31
Google Address Sanitizer ("compile-time valgrind") to be part of GCC 4.8
This is the mail archive of the gcc-patches@gcc.gnu.org mailing list for the GCC project .
New
The latest blog posts to take off on Hacker News. 233 posts.
32
33
Followup to "I bought more than 1 million Facebook data entries for $5"
Warning: According to Facebook you are not allowed to read this post, so beware.
34
SSH key and passwordless login basics for developers
SSH keys are useful to login over ssh (secure shell) without typing a password. They are also used by Github and other version control systems for passwordless authentication. Here is some basic information from the software developer point of view how to use SSH keys for maximum comfort and security. These…
35
The most dangerous code in the world
Abstract: SSL (Secure Sockets Layer) is the de facto standard for secure Internet communications. Security of SSL connections against an active network attacker depends on correctly validating public-key certificates presented when the connection is established. We demonstrate that SSL certificate validation is…
36
Mozilla blogger bought 1 million Facebook entries (full name, e-mail) for $5
I have the bloody habit to look for cheap deals on some websites and today I’ve got the featured offer to buy more than 1 million Facebook entries containing Full Name, e-mail and Facebook profile URL. I make a quick check over the data and surprise, surprise: most of them are real and I even know some of those users.
37
Introducing the USB Stick of Death
Several months back we have been playing with different file systems on various system platforms, examining the security posture and robustness of numerous device drivers’ implementations. One of the configurations we spent some time on was the commonly used NTFS on Microsoft Windows – as the file system is rather…
38
39
40
Master Keys
Earlier this month, a retired New York City locksmith was selling a set of “master keys” on eBay: Three of the five are standard issue for members of the FDNY, and the set had a metal dog tag that was embossed with an FDNY lieutenant’s shield number, 6896. The keys include the all-purpose “1620,” a master firefighter…
41
42
GET /browser.exe
Jon Howell dreams of a new Internet. In this new Internet, cross-browser compatibility checking is a distant memory and new features can be unilaterally be added to browsers without having to convince the world to upgrade first. The idea which makes this Internet possible is so crazy, it just might work.
43
44
Using the HTML5 Fullscreen API for Phishing Attacks
Feross Aboukhadijeh is a computer security researcher, teacher, web developer, designer, long distance runner, gamer, music lover, and builder of websites that (sometimes) go viral.
45
When Will We See Collisions for SHA-1?
On a NIST-sponsored hash function mailing list, Jesse Walker (from Intel; also a member of the Skein team) did some back-of-the-envelope calculations to estimate how long it will be before we see a practical collision attack against SHA-1. I’m reprinting his analysis here, so it reaches a broader audience. According…
46
47
48
Did NSA Put a Secret Backdoor in New Encryption Standard? (2007)
Random numbers are critical for cryptography: for encryption keys, random authentication challenges, initialization vectors, nonces, key-agreement schemes, generating prime numbers and so on. Break the random-number generator, and most of the time you break the entire security system. Which is why you should worry…
49
Bank of America Giving Access to Random Accounts
Today, we received an invoice for one of our expenses. To send the payment, I logged into Bank of America's website to use their ACH (Automated Clearing
50
51
SHA-3 to Be Announced
NIST is about to announce the new hash algorithm that will become SHA-3. This is the result of a six-year competition, and my own Skein is one of the five remaining finalists (out of an initial 64). It’s probably too late for me to affect the final decision, but I am hoping for “no award.” It’s not that the new hash…
52
53
Web Cryptography API posted as W3C working draft
This specification describes a JavaScript API for performing basic cryptographic operations in web applications, such as hashing, signature generation and verification, and encryption and decryption. Additionally, it describes an API for applications to generate and/or manage the keying material necessary to perform…
54
Virgin Mobile leaves six million subscriber accounts wide open
Update: Virgin fixed the issue Tuesday night after taking their login page down for four hours. Please see my update at the bottom of this post.
55
Analysis of bank PIN numbers
Is your PIN number too predictable? Detailed analysis on PIN number databases.
56
How to Launch a 65Gbps DDoS, and How to Stop One
Yesterday I posted a post mortem on an outage we had Saturday. The outage was caused when we applied an overly aggressive rate limit to traffic on our network while battling a determined DDoS attacker.
57
58
59
60
