31
Focus by Firefox, a Content Blocker for iOS
Today we’re pleased to announce the launch of Focus by Firefox, a free content blocker for Safari users on iOS 9 that gives users greater control of their mobile Web ...
New
The latest blog posts to take off on Hacker News. 473 posts.
32
33
When Undercover Credit Card Buys Go Bad
I recently heard from a source in law enforcement who had a peculiar problem. The source investigates cybercrime, and he was reaching out for advice after trying but failing to conduct undercover buys of stolen credit cards from a well-known underground card market. Turns out, the cybercrime bazaar’s own security…
34
Court: Breaking Your Employer's Computer Policy Isn't a Crime
The United States Court of Appeals for the Second Circuit issued an opinion rejecting the government’s attempt to hold an employee criminally liable under the federal hacking statute—the Computer Fraud and Abuse Act (“CFAA”)—for violating his employer-imposed computer use restrictions. The decision...
35
TPP Threatens Security and Safety by Locking Down US Policy on Source Code Audit
Multiple recent reports on serious security vulnerabilities in cable modems and routers paint a dire picture of the state of security of the devices that millions of users depend upon to connect to the Internet. Such vulnerabilities can be exploited to disable our access, snoop on our personal...
36
37
The Moral Character of Cryptographic Work
Abstract: Cryptography rearranges power: it configures who can do what, from what. This makes cryptography an inherently political tool, and it confers on the field an intrinsically moral dimension. The Snowden revelations motivate a reassessment of the political and moral positioning of cryptography. They lead one to…
38
39
Entering Public Beta
We’re happy to announce that Let’s Encrypt has entered Public Beta. Invitations are no longer needed in order to get free certificates from Let’s Encrypt. It’s time for the Web to take a big step forward in terms of security and privacy. We want to see HTTPS become the default. Let’s Encrypt was built to enable that…
40
Facebook Sponsors Let's Encrypt
We’re happy to share today that Facebook is the newest Gold sponsor of Let’s Encrypt. Facebook has taken multiple important steps to support and advance encryption this year, and we are glad to see Let’s Encrypt as the latest example. According to Alex Stamos, Chief Security Officer at Facebook, “Making it easier for…
41
Let’s encrypt automation on Debian
NOTE: This article is old, this hack is no longer necessary, as Debian includes dehydrated that makes all the work. Free SSL certificates for everyone! the https://letsencrypt.org/ initiative backed by Akamai, Cisco, Mozilla and EFF, is going to offer free certificates. On this post I am going to explain how I have…
42
Signal Desktop
Today we’re making the Signal Desktop beta available. Signal Desktop brings the trusted private messaging experience of Signal to the desktop, with a simplicity that allows you to seamlessly continue conversations back and forth between your mobile device and your desktop computer.
43
44
45
Google Deceptively Tracks Students’ Internet Browsing, EFF Says in FTC Complaint
San Francisco—The Electronic Frontier Foundation (EFF) filed a complaint today with the Federal Trade Commission (FTC) against Google for collecting and data mining school children’s personal information, including their Internet searches—a practice EFF uncovered while researching its “Spying on...
46
Faking the TCP handshake
Update: This article has been superseded by a new post which hopefully explains it more clearly: Spoofing TCP connections without sequence number prediction
47
Why FPGA manufacturers keep their bitstream formats secret
Every FPGA vendor keeps the bitstream format for their device secret. Only the tools provided in binary-only format by the vendor (and a select few third parties under NDA) can generate these bitstreams.
48
49
Telegram stalking
Update 20151216: This quick post got far more attention than expected. I regret not mentioning that the leakage can easily be prevented via a setting. In practice the problem remains, users in general will have no idea about this being a relevant setting to change and will stay with the default. The best discussion on…
50
Hostnames and usernames to reserve
If you're setting up a service where people can register their own usernames to be used as a hostname (username.example.com), email address (username@example.com), or URL path (example.com/username) within your domain, there are some common names you should avoid letting the general public register. Many …
51
UUIDs generally do not meet security requirements
Some time ago, I was doing a web application penetration test, and noticed that the authentication tokens were UUIDs. This I knew was risky, and in fact if you read the UUID rfc, section 6 of it wa…
52
53
How botnets are created with hijacked Worpess, fake Flash downloads and Node.js
I just noticed the website of an old employer has been hacked and some JavaScript is injected into their corporate website that runs on WordPress. Ouch. Of course I notified them about it and they’re just trying to figure out what happened and how to fix it.
54
United Airlines Bug Bounty: An experience in reporting a serious vulnerability
About six months ago, United Airlines announced their Bug Bounty program and, almost immediately, it received a ton of press. Though I initially wasn’t interested in pursuing the program (mainly due to its popularity), I decided to take a look a week or two after its launch despite being late to the party. Shortly…
55
Break a dozen secret keys, get a million more for free
[An in-depth blog post by Daniel J. Bernstein, crossposted between the ECRYPT blog and the cr.yp.to blog .]
56
Baseless Calls to Expand Surveillance Fit Familiar, Cynical Pattern
Like clockwork, cynical calls to expand mass surveillance practices—by continuing the domestic telephone records collection and restricting access to strong encryption—came immediately following the Paris attacks. These calls came before the smoke had even cleared, much less before a serious...
57
Domain-validated SSL will soon be free from the large CAs
Upcoming plans revealed from two of the largest commercial CAs
58
Popular Google Chrome extensions are constantly tracking you by default
Popular Google Chrome extensions are constantly tracking you per default, making it very difficult or impossible for you to opt-out.
59
60
ARRIS Cable Modem Has a Backdoor in the Backdoor
A couple of months ago, some friends invited me to give a talk at NullByte Security Conference . I started to study about some embedded devi...