5101
The Digital Maginot Line
There is a war happening. We are immersed in an evolving, ongoing conflict: an Information World War in which state actors, terrorists, and ideological…
New
The latest blog posts to take off on Hacker News. 8,772 posts.
5102
5103
“Stylish” is back, and you still shouldn't use it
2 days after I published ‘“Stylish” browser extension steals all your internet history’, Stylish was pulled from the Chrome and Firefox stores. The story echoed around parts of the internet for a few days, my name was misspelled on several right-wing British news websites, and I felt that I’d helped make the world a…
5104
5105
Half of All Phishing Sites Now Have the Padlock
Maybe you were once advised to “look for the padlock” as a means of telling legitimate e-commerce sites from phishing or malware traps. Unfortunately, this has never been more useless advice. New research indicates that half of all phishing scams are now hosted on Web sites whose Internet address includes the padlock…
5106
GDPR complaints against Google’s deceptive practices to track user location
Based on new research published today by BEUC’s Norwegian member Forbrukerrådet, seven consumer groups are filing complaints against Google with their national data protection authorities.
5107
Scammers are changing the contact details for banks on Google Maps
A new type of banking scam involving fake business listings is taking over Google [3 min read]
5108
5109
Advanced web security topics
(Updated 22 May 2020) This post discusses web security issues that I come across – so far thankfully mostly by reading about them. It is a work in progress which I’ll keep updating. The…
5110
Secure Boot in the Era of the T2
Explore the Duo Blog for expert tips, security insights, and resources to stay updated on the latest in security and access management trends.
5111
The EU Terrorist Content Regulation – a threat to the ecosystem and user rights
The EU has proposed a new law aimed at terrorist content online. Here we outline how the proposal poses a risk for rights and the internet ecosystem.
5112
Shamir’s Secret Sharing Scheme
Consider a scenario in which you are tasked with managing the security of a bank's vault. The vault is considered impenetrable without a key, which you are g...
5113
5114
5115
Amazon S3 Block Public Access: Protection for Your Accounts and Buckets
Update (4/27/2023): Amazon S3 now automatically enables S3 Block Public Access and disables S3 access control lists (ACLs) for all new S3 buckets in all AWS Regions. Update (August 2019)– Fresh screen shots and changes to the names of the options. Newly created Amazon S3 buckets and objects are (and always have been)…
5116
Beyond Passwords: 2FA, U2F and Google Advanced Protection
Last week I wrote a couple of different pieces on passwords, firstly about why we're going to be stuck with them for a long time yet [https://www.troyhunt.com/heres-why-insert-thing-here-is-not-a-password-killer/] and then secondly, about how we all bear some
5117
Privacy not included: Holiday gift list for privacy and security
Privacy Not Included was launched in 2017 to help you understand the privacy risks of tech products that connect to the internet. We are continuing that work in the form of Product Reviews at our magazine Nothing Personal, where our privacy experts do hours of hands-on testing and research on the most popular consumer…
5118
Hacking Gmail’s UX with 'From' Fields – Another Phishing Vector
An Unexpected Consequence of a Bad Header
5119
Private by Design: How We Built Firefox Sync
Firefox Sync by default protects all your synced data so Mozilla can’t read it. We built Sync this way because we put user privacy first. How it works is...
5120
Improving DuckDuckGo
Want to know more about a DuckDuckGo product or feature? Find answers to frequently asked questions and more at DuckDuckGo Help.
5121
The rise of multivector DDoS attacks
It's been a while since we last wrote about Layer 3/4 DDoS attacks on this blog. This is a good news - we've been quietly handling the daily onslaught of DDoS attacks. Since our last write-up, a handful of interesting L3/4 attacks have happened. Let's review them.
5122
A 100k Botnet Turns Home Routers to Email Spammers
This article was co-authored by Hui Wang and RootKiter. Since September 2018, 360Netlab Scanmon has detected multiple scan spikes on TCP port 5431, each time the system logged more than 100k scan sources, a pretty large number compared with most other botnets we have covered before. The interaction between the
5123
5124
The Lie Behind the Lie Detector
5th Edition of The Lie Behind the Lie Detector Released
5125
Capsicum
I spent a couple of years evangelizing about Capsicum. I wrote many articles about it. So, it is very natural that I would also like to update you on this blog about the progress of the Capsicum project in FreeBSD, because this is what I’m doing in my free time. That said I feel that this blog wouldn’t be completed…
5126
Android Security Auditing: Investigating Unauthorized Screenshots
About six months ago, I discovered something on my smartphone that horrified me: I went to undelete a file in DiskDigger, and I stumbled upon a plethora of unexpected jpegs: screenshots of my activity. Screenshots that I didn’t take. Screenshots of my conversations. Screenshots of my GPS position. And screenshots of…
5127
Application-Layer DDoS Attack Protection with HAProxy
This blog post describes techniques that utilize ACLs, maps, and stick tables.
5128
U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service
A year ago, KrebsOnSecurity warned that “Informed Delivery,” a new offering from the U.S. Postal Service (USPS) that lets residents view scanned images of all incoming mail, was likely to be abused by identity thieves and other fraudsters unless the USPS beefed up security around the program and made it easier for…
5129
5130
What’s Hiding in Your PDF?
PDFs hold information you may not know about. Discover different forms of metadata and where to look for them.