5221
Cracking Litter Box DRM
TLDR : My robot cat litter box bricks itself after a set number of washes with each soap cartridge so I reverse engineered and suppressed the verfication process to enable refilling.
New
The latest blog posts to take off on Hacker News. 8,772 posts.
5222
Why Static Websites Need HTTPS
It was Jan last year that I suggested HTTPS adoption had passed the "tipping point" [https://www.troyhunt.com/https-adoption-has-reached-the-tipping-point/], that is, it had passed the moment of critical mass [https://en.wikipedia.org/wiki/The_Tipping_Point] and as I said at the
5223
The NSA Continues to Violate Americans' Internet Privacy Rights
A federal court will be scrutinizing one of the National Security Agency’s worst spying programs on Monday. The case has the potential to restore crucial privacy protections for the millions of Americans who use the internet to communicate with family, friends, and others overseas.
5224
5225
Remote Code Execution on a Facebook server
I regularly search for vulnerabilities on big services that allow it and have a Bug Bounty program. Here is my first paper which covers a vulnerability I discovered on one of Facebook’s servers.
5226
5227
Court has confirmed coordinated raids of Zwiebelfreunde in Germany were illegal
Update July 10th: Last week Monday, prosecution stated that they will keep our things for further analysis, even after explicitly confirming to journalists that they are aware that our only connection to Riseup is the collection of donations. This includes items belonging to our partners, and other third parties like…
5228
Intel Publishes Microcode Patches, No Benchmarking or Comparison Allowed
UPDATE: Intel has resolved their microcode licensing issue which I complained about in this blog post. The new license text is here .
5229
How I recorded user behaviour on my competitor’s websites
A test that hijacked the Chrome back button to send visitors to a fake Google results page, then to mirrored competitor pages where heatmaps, sessions and typing were recorded. Google de-indexed the whole domain.
5230
Telling the Truth About Defects in Technology Should Never Be Illegal
Congress has never made a law saying, "Corporations should get to decide who gets to publish truthful information about defects in their products,"— and the First Amendment wouldn't allow such a law — but that hasn't stopped corporations from conjuring one out of thin air, and then defending it as...
5231
5232
Why Do Keynote Speakers Keep Suggesting That Improving Security Is Possible?
Some people enter the technology industry to build newer, more exciting kinds of technology as quickly as possible. My keynote will savage these people and will burn important professional bridges, likely forcing me to join a monastery or another penance-focused organization. In my keynote, I will explain why the…
5233
5234
OpenPGPjs has passed an independent security audit
We maintain the OpenPGPjs encryption library. After some recent code enhancements, OpenPGPjs underwent an independent security audit, the results of which are discussed in this article.
5235
Twitter's Secret “Guest Mode”
Twitter has an undocumented feature which lets you follow accounts without being logged in. Here's how I found it, and how you can use it. My crappy old TV has a crappy old web browser on it. One boring Sunday, I decided to see which websites worked and which didn't on a 6 year old browser. Anything using LetsEncrypt…
5236
TLS 1.3 Is an Opportunity for Amazon, Google and Microsoft to End Censorship
A new standard for cryptography is on the horizon, called Transport Level Security 1.3 (TLS 1.3). TLS 1.3 is a major update to cryptography, and
5237
5238
Dropbear SSH, a lightweight alternative to OpenSSH
Dropbear is a small and lightweight SSH server and client that can replace OpenSSH on any POSIX platform such as GNU / Linux, * BSD, Cygwin … Dropbear is free software since it is released under MIT-style licenses.
5239
Understanding L1 Terminal Fault aka Foreshadow: What You Need to Know
L1 Terminal Fault/Foreshadow explained in ~three minutesFor a more detailed technical view of L1 Terminal Fault, please see this deeper dive with Jon Masters.How we got here: a brief history of modern microprocessor cachesModern computer microprocessors are complex machines, filled with many optimizations designed to…
5240
LaTeX TikZ for Cryptographers
LaTeX Code for Cryptographic Images.
5241
5242
Faxploit: Sending Fax Back to the Dark Ages
Research By: Eyal Itkin, Yannay Livneh and Yaniv Balmas Fax, the brilliant technology that lifted mankind out the dark ages of mail delivery when only the postal service and carrier pigeons were used to deliver a physical message from a sender to a receiver. Technology wise, however, that was a long time ago. Today […]
5243
Practical Web Cache Poisoning
In this paper I'll show you how to compromise websites by using esoteric web features to turn their caches into exploit delivery systems
5244
5245
5246
Systemd's DynamicUser feature is currently dangerous
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
5247
The Secret API of Banks
Interacting with bank data often requires trusting 3rd parties with your credentials. What if there were a more secure way to explore transactions?
5248
5249
5250
Let's Encrypt Root Trusted by All Major Root Programs
As of the end of July 2018, the Let’s Encrypt root, ISRG Root X1, is directly trusted by Microsoft products. Our root is now trusted by all major root programs, including Microsoft, Google, Apple, Mozilla, Oracle, and Blackberry. Today’s announcement that we’re trusted by all major root programs represents a major…