31
New
The latest blog posts to take off on Hacker News. 556 posts.
32
The silent CVE in the heart of Kubernetes apiserver
An overview into CVE-2018-1002105's root cause and a program to test if your clusters are affected
33
HTTPS in the real world
In cryptography, trust is mathematically provable. Everything else is just faith.
34
Hashicorp Vault v1.0
Vault 1.0 is focused on renovating Vault's infrastructure to support high performance, scalable workloads.
35
36
Simple Encrypted Arithmetic Library goes open source
Today we are extremely excited to announce that our Microsoft Simple Encrypted Arithmetic Library (Microsoft SEAL), an easy-to-use homomorphic encryption library developed by researchers in the Cryptography Research group at Microsoft, is open source on GitHub under an MIT License for free use. The library has already…
37
The Bare Minimum You Should Do to Protect Your Family's Data
For a lot of families, technology is the glue that holds everything together. There’s your kid’s Instagram feed you follow to see what theyR
38
Maximizing password manager attack surface
Kaspersky Password Manager uses a unique approach to maximize the attack surface. A quick introduction.
39
Major sites running unauthenticated JavaScript on their payment pages
A few months ago, British Airways' customers had their credit card details stolen. How was this possible? The best guess goes something like this: BA had 3rd party JS on its payment page <script src="https://example.com/whatever.js"></script> The 3rd party's site was hacked, and the JS was changed. BA's customers ran…
40
The Digital Maginot Line
There is a war happening. We are immersed in an evolving, ongoing conflict: an Information World War in which state actors, terrorists, and ideological…
41
42
“Stylish” is back, and you still shouldn't use it
2 days after I published ‘“Stylish” browser extension steals all your internet history’, Stylish was pulled from the Chrome and Firefox stores. The story echoed around parts of the internet for a few days, my name was misspelled on several right-wing British news websites, and I felt that I’d helped make the world a…
43
44
Half of All Phishing Sites Now Have the Padlock
Maybe you were once advised to “look for the padlock” as a means of telling legitimate e-commerce sites from phishing or malware traps. Unfortunately, this has never been more useless advice. New research indicates that half of all phishing scams are now hosted on Web sites whose Internet address includes the padlock…
45
GDPR complaints against Google’s deceptive practices to track user location
Based on new research published today by BEUC’s Norwegian member Forbrukerrådet, seven consumer groups are filing complaints against Google with their national data protection authorities.
46
Scammers are changing the contact details for banks on Google Maps
A new type of banking scam involving fake business listings is taking over Google [3 min read]
47
48
Advanced web security topics
(Updated 22 May 2020) This post discusses web security issues that I come across – so far thankfully mostly by reading about them. It is a work in progress which I’ll keep updating. The…
49
Secure Boot in the Era of the T2
Explore the Duo Blog for expert tips, security insights, and resources to stay updated on the latest in security and access management trends.
50
The EU Terrorist Content Regulation – a threat to the ecosystem and user rights
The EU has proposed a new law aimed at terrorist content online. Here we outline how the proposal poses a risk for rights and the internet ecosystem.
51
Shamir’s Secret Sharing Scheme
Consider a scenario in which you are tasked with managing the security of a bank's vault. The vault is considered impenetrable without a key, which you are g...
52
53
54
Amazon S3 Block Public Access: Protection for Your Accounts and Buckets
Update (4/27/2023): Amazon S3 now automatically enables S3 Block Public Access and disables S3 access control lists (ACLs) for all new S3 buckets in all AWS Regions. Update (August 2019)– Fresh screen shots and changes to the names of the options. Newly created Amazon S3 buckets and objects are (and always have been)…
55
Beyond Passwords: 2FA, U2F and Google Advanced Protection
Last week I wrote a couple of different pieces on passwords, firstly about why we're going to be stuck with them for a long time yet [https://www.troyhunt.com/heres-why-insert-thing-here-is-not-a-password-killer/] and then secondly, about how we all bear some
56
Privacy not included: Holiday gift list for privacy and security
Privacy Not Included was launched in 2017 to help you understand the privacy risks of tech products that connect to the internet. We are continuing that work in the form of Product Reviews at our magazine Nothing Personal, where our privacy experts do hours of hands-on testing and research on the most popular consumer…
57
Hacking Gmail’s UX with 'From' Fields – Another Phishing Vector
An Unexpected Consequence of a Bad Header
58
Private by Design: How We Built Firefox Sync
Firefox Sync by default protects all your synced data so Mozilla can’t read it. We built Sync this way because we put user privacy first. How it works is...
59
Improving DuckDuckGo
Want to know more about a DuckDuckGo product or feature? Find answers to frequently asked questions and more at DuckDuckGo Help.
60
The rise of multivector DDoS attacks
It's been a while since we last wrote about Layer 3/4 DDoS attacks on this blog. This is a good news - we've been quietly handling the daily onslaught of DDoS attacks. Since our last write-up, a handful of interesting L3/4 attacks have happened. Let's review them.