511
Building a Faraday cage with data passthrough for ESP32 reverse engineering
Instructions for building an affordable Faraday cage
New
The latest blog posts to take off on Hacker News. 536 posts.
512
How to delete your data from data brokers
Digital safety is public safety. We're building the knowledge, standards, and tools people need to face online harm — together.
513
Exploring Podman: A More Secure Docker Alternative
This article explore Podman's features and benefits, comparing it to Docker and describing a step-by-step migration guide
514
A decade-old Steam bug
Valve has shown to occasionally not act on community feedback and bug reports. A story about a decade old bug.
515
A supply chain attack on PyTorch
Security tends to lag behind adoption, and AI/ML is no exception. Four months ago, Adnan Khan and I exploited a critical CI/CD vulnerability in PyTorch, one of the world’s leading ML platform…
516
Keycloak open redirect: wildcard redirect URIs can be exploited to steal tokens
CVE-2023-6927 Keycloak vulnerability allows bypassing redirect URI validation which can be used as a vector for stealing authorization codes, access tokens and be used to redirect victims to arbitrary hosts.
517
Attack of the Week: Airdrop Tracing
It’s been a while since I wrote an “attack of the week” post, and the fault for this is entirely mine. I’ve been much too busy writing boring posts about Schnorr signatures!…
518
Outlook is Microsoft's new data collection service
The new Outlook now appears to be a data collection service for Microsoft’s 801 external partners for targeted advertising.
519
Meta unlawfully ignores the users' right to easily withdraw consent: complaint
If Instagram and Facebook users want to withdraw their consent, they have to buy an expensive subscription
520
I pwned half of America's fast food chains simultaneously
How I pwned half of America’s fast food chains, simultaneously. Also checkout Eva’s blogpost of this event. With an upbeat pling my console alerted me that my script had finished running, to be precise it was searching for exposed Firebase credentials on any of the hundreds of recent AI startups. This was achieved…
521
Bit-Banging Bluetooth Low Energy
Dmitry.GR: Creating BTLE-compliant advertisement packets, so that iOS and android devices can see and parse them.
522
Attacks on machine learning models
HN discussion
523
The browser's biggest TLS mistake
Much like a previous talk of mine at Chaos Computer Congress this blog post is a direct write-up of a talk, if you prefer to consume this kind of content in video form you can watch the video here:
524
Age verification is incompatible with the internet
The recent move among U.S. states to add digital “age verification” to websites which serve adult content is a troubling one. Digital age verification systems are rife with privacy concerns, many requiring you to upload your government ID to third-party vendors or even directly to the website in question. Privacy…
525
WPA3 Enterprise 192-bit mode at home
For our 2023 holiday project, we're setting up an WPA3 Enterprise certificate-authenticated Wi-Fi network at home! And when your family from out of town asks to "jump on the Wi-Fi real quick," you'll learn why this type of network is such a hassle to manage.
526
527
Ten years isn't long enough for maximum age settings
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
528
The Curious Case of MD5
Recently I came across a puzzling fact: the International Criminal Court hashes electronic evidence with MD5, even though MD5 is badly broken. So, why are lawyers using broken, outdated technology? The answer involves the common law system, cultural isolation, and a single man named Don L. Lewis.
529
Someone was breaking into Orange Spain RIPE account (and break their /12)
Ah. Orange Spain has had their /12 (and likely others) broken by (what appears to be) someone breaking into their RIPE account and making RPKI ROA's to somewher...
530
OpenBSD Workstation Hardening
In this blog post, you will learn different methods to harden your OpenBSD system, and in which situation they are useful
531
Bitwarden Heist – How to break into password vaults without using passwords
Sometimes, making particular security design decisions can have unexpected consequences. For security-critical software, such as password managers, this can easily lead to catastrophic failure: In this blog post, we show how Bitwarden’s Windows Hello …
532
AI generated security reports about curl
I have held back on writing anything about AI or how we (not) use AI for development in the curl factory. Now I can't hold back anymore. Let me show you the most significant effect of AI on curl as of today - with examples. Bug Bounty Having a bug bounty means that we offer … Continue reading The I in LLM stands for…
533
Double encryption: Analyzing the NSA/GCHQ arguments against hybrids
In 2019, Google and Cloudflare ran an experiment where they upgraded HTTPS for many "real users’ connections" to use post-quantum encryption. They then reported statistics on how affordable this was. Google had also run a similar experiment in 2016: "While it's still very early days for quantum computers, we're…
534
The funny rules of SpamAssassin in 2023
This investigation was surprising to me so I thought it would be interesting to share my findings and I hope you'll like it.
535
536
EFF Year in Review: Google's Corporate Paternalism in the Browser
It’s a big year for the oozing creep of corporate paternalism and ad-tracking technology online. Google and its subsidiary companies have tightened their grips on the throat of internet innovation, all while employing the now familiar tactic of marketing these things as beneficial for users. Here...