31
Nobody expects CDATA sections in XML
I made a very explicit, pragmatic design decision with afl-fuzz : for performance and reliability reasons, I did not want to get into stati...
New
The latest blog posts to take off on Hacker News. 391 posts.
32
Inline PGP signatures considered harmful
People often suggest that inline PGP signatures in e-mail are somehow more compatible or more acceptable than using PGP/MIME . This is a mistake. Inline PGP signatures are prone to several failure modes, up to and including undetectable message tampering.
33
Zero Knowledge Proofs: An illustrated primer
One of the best things about modern cryptography is the beautiful terminology. You could start any number of punk bands (or Tumblrs) named after cryptography terms like ‘hard-core predicate&#…
34
Escaping the Safari sandbox with a kernel GPU bug
Posted by Ian BeerTL;DRAn OS X GPU driver trusted a user-supplied kernel C++ object pointer and c...
35
The Increasing Trend of Online Extortion
I heard about this guy, walked into a federal bank with a portable phone, handed the phone to the teller, the guy on the other end of the phone said: “We got this guy’s little girl, and if you don’t give him all your money, we’re gonna
36
37
38
39
Regin: Top-tier espionage tool enables stealthy surveillance
Broadcom Community - VMTN, Mainframe, Symantec, Carbon Black
40
A New Malware Detection Tool That Can Expose Illegitimate State Surveillance
Recent years have seen a boom in the adoption of surveillance technology by governments around the world, including spyware that provides its purchasers the unchecked ability to target remote Internet users' computers, to read their personal emails, listen in on private audio calls, record...
41
Google disables SSL search at BT’s request
Update – Since this was posted, Max Allan and Damion Yates have investigated further and found that BT are intercepting DNS queries and replying with doctored DNS results, which I didn’…
42
43
Open Whisper Systems partners with WhatsApp to provide end-to-end encryption
At Open Whisper Systems, our goal is to make private communication simple. For the past three years, we’ve been developing a modern, open source, strong encryption protocol for asynchronous messaging systems, designed to make seamless end-to-end encrypted messaging possible. Today we’re excited ...
44
Launching in 2015: A Certificate Authority to Encrypt the Entire Web
Today EFF is pleased to announce Let’s Encrypt, a new certificate authority (CA) initiative that we have put together with Mozilla, Cisco, Akamai, IdenTrust, and researchers at the University of Michigan that aims to clear the remaining roadblocks to transition the Web from HTTP to HTTPS.Although...
45
The USA Freedom Act: What's to Come and What You Need to Know
Update, Nov 18: The USA Freedom Act does not renew the entirety of the Patriot Act, which consisted of over 100 sections changing numerous electronic surveillance laws. The USA Freedom Act does extend three provisions of the Patriot Act: the "lone wolf" provision, the "roving wire tap" provision,...
46
47
Unraveling NSA's TURBULENCE Programs
The NSA TURBULENCE program was first revealed in 2007 by the Baltimore Sun for being over-budget and poorly-managed 1 2 . Many documents from the Snowden trove from the past two years reference parts of this program, but no coherent story or overview of how these programs operate together has been described. This is…
48
49
What does the NSA think of academic cryptographers?
Brighten Godfrey was one of my officemates when we were grad students at Berkeley. He’s now a highly-successful computer networking professor at the University of Illinois Urbana-Champaign, …
50
Unsealed Filing Shows DOJ Misled Appeals Court About NSL Gag Orders
A court filing unsealed late Wednesday shows that the U.S. Department of Justice (DOJ) made a highly misleading argument to an appeals court in October during a hearing on the constitutionality of National Security Letters (NSLs). On October 8, the Electronic Frontier Foundation argued before the...
51
It’s time to extend the US Privacy Act to EU citizens
Last summer’s Snowden revelations not only highlighted the urgent need for surveillance reform but also severely damaged relations between t...
52
BrowserStack Post Mortem (Shell shocked)
Official transparency report on the November 2014 BrowserStack security breach involving a legacy prototype server (Shellshock). Incident fully resolved. BrowserStack is now SOC 2 Type II, ISO 27001:2022, and GDPR compliant. Trusted by 50,000+ companies.
53
ISPs Removing Their Customers' Email Encryption
Recently, Verizon was caught tampering with its customer's web requests to inject a tracking super-cookie. Another network-tampering threat to user safety has come to light from other providers: email encryption downgrade attacks. In recent months, researchers have reported ISPs in the US and...
54
Polaris Privacy Initiative to Accelerate User-focused Privacy Online
At Mozilla, we believe that an individuals’ privacy on the Internet cannot be treated as optional. Our Privacy Principles guide us with the design of each of our products and ...
55
All cameras are police cameras
Welcome to The Nor, a series of essays by James Bridle commissioned by the Hayward Gallery in 2014/5. In order, the essays are: All Cameras Are Police Cameras , Living in the Electromagnetic Spectrum , and Low Latency , as well as an Epilogue . These are accompanied by photographs and a map , and additional content…
56
Thoughts and Concerns about Operation Onymous
What happened Recently it was announced that a coalition of government agencies took control of...
57
Libtls – New TLS API from LibreSSL
tls_init , tls_config_new , tls_config_free , tls_config_error — initialize TLS client and server API
58
Pulling JPEGs out of thin air
This is an interesting demonstration of the capabilities of afl ; I was actually pretty surprised that it worked! $ mkdir in_dir $ echo ' h...
59
GnuPG - What’s new in 2.1
A possibly revised version of this article can be found at: https://gnupg.org/faq/whats-new-in-2.1.html
60
How I reverse-engineered Google Docs to play back any document's keystrokes
How James Somers reverse-engineered Google Docs to play back any document's keystrokes