631
Facebook Disabled My Account After I Criticized Them
Facebook unfriended me. Why? So far as I can tell, it’s because I’ve been using Facebook to advocate for decentralization of social media. And apparently th ...
New
The latest blog posts to take off on Hacker News. 678 posts.
632
Access Control for GitHub Pages
GitHub Pages now gives you the option to limit access, making the site visible only to users with access to the repository that published the Page. With access control, you…
633
Unlocking LUKS2 Volumes with TPM2, FIDO2, PKCS#11 Security HW on Systemd 248
Posts and writings by Lennart Poettering
634
The database servers powering Let's Encrypt
Let’s Encrypt helps to protect a huge portion of the Web by providing TLS certificates to more than 235 million websites. A database is at the heart of how Let’s Encrypt manages certificate issuance. If this database isn’t performing well enough, it can cause API errors and timeouts for our subscribers. Database…
635
DDoS-Guard to forfeit internet space occupied by Parler
Parler , the beleaguered social network advertised as a “free speech” alternative to Facebook and Twitter, has had a tough month. Apple and Google removed the Parler app from their stores, and Amazon blocked the platform from using its hosting services. Parler has since found a home in DDoS-Guard , a Russian digital…
636
I no longer trust The Great Suspender
I know a number of folks use The Great Suspender to automatically suspend inactive browser tabs in Chrome. Apparently recent versions of this extension have been taken over by a shady anonymous entity and is now flagged by Microsoft as malware . Notably the most recent version of the extension (v7.1.8) has added…
637
Update: YouTube-dl reinstated thanks to EFF (2020)
In October, the popular and famous archivist tool youtube-dl was taken down by GitHub due to a DMCA request by the Recording Industry Association of America. I posted a detailed analysis explaining the relation between international, US, EU and German law, and showing why this request was very different from what most…
638
The State of State Machines
Posted by Natalie Silvanovich, Project ZeroOn January 29, 2019, a serious vulnerability was ...
639
The embedded YouTube player told me what you were watching
David Schütz's bug bounty writeups
640
Yubico proposes WebAuthn protocol extension to simplify backup security keys
Yubico proposes a new WebAuthn extension to the World Wide Web Consortium (W3C) to add a user-friendly solution for backup security keys, and receives cryptographic proof from researchers at the Surrey Center for Cyber Security.
641
642
BitLocker Lockscreen Bypass
BitLocker is a modern data protection feature that is deeply integrated in the Windows kernel. It is used by many corporations as a means of protecting company secrets in case of theft. Microsoft recommends that you have a Trusted Platform Module which can do some of the heavy cryptographic lifting for you.
643
That's not how 2FA works
Another day, another high-profile website cloned to phish credentials. Tess Rinearson@_tessrIs this a phishing attempt? Goes to "githubverification.com" and asks for username and pw (if so, it nearly got me!) /cc @github pic.x.com/jgt4oNvjF2❤️ 2,243💬 111🔁 016:12 - Sat 16 January 2021 In the replies, you’ll see lots of…
644
Attacking the DeFi ecosystem with flash loans for fun and profit (2020)
This article will examine in details what happened during the two transactions that exploited vulnerabilities to open under-collateralized positions in bZx, causing a loss of equity worth more than a million dollar in total.
645
Would Rust Secure Curl?
Rewriting programs in Rust has become a bit of a meme and one program that has been discussed a lot is cURL .
646
647
Running a fake power plant on the internet for a month
There is a lot more on the internet than just social media and banking websites…
648
Limiting Private API Availability in Chromium
During a recent audit, we discovered that some third-party Chromium based browsers were able to integrate Google features, such as Chrome sy...
649
The Apple goto fail vulnerability: lessons learned (2014)
Description of what we have learned
650
Escaping VirtualBox 6.1: Part 1
This post is about a VirtualBox escape for the latest currently available version (VirtualBox 6.1.16 on Windows). The vulnerabilities were discovered and exploited by our team Sauercl0ud as part of the RealWorld CTF 2020/2021. The vulnerability was known to the organizers, requires the guest to be able to insert…
651
652
How I hijacked the top-level domain of a sovereign state
Here’s how I temporarily took over 50% of all DNS traffic for the TLD of the Democratic Republic of Congo.
653
Facebook sues two Chrome extension devs for scraping user data
Today we filed a lawsuit against two individuals for violating our Terms of Service and Portugal’s Database Protection Law.
654
Helping to secure internet routing
The internet works reliably, in large part, on the basis of a key technology called Border Gateway Protocol (BGP). BGP is a means by which all junction points on the internet (routers) communicate with each other to dynamically establish the correct (and correctly weighted) paths that network packets should follow to…
655
SolarWinds: What Hit Us Could Hit Others
New research into the malware that set the stage for the megabreach at IT vendor SolarWinds shows the perpetrators spent months inside the company’s software development labs honing their attack before inserting malicious code into updates that SolarWinds then shipped to thousands of customers. More worrisome, the…
656
Leaking silhouettes of cross-origin images
This blog post is one of several guest blog posts, where we invite participants of our bug bounty program to write about bugs they've reported to us. This is a ...
657
Amazon Echo Flex: Microphone mute button appears to be real and functional
Teardown and analysis of electronics. Integrated circuit design analysis.
658
Why Isn’t Telegram End-to-End Encrypted by Default (2017)
telegra.ph/why-isnt-telegram-end-to-end-encrypted-by-default-08-142021127 points145 commentscited by 11Security & Privacy details
I've been getting this question more often this year. It's based on the wrong assumption that some other popular messaging apps such as WhatsApp are "end-to-end encrypted by default", while Telegram is not. This post is intended to disprove this myth that has been so carefully crafted by Facebook/WhatsApp marketing…
659
Getting Started with Signal
How to take advantage of Signal for secure messages and calls
660