541
New
The latest blog posts to take off on Hacker News. 612 posts.
542
Dangerous domain corp.com goes up for sale
As an early domain name investor, Mike O’Connor had by 1994 snatched up several choice online destinations, including bar.com, cafes.com, grill.com, place.com, pub.com and television.com. Some he sold over the years, but for the past 26 years O’Connor refused to auction perhaps the most sensitive domain in his stable…
543
Critical Bluetooth vulnerability in Android
On November 3rd, 2019, we have reported a critical vulnerability affecting the Android Bluetooth subsystem. This vulnerability has been assigned CVE-2020-0022 and was now patched in the latest security patch from February 2020. The security impact is as follows:
544
Zero-days in Cisco Discovery Protocol
Identify which devices of your company are impacted by five vulnerabilities that Armis found out in the Cisco Discovery Protocol (CPD).
545
Your New Medical Credit Score Could Deny You Care
There is now a number, that you can't see, that follows you wherever you go.
546
547
Mental health websites don't have to sell user data but most still do
The changes discussed in this article are based on a second analysis performed in late November, 3 months after the original study Your Mental Health is for Sale and following the exact same methodology.
548
549
Using ‘radioactive data’ to detect if a data set was used for training
Facebook AI has developed a new technique to mark the images in a dataset, so that researchers can then determine if a particular machine learning model...
550
Wacom tablets track every app you open
I have a Wacom drawing tablet. I use it to draw cover illustrations for my blog posts, such as this one.
551
Website data leaks pose greater risks than most people realize
Students find website data leaks pose greater risks than most people realize
552
Anatomy of a Rental Phishing Scam
I was recently the (unsuccessful) target of a very well-crafted phishing scam. As part of a housing search a few weeks ago, I was trawling craigslist and zillow for rental opportunities in the SF bay area. I reached out to a beautiful looking rental place to inquire about a tour. Despite my experience as a security…
553
554
Swift Crypto
I’m thrilled to announce a new open-source project for the Swift ecosystem, Swift Crypto. Swift Crypto is a new Swift package that brings the fantastic APIs of Apple CryptoKit to the wider Swift community. This will allow Swift developers, regardless of the platform on which they deploy their applications, to access…
555
TeamViewer stores user passwords in registry, encrypted with hard-coded key
Oh man where to even begin with this one. This was a crazy ride and I learned a ton along the way.
556
How to decrypt WhatsApp end-to-end media files
At the center of the "Saudis hacked Bezos" story is a mysterious video file investigators couldn't decrypt, sent by Saudi Crown Prince MBS t...
557
Buffer overflow when pwfeedback is set in sudoers
Sudo’s pwfeedback option can be used to provide visual feedback when the user is inputting their password. For each key press, an asterisk is printed. This option was added in response to user confusion over how the standard Password: prompt disables the echoing of key presses. While pwfeedback is not enabled by…
558
Writing Safe Shell Scripts (2019)
This page was migrated from the old website and has not been manually reviewed, or is here for historical purposes. We make no guarantees that the content is up-to-date or reflects SIPB's current views. Contact sipb-www@mit.edu if anything is broken or you have other questions or feedback.
559
560
ACLU: ICE and CBP Are Secretly Tracking Us Using Stingrays. We’re Suing
The public has a right to know if and how often ICE and CBP are using Stingrays.
561
New Cryptographic Tools on Keybase
You're reading the Keybase blog. There are more posts . When you're done, you can install Keybase .
562
Critical flaw in Trezor hardware wallets
Kraken Security Labs has devised a way to extract seeds from both cryptocurrency hardware wallets offered from industry leader Trezor, the Trezor One and Trezor Model T. The attack requires just 15 minutes of physical access to the device. This is the first time that the detailed steps for a current attack against…
563
The EARN IT Act: how to ban end-to-end encryption without banning it
Stanford Center for Internet and Society2020613 points234 commentscited by 8Society, Policy & Culture details
The story so far: In the ‘90s the Internet was created. This has made a lot of people very angry and been widely regarded as a bad move. (with apologies to Douglas Adams)[1] There’s a new bill afoot in Congress called the EARN IT Act. A “discussion draft”
564
“Why Using WhatsApp Is Dangerous“
telegra.ph/why-using-whatsapp-is-dangerous-01-30-42020381 points234 commentscited by 3Security & Privacy details
A few months ago I wrote about a WhatsApp backdoor that allowed hackers to access all data on any phone running WhatsApp [1]. Facebook, its parent company, claimed at the time that they had no proof the flaw had ever been used by attackers [2]. Last week it became clear that this backdoor had been exploited to extract…
565
OpenSK: a fully open-source security key implementation
Posted by Elie Bursztein, Security & Anti-abuse Research Lead, and Jean-Michel Picod, Software Engineer, Google Today, FIDO security...
566
Advice to avoid public Wi-Fi is mostly out of date
If you follow security on the Internet, you may have seen articles warning you to “beware of public Wi-Fi networks" in cafes, airports, hotels, and other public places. But now, due to the widespread deployment of HTTPS encryption on most popular websites, advice to avoid public Wi-Fi is mostly out...
567
Off-Facebook Activity Is a Welcome but Incomplete Move
Today Facebook announced the roll-out of its Off-Facebook Activity tool (initially introduced as “Clear History” nearly two years ago). The tools shows you a list of apps, websites, and businesses that Facebook knows you have visited through its business tools (including Facebook Login, Facebook’s...
568
De-Anonymization via Clickjacking in 2019
This blog post is about my journey to understand the current practice of de-anonymization via the clickjacking technique whereby a malicious website is able to uncover the identity of a visitor, including his full name and possibly other personal information. I don’t present any new information here that isn’t already…
569
How Popular Is “Sign in with Apple”?
Link to: https://benpackard.github.io/blog/2020-01-28-sign-in-with-apple/
570
Anatomy of a Scam
There is a lot of material about the not-so-nice VCs who take advantage of young and inexperienced founders. But the reverse also happens, founders that try to get money out of VCs for projects that have zero chance of every coming to fruit. Or worse still, founders that pretend to have something on the go when they…