5431
New
The latest blog posts to take off on Hacker News. 8,772 posts.
5432
Sunsetting Tor Messenger
In 2015, we introduced Tor Messenger, a cross-platform chat program that aimed to be secure by...
5433
Panera Bread did nothing about its customer data vulnerability for eight months
tl;dr: In August 2017, I reported a vulnerability to Panera Bread that allowed the full name, home address, email address, food/dietary…
5434
Oblivious DNS: Plugging the Internet’s Biggest Privacy Hole
by Annie Edmundson, Paul Schmitt, Nick Feamster The recent news that Cloudflare is deploying their own DNS recursive resolver has once again raised hopes that users will enjoy improved privacy, since they can send DNS traffic encrypted to Cloudflare, rather than to their ISP. In this post, we explain why this approach…
5435
Panerabread.com leaks millions of customer records
Panerabread.com , the Web site for the American chain of bakery-cafe fast casual restaurants by the same name, leaked millions of customer records — including names, email and physical addresses, birthdays and the last four digits of the customer’s credit card number — for at least eight months before it was yanked…
5436
1.1.1.1: Fast, privacy-first consumer DNS service
Cloudflare's mission is to help build a better Internet. We're excited today to take another step toward that mission with the launch of 1.1.1.1 — the Internet's fastest, privacy-first consumer DNS service. This post will talk a little about what that is and a lot about why we decided to do it.
5437
APFS encrypted plaintext password found in another log file
UPDATE: PLEASE HELP ME TEST At some point you just need to stop looking and be blissfully ignorant...this was not one of those days. In and update to my previously updated blog article , I have found another instance where the plaintext password was written to system logs. Thi
5438
Reversing a MacOS Kernel Extension
In my last post I covered the basics of kernel debugging in macOS. In this post we will put some of that to use and work through the process of reversing a macOS kernel module. As I said in my last post, in macOS there is a kernel module named “Don’t Steal Mac OS X” (DSMOS) which registers a function with the Mach-O…
5439
Cloudflare supports Privacy Pass
Cloudflare supports Privacy Pass, a recently-announced privacy-preserving protocol developed in collaboration with researchers from Royal Holloway and the University of Waterloo.
5440
5441
Have I Been Pwned Is Now Partnering with 1Password
The penny first dropped for me just over 7 years ago to the day: The only secure password is the one you can't remember [https://www.troyhunt.com/only-secure-password-is-one-you-cant/]. In an era well before the birth of Have I Been Pwned [https://haveibeenpwned.
5442
Qubes OS 4.0 has been released
After nearly two years in development and countless hours of testing, we’re pleased to announce the stable release of Qubes OS 4.0! Major changes in version 4.0 Version 4.0 includes several fundamental improvements to the security and functionality of Qubes OS: The Qubes Admin API Qubes...
5443
VPN leaks users’ IPs via WebRTC
VPN leaks users’ IPs via WebRTC: I’ve tested hundred VPN and Proxy providers and 19 of them leaks users’ IPs via WebRTC (16%)
5444
5445
Windows 7 patch for Meltdown enabled arbitrary reads and writes in kernel memory
Did you think Meltdown was bad? Unprivileged applications being able to read kernel memory at speeds possibly as high as megabytes per seco...
5446
Facebook Container Extension: Take control of how you’re being tracked
Our Multi-Account Containers extension has been a game changer for many users, letting them manage various parts of their online life without intermingling
5447
Logs in High Sierra Show Plaintext Password for APFS Encrypted External Volumes
UPDATE: PLEASE HELP ME TEST UPATE TO THE UPDATE: Similar log entries are now found in another system log that is more persistent, see the article here . UPDATE: This is still vulnerable on current versions of macOS 10.13.3 when encrypted an ALREADY EXISTING unencrypted APFS volume
5448
EU GDPR – Another reason for SaaS to reconsider on-premise
We review GDPR's impact on SaaS vendors and data collection practices and how it may reduce the cost disparity between hosted SaaS and on-premises Private SaaS.
5449
How a Political Engineering Firm Exposed Their Code Base
Political data firm AggregateIQ exposed IT assets that raise questions for society about how technology is being used in recent US political history.
5450
Who and what is Coinhive?
Multiple security firms recently identified cryptocurrency mining service Coinhive as the top malicious threat to Web users, thanks to the tendency for Coinhive’s computer code to be used on hacked Web sites to steal the processing power of its visitors’ devices. This post looks at how Coinhive vaulted to the top of…
5451
5452
TLS 1.3 approved
Search IETF mail list archives
5453
Our suite of Ethereum security tools
Two years ago, when we began taking on blockchain security engagements, there were no tools engineered for the work. No static analyzers, fuzzers, or reverse engineering tools for Ethereum. So, we invested significant time and expertise to create what we needed, adapt what we already had, and refine the work…
5454
With SESTA/FOSTA, lawmakers failed to separate good intentions from bad law
In Passing SESTA/FOSTA, Lawmakers Failed to Separate Their Good Intentions from Bad LawToday was a dark day for the Internet.The U.S. Senate just voted 97-2 to pass the Allow States and Victims to Fight Online Sex Trafficking Act (FOSTA, H.R. 1865), a bill that silences online speech by forcing...
5455
Responsibility Deflected, the CLOUD Act Passes
UPDATE, March 23, 2018: President Donald Trump signed the $1.3 trillion government spending bill—which includes the CLOUD Act—into law Friday morning. “People deserve the right to a better process.”Those are the words of Jim McGovern, representative for Massachusetts and member of the House of...
5456
Protecting Security Researchers
Dash knows your context, your team, and your work, so your team can stay organized, easily find and share knowledge, and keep projects secure, all from one place.
5457
The Legitimisation of Have I Been Pwned
There's no way to sugar-coat this: Have I Been Pwned [https://haveibeenpwned.com/] (HIBP) only exists due to a whole bunch of highly illegal activity that has harmed many individuals and organisations alike. That harm extends all the way from those in data breaches feeling a sense of
5458
Breaking the Ledger Security Model
In this post, I’m going to discuss a vulnerability I discovered in Ledger hardware wallets. The vulnerability arose due to Ledger’s use of a custom architecture to work around many of the limitations of their Secure Element.
5459
A picture got my PostgreSQL database to start mining Monero
A Deep Dive into Database Attacks [Part III]: Why Scarlett Johansson’s Picture Got My Postgres Database to Start Mining Monero
5460