31
The NSA: An Inside View
In which I relate my experience as an NSA employee and impart my thoughts on the policies in place, my former coworkers, and the current cyber war.
New
The latest blog posts to take off on Hacker News. 431 posts.
32
How to send DMs on Twitter without permission
I just recalled " SMS commands " feature and tried to send a DM (private, direct message) with "Share on Twitter"-button. It works! Twitt...
33
Google Removes Vital Privacy Feature From Android, Claims Release Was Accidental
Yesterday, we published a blog post lauding an extremely important app privacy feature that was added in Android 4.3. That feature allows users to install apps while preventing the app from collecting sensitive data like the user's location or address book.[caption]The App Ops interface removed in...
34
35
36
Meet Jack. Or, What The Government Could Do With All That Location Data
We now know that the NSA is collecting location information en masse. As we’ve long said, location data is an extremely powerful set of information about people.
37
38
TextSecure, Now With 10 Million More Users
At Open Whisper Systems, we’re working to both advance the state of the art for secure communication and also reduce the friction required for ordinary people to make use of it. We want everyone to have access to advanced secure communication methods that are as easy and reliable to use as makin...
39
Further improving digital certificate security
Posted by Adam Langley, Security Engineer Late on December 3rd, we became aware of unauthorized digital certificates for several Google do...
40
“No-fly” trial: Closing arguments
Judge William Alsup convened day five of the trial in Ibrahim v. DHS — the first lawsuit challenging a U.S. government “no-fly” order to make it to trial — on Friday morning with the announcement that, “I received this additional material about the [plaintiff’s] daughter and her attempts to come here.”
41
Is Unicode Safe?
Unicode is just too complex to ever be secure.  — Bruce Schneier, 2000 Over the last 25 years Unicode has succeeded. It hasn't displaced all other character encodings, but it's clearly on its way there. It's supported widely enough that it's a compatible choice, new projects use it, and it's becoming the…
42
Evading Airport Security
The news is reporting about Evan Booth, who builds weaponry out of items you can buy after airport security. It’s clever stuff. It’s not new, though. People have been explaining how to evade airport security for years. Back in 2006, I—and others—explained how to print your own boarding pass and evade the photo-ID…
43
44
45
RJS leaking vulnerability in multiple Rails applications
I wrote about this problem in May, without showcases, just a theoretical post http://homakov.blogspot.com/2013/05/do-not-use-rjs-like-techn...
46
Facebook reveals friends list even when it’s set to private
The Sophos Blog
47
Advanced cryptographic ratcheting
At Open Whisper Systems, we’ve been working on improving our encrypted asynchronous chat protocol for TextSecure. The TextSecure protocol was originally a derivative of OTR, with minor changes to accommodate it for transports with constraints like SMS or Push. Some of the recent changes we’ve ...
48
49
50
51
Google Account Recovery Vulnerability
Global Main Authentication and Identification Library (GMAIL) was exposed to a security threat by Oren Hafif.
52
LG TV logging filenames from network folders
After DoctorBeet’s blog post detailing his LG TV’s shady logging practices I decided to have a look at what my own was doing. To start off I couldn’t seem to find an option to disable logging…
53
54
LG Smart TVs log USB filenames and viewing info to LG servers
Earlier this month I discovered that my new LG Smart TV was displaying ads on the Smart landing screen. After some investigation, I f...
55
Visual Cryptography
How to create perfect secret messages that can be decoded using just your eyes.
56
Microsoft ‘Mortally Wounds’ SHA-1
Microsoft has announced that CAs in its root program may not issue certs signed using the SHA-1 algorithm, starting just over two years from now, and that Windows will start refusing to recognise such certs starting just over 3 years from now.
57
Adobe credentials and the serious insecurity of password hints
Adobe had a little issue the other day with the small matter of 150 million accounts being breached and released to the public. Whoops. So what are we talking about? A shed load of records containing an internal ID, username, email, encrypted password and a password hint. Naked Security did
58
Severing Ties with the NSA
Note: These pages make extensive use of the latest XHTML and CSS Standards . They ought to look great in any standards-compliant modern browser. Unfortunately, they will probably look horrible in older browsers, like Netscape 4.x and IE 4.x. Moreover, many posts use MathML, which is, currently only supported in…
59
NSA's Surveillance Powers Extend Far Beyond Counterterrorism
Time and again we’ve seen the National Security Agency (NSA) defend its vast surveillance apparatus by invoking the spectre of terrorism, discussing its spying powers as a method to keep America safe. Yet, the truth is that counterterrorism is only a fraction of their far broader authority to seek...
60
