5191
Introducing the Librem Key
Purism makes premium phones, laptops, mini PCs and servers running free software on PureOS. Purism products respect people's privacy and freedom while protecting their security.
New
The latest blog posts to take off on Hacker News. 8,772 posts.
5192
Introducing the Cloudflare Onion Service
Two years ago this week Cloudflare introduced Opportunistic Encryption, a feature that provided additional security and performance benefits to websites that had not yet moved to HTTPS.
5193
5194
The Justice Dept's secret rules for targeting journalists with FISA court orders
The Justice Dept has kept these FISA court rules for targeting journalists secret for years.
5195
The Private Blockchain Fallacy
In all the blockchain hype, a simple, yet self-refuting idea keeps popping up: a Private Blockchain .
5196
5197
RPKI – The required cryptographic upgrade to BGP routing
We have talked about the BGP Internet routing protocol before. We have talked about how we build a more resilient network and how we can see outages at a country-level via BGP. We have even talked about the network community that is vital to the operation of the global Internet.
5198
5199
Extended Validation Certificates Are Dead
That's it - I'm calling it - extended validation certificates are dead. Sure, you can still buy them (and there are companies out there that would just love to sell them to you!), but their usefulness has now descended from "barely there" to "as good as non-existent". This change
5200
New “Terrorist Content” Regulations: A Grim Day for Digital Rights in Europe
Despite waves of calls and emails from European Internet users, the European Parliament today voted to accept the principle of a universal pre-emptive copyright filter for content-sharing sites, as well as the idea that news publishers should have the right to sue others for quoting news items...
5201
Remote Code Execution in Alpine Linux
tl;dr I found several bugs in apk, the default package manager for Alpine Linux. Alpine is a really lightweight distro that is very commonly used with Docker...
5202
Today, Europe Lost The Internet. Now, We Fight Back
Today, in a vote that split almost every major EU party, Members of the European Parliament adopted every terrible proposal in the new Copyright Directive and rejected every good one, setting the stage for mass, automated surveillance and arbitrary censorship of the internet: text messages like...
5203
Protecting Mozilla’s GitHub Repositories from Malicious Modification
At Mozilla, we’ve been working to ensure our repositories hosted on GitHub are protected from malicious modification. As the recent Gentoo incident demonstrated, such attacks are possible. Mozilla’s original usage ...
5204
The Effectiveness of Publicly Shaming Bad Security
Here's how it normally plays out: It all begins when a company pops up online and makes some sort of ludicrous statement related to their security posture, often as part of a discussion on a public social media platform such as Twitter. Shortly thereafter, the masses descend on said
5205
5206
First-party isolation in Firefox: what breaks if you enable it?
Firefox’s FPI system keeps websites from tracking your movements across websites. This gives excellent privacy protections but at a cost of web compatibility.
5207
The mysterious case of missing URLs and Google's AMP
When I saw a speculative article about Google wanting to “kill” URLs appear in my news feed, I didn’t think too much about it. Trying to hide “ugly” URLs… well, that feels like a natural thing for an app to try and do. Designers of apps often (erroneously) assume that users cannot cope with “technical” things like…
5208
Keybase’s browser extension subverts its encryption
The Keybase browser extension subverts the app's end-to-end encryption. Keybase considers that "an acceptable risk" and not worth fixing.
5209
Brute Force Incognito Browsing
Both Firefox and Chrome have a feature for creating temporary private browsing sessions. Firefox calls it Private Browsing and Chrome calls it Incognito Mode . Both work essentially the same way. A temporary browsing session is started without carrying over most existing session state (cookies, etc.), and no state…
5210
Tor Browser 8.0 released
We gave the world’s most private browsing experience a UX overhaul.
5211
Distrust of Symantec TLS Certificates
A Certification Authority (CA) is an organization that browser vendors (like Mozilla) trust to issue certificates to websites. Last year, Mozilla published and discussed a set of issues with one ...
5212
You can't contain me: elevation-of-privilege vulnerability in Docker for Windows
I have been continuing my journey of searching for windows breakout vulnerabilities in popular applications and one that I discovered in March I found intere...
5213
MikroTik routers are forwarding owners’ traffic to unknown attackers
[Update] 2018-09-05 11:00 GMT+8, with the generous help from the AS64073, 103.193.137.211 has been promptly suspended and is no longer a threat. Overview MikroTik is a Latvian company founded in 1996 to develop routers and wireless ISP systems. MikroTik now provides hardware and software for
5214
Fear the reaper: characterization and fast detection of card skimmers
Fear the reaper: characterization and fast detection of card skimmers Scaife et al., USENIX Security 2018 Until I can get my hands on a Skim Reaper I’m not sure I’ll ever trust an ATM or other expo…
5215
5216
Changing Our Approach to Anti-Tracking
In the near future, Firefox will -- by default -- protect users by blocking tracking while also offering a clear set of controls to give our users more choice over what information they share with sites.
5217
Approaching Access Control on the Web (Part I)
Learn how to build future-proof, state of the art login, access control and API security systems in this multipart series.
5218
Very Good Security
“Never answer an anonymous letter” —Yogi Berra Did you ever wonder why doctor offices ask for your social security number? They don’t want to keep your SSN, but it’s the primary “key” that identifies you to an insurance company. In computer science/math terms, they need to call a function. Let’s call it: int…
5219
Australia’s Proposed Surveillance Laws Will Break the Trust Tech Depends On
In the last few years, we’ve discovered just how much trust — whether we like it or not — we have all been obliged to place in modern technology. Third-party software, of unknown composition and security, runs on everything around us: from the phones we carry around, to the smart devices with...
5220
Sen. Wyden Confirms Cell-Site Simulators Disrupt Emergency Calls
Sen. Ron Wyden has sent a letter to the U.S. Department of Justice concerning disruptions to 911 emergency services caused by law enforcement’s use of cell-site simulators (CSS, also known as IMSI catchers or Stingrays). In the letter, Sen. Wyden states that:Senior officials from the Harris...