
While the indictment of Julian Assange centers on an alleged attempt to break a password—an attempt that was not apparently successful—it is still, at root, an attack on the publication of leaked material and the most recent act in an almost decade-long effort to punish a whistleblower and the...
4908
Making email more secure with MTA-STS standard
Posted by Nicolas Lidzborski, Senior Staff Software Engineer, Google Cloud and Nicolas Kardas, Senior Product Manager, Google Cloud We’re...
4909
EU Agencies Falsely Report More Than 550 Archive.org URLs as Terrorist Content
CORRECTION: This post previously identified the sender of the 550 falsely identified URLs as Europol's EU Internet Referral Unit (EU IRU). The sender was in fact, the French national Internet Referral Unit, using Europol's application, which sends the email from an @europol.europa.eu address. The EU IRU has informed…
4910
4911
Your Android Phone Is a Security Key
Now, your phone running Android 7+ can be your security key, protecting you against phishing. Use it to protect your personal and work Google Accounts.
4912
DNS-over-HTTPS Policy Requirements for Resolvers
Over the past few months, we’ve been experimenting with DNS-over-HTTPS (DoH), a protocol which uses encryption to protect DNS requests and responses, with the goal of deploying DoH by default ...
4913
Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta
We have added a feature to block fingerprinting and cryptomining in Firefox Nightly as an option for users to turn on.
4914
4915
Characterizing secret leakage in public GitHub repositories
How bad can it git? Characterizing secret leakage in public GitHub repositories Meli et al., NDSS’19 On the one hand you might say there’s no new news here. We know that developers shouldn’t …
4916
VPN – Very Precarious Narrative
A very long article about commercial VPNs, their marketing strategies, and the truth behind their privacy and security claims.
4917
How to increase your chances of finding a hidden camera
Take note of the title of this blog. What you read below will give you some additional knowledge that may help you identify a hidden camera but it certainly won’t guarantee that. We got lucky…
4918
How Apps on Android Share Data with Facebook (2018)
Facebook routinely tracks users, non-users and logged-out users outside its platform through Facebook Business Tools. App developers share data with Facebook through the Facebook Software Development Kit (SDK), a set of software development tools that help developers build apps for a specific operating system. Using…
4919
Ginseng: Keeping secrets in registers when you distrust the operating system
Ginseng: keeping secrets in registers when you distrust the operating system Yun & Zhong et al., NDSS’19 Suppose you did go to the extreme length of establishing an unconditional root of …
4920
Should you be concerned about LastPass uploading your passwords to its server?
The answer to this question is still "Yes!" Here I demonstrate yet another way for the server to access your data, the issues being structural.