481
Investigating the 900GB “Collection #1-5” password leaks with R
This post shows how to process gigabytes of unstructured data with the Spark framework and using the R language.
New
The latest blog posts to take off on Hacker News. 579 posts.
482
Facebook’s Privacy Cake
Mark Zuckerberg’s announcement of A Privacy-Focused Vision for Social Networking is not some dramatic pivot: it is a growth opportunity for Facebook and a challenge for regulators.
483
800M Email Addresses Leaked Online by Email Verification Service
Our Biggest Data Breach Discovery of 2019 a massive 800 million emails leaked online. This data breach uncovered how an email verification service uses spam
484
485
Serious Chrome zero-day
The Sophos Blog
486
487
How to Spoof PDF Signatures
One year ago, we received a contract as a PDF file. It was digitally signed. We looked at the document - ignoring the "certificate is not tr...
488
Facebook Doubles Down on Misusing Your Phone Number
When we publicly demanded that Facebook stop messing with users’ phone numbers last week, we weren’t expecting the social network to double down quite like this: By default, anyone can use the phone number that a user provides for two-factor authentication (2FA) to find that user’s profile. For...
489
Facebook exploit – Confirm website visitor identities
I discovered a Facebook bug which allows me to identify whether a visitor is logged in to a specific Facebook account. It can check hundreds of identities per second.
490
German Data Privacy Commissioner Says Article 13 Inevitably Leads to Filters
German Data Privacy Commissioner Ulrich Kelber is also a computer scientist, which makes him uniquely qualified to comment on the potential consequences of the proposed new EU Copyright Directive. The Directive will be voted on at the end of this month, and its Article 13 requires that online...
491
The Supreme Backdoor Factory
Recently I was playing with VirusTotal Intelligence and while testing some dynamic behavior queries I stumbled upon this strange PE binary (MD5: …
492
Millions of Binaries Later: A Look into Linux Hardening in the Wild
With Sophos Cloud Native Security, you can easily integrate protection across multiple environments while minimizing detection time and response.
493
2FA on the command line
OTP: One-Time Password TOTP: Time-based One-time Password algorithm 2FA: Two-factor authentication There is no shortage of OTP 2FA apps availiable for your phone, such as Google Authenticator or Duo Mobile. These apps take an initial secret code, and create a TOTP anytime you need a 2FA code for login.… …
494
495
The most popular docker images each contain at least 30 vulnerabilities
we found that 44% of docker image scans had known vulnerabilities, and for which there were newer and more secure base image available. Most vulnerabilities originate in the base image you selected. For that reason, remediation should focus on base image fixes.
496
ETS Isn't TLS and You Shouldn't Use It
The good news: TLS 1.3 is available, and the protocol, which powers HTTPS and many other encrypted communications, is better and more secure than its predecessors (including SSL). The bad news: Thanks to a financial industry group called BITS, there’s a look-alike protocol brewing called ETS (or...
497
PureBoot, the High Security Boot Process
Purism makes premium phones, laptops, mini PCs and servers running free software on PureOS. Purism products respect people's privacy and freedom while protecting their security.
498
ICANN Calls for DNSSEC for All Domains Following Domain Hijacking Attempts
Announcement that the Internet Corporation for Assigned Names and Numbers (ICANN) believes there is an ongoing and significant risk to key parts of the Domain Name System (DNS) infrastructure and is calling for the full deployment of the Domain Name System Security Extensions (DNSSEC) across all unsecured domain names.
499
Tracking my phone's silent connections
FOSS and life. Kushal Das talks here.
500
Breaking Out of Docker via RunC
Unit 42 brings together world-renowned threat researchers, incident responders and security consultants to create an intelligence-driven, response-ready organization that's passionate about helping you proactively manage cyber risk.
501
Intelligent Tracking Prevention 2.1
Note: Read about past updates to this technology in other blog posts about Intelligent Tracking Prevention, and the Storage Access API.
502
Why Does My Remote Control Need to Know My Location?
Here's an interesting user-hostile pattern which could easily be avoided if programmers and business-people thought like regular humans. I have a Pioneer / Onkyo sound system. It's pretty nice and comes with a (not too crappy) Android app to let me remote control it. One day, the app updated itself. The changelog was…
503
504
OnionShare 2 adds anonymous dropboxes
After nearly a year of work from a growing community of developers, designers, and translators, I'm excited that OnionShare 2 is finally ready. You can download it from onionshare.org. OnionShare is an open source tool for securely and anonymously sending and receiving files using Tor onion services. It
505
Password Managers: Under the Hood of Secrets Management
February 19, 2019
506
Microsoft is Abandoning SHA-1 Hashes for Updates
Microsoft is shipping a patch to eliminate SHA-1 hashes from its update process. There’s nothing wrong with eliminating SHA-1—but their reasoning may be very interesting.
507
508
509
Deciphering the Messages of Apple’s T2 Coprocessor
Explore the Duo Blog for expert tips, security insights, and resources to stay updated on the latest in security and access management trends.
510
Spoofing Google Search Results
By adding two parameters to any Google Search URL, you can replace search results with a Knowledge Graph card of your choice. A malicious user can use this to generate false information or ‘fake news’.