541
Claude Shannon: The Mathematical Theory of Cryptography
The foundation of modern cryptography.
New
The latest blog posts to take off on Hacker News. 678 posts.
542
Avoid Consumer Routers
Consumer Routers are not secure
543
Can We Stop Pretending SMS Is Secure Now?
SMS text messages were already the weakest link securing just about anything online, mainly because there are tens of thousands of employees at mobile stores who can be tricked or bribed into swapping control over a mobile phone number to someone else. Now we’re learning about an entire ecosystem of companies that…
544
Librem Tunnel Is Leaving iOS
Purism makes premium phones, laptops, mini PCs and servers running free software on PureOS. Purism products respect people's privacy and freedom while protecting their security.
545
It’s time to stop using SMS for security
By now most infosec professionals are aware of various ways SMS text messaging can be hijacked. For example so-called “SIM Swap” attacks…
546
Facebook's GDPR consent bypass reaches Austrian Supreme Court
Austrian Supreme Court may refer case to Court of Justice, questioning the basis of Facebook's business model in Europe.
547
The FBI Should Stop Attacking Encryption
Federal law enforcement has been asking for a backdoor to read Americans’ encrypted communications for years now. FBI Director Christopher Wray did it again last week in testimony to the Senate Judiciary Committee. As usual, the FBI’s complaints involved end-to-end encryption employed by popular...
548
Docker Security Cheat Sheet
Website with the collection of all the cheat sheets of the project.
549
How Git servers work, and how to keep yours secure
Disclaimer: I’m no sysadmin extraordinaire, please please please correct me if there’s something blatantly wrong here:
550
A Spectre proof-of-concept for a Spectre-proof web
Posted by Stephen Röttger and Artur Janc, Information Security Engineers Three years ago, Spectre changed the way we think about security b...
551
Fuzzing Java in OSS-Fuzz
Posted by Jonathan Metzman, Google Open Source Security Team OSS-Fuzz , Google’s open source fuzzing service, now supports fuzzing applicat...
552
The security scanner that cried wolf
If you’ve ever been alarmed by how many security vulnerabilities your Docker image has, even after you’ve installed security updates, here’s what’s going on.
553
No, RSA Is Not Broken
I have been seeing this paper by cryptographer Peter Schnorr making the rounds: “Fast Factoring Integers by SVP Algorithms.” It describes a new factoring method, and its abstract ends with the provocative sentence: “This destroys the RSA cryptosystem.” It does not. At best, it’s an improvement in factoring—and I’m not…
554
Half of curl’s vulnerabilities are C mistakes
I spent a lot of time and effort digging up the numbers and facts for this post! Lots of people keep referring to the awesome summary put together by a friendly pseudonymous "Tim" which says that "53 out of 95" (55.7%) security flaws in curl could've been prevented if curl had been written in Rust. … Continue reading…
555
A bug related to handling of authenticated sessions
On the evening of March 8, we invalidated all authenticated sessions on GitHub.com created prior to 12:03 UTC on March 8 out of an abundance of caution.
556
Amazon Assistant lets Amazon track your every move on the web
Amazon Assistant browser extension delegates its wide range of privileges to Amazon web services. The potential for misuse is enormous.
557
What science can tell us about C and C++'s security
There are not a lot of very strong empirical results in the field of programming languages . This is probably because there’s a huge amount of variables to control for, and most of the subjects available to researchers are CS undergraduates. However, I have recently found a result replicated across numerous codebases…
558
30k U.S. organizations newly hacked via holes in Microsoft Exchange Server
At least 30,000 organizations across the United States — including a significant number of small businesses, towns, cities and local governments — have over the past few days been hacked by an unusually aggressive Chinese cyber espionage unit that’s focused on stealing email from victim organizations, multiple sources…
559
The reason Okta spent $6.5B on Auth0
Explore the business drivers behind Okta's acquisition of Auth0, including market positioning, strategic goals, and the future of authentication providers.
560
Google’s FLoC Is a Terrible Idea
Update, April 9, 2021 : We've launched Am I FLoCed, a new site that will tell you whether your Chrome browser has been turned into a guinea pig for Federated Learning of Cohorts or FLoC, Google’s latest targeted advertising experiment. The third-party cookie is dying, and Google is trying to create...
561
Gab Has Been Breached
I've investigated hundreds of data breaches over the years (there are 514 of them in Have I Been Pwned [https://haveibeenpwned.com/] as I write this), and for the most part, the situation with Gab is just another day on the internet. But Gab is also different, having grown
562
Bitsquatting Windows.com
Earlier this month, I came back around to seriously considering an attempt at bitsquatting. While the prior link goes into great depth on the topic, I will attempt to give a very high level overview here: If this sort of thing interests you: I tend to do stuff like this weekly. Give me a follow @_mattata
563
564
Did Schnorr destroy RSA? Show me the factors
Schnorr has claimed new factoring methods that “destroy RSA”. This should be easy to demonstrate with well known challenges.
565
Using Ghidra to Reverse Engineer Super Monkey Ball for GameCube
In Part 1, we used Dolphin’s debugger to find the location of Player 1’s score in RAM . In this article, our goal is to hack the score calculation routine so that the bonus goals do not award so many points.
566
567
Are Xiaomi browsers spyware? Yes, they are (2020)
Xiaomi browsers collect not merely your browsing history but also searches, downloads, YouTube videos watched and much more.
568
Use Touch ID for Sudo on Mac
The landscape of security is changing quite a bit. We've gone from basic username and password to 2FA, facial recognition, fingerprint recognition, and so
569
Spectre exploits in the "wild"
Personal blog of Julien (jvoisin) Voisin
570
Little League wants all your information
To sign kids up for our city’s Little League baseball …