6661
The Basics of Web Application Security
Security is both very important and often under-emphasized. While many targeted techniques help, there are some basic clean code habits which every developer can and should be doing
New
The latest blog posts to take off on Hacker News. 8,773 posts.
6662
The Trouble with Tor
The Tor Project makes a browser that allows anyone to surf the Internet anonymously. Tor stands for "the onion router" and that describes how the service works. Traffic is routed through a number of relays where each relay only knows the next hop, not the ultimate destination.
6663
Lessons learned while protecting Gmail
Posted by Elie Bursztein - anti-abuse & security research, Nicolas Lidzborski - Gmail security engineering, and Vijay Eranti - Gmail anti-abus...
6664
FBI Breaks into iPhone. We Have Some Questions
The FBI has successfully accessed data on an iPhone that has been the subject of a legal battle between the Justice Department and Apple, according to a court filing. EFF is pleased that the Justice Department has retreated from its dangerous and unconstitutional attempt to force Apple to subvert...
6665
HIPAA 101 for Software Development Teams
Everything you need to know about HIPAA compliance, from the basics to infrastructure requirements to building with AI.
6666
Follow the money: Apple vs. the FBI
A lot of people are watching the spectacle of Apple vs. the FBI and the Homeland Security Theatre and rubbing their eyes, wondering why Apple (in the person of CEO Tim Cook) is suddenly the knight in shining armour on the side of consumer privacy and civil rights. Apple, after all, is a goliath-sized corporate…
6667
NPM Package Hijacking From the Hijacker's Perspective
In light of recent events in the javascript community, I would like to share the story of how I came into control of more than 200 heavily…
6668
More Encryption, More Notifications, More Email Security
Posted by Nicolas Lidzborski, Gmail Security Engineering Lead and Jonathan Pevarnek, Jigsaw Engineer Today, we’re announcing a variety of...
6669
ECDSA smartphone key extraction using $2 magnetic probe
We show that modern cryptographic software on mobile phones, implementing the ECDSA digital signature algorithm, may inadvertently expose its secret keys through physical side channels: electromagnetic radiation and power consumption which fluctuate in a way that depends on secret information during the cryptographic…
6670
Obama Has Gotten 3,000+ Tweets about Encryption. Let’s Double That
EFF, ACLU, and Access Now released a statement in support of Apple and its stance on encryption last week. We called on the President to reject any attempt to force backdoors like the one the FBI was seeking to Apple’s operating system. We asked our communities to help by tweeting at the President...
6671
Alert: NPM modules hijacked
<p><strong>EDIT : User @nj48 appears to <a href="https://twitter.com/seldo/status/712673227630313472">have no malicious intentions</a>.</strong></p>
6672
Race you to the kernel
Posted by Ian Beer of Google Project ZeroThe OS X and iOS kernel code responsible for loading a s...
6673
A Statement from The Tor Project on Software Integrity and Apple
The Tor Project exists to provide privacy and anonymity for millions of people, including human...
6674
6675
6676
My Take on FBI's “Alternative” Method
FBI acknowledged today that there “appears” to be an alternative way into Farook’s iPhone 5c – something that experts have been shouting for weeks now; in fact, we’ve been saying there are several viable methods. Before I get into which method I think is being used here, here are some possibilities of other viable…
6677
Sustaining Digital Certificate Security
Posted by Ryan Sleevi, Software Engineer This post updates our previous notification of a misissued certificate for google.com Followin...
6678
Attack of the Week: Apple iMessage
Today’s Washington Post has a story entitled “Johns Hopkins researchers poke a hole in Apple’s encryption”, which describes the results of some research my students and I have bee…
6679
StartSSL domain validation vulnerability
StartSSL certificate authority is well known for offering free domain validated SSL certificates, and also sells organisation and extended v...
6680
Counterfeit Macbook charger teardown: convincing outside but dangerous inside
What's inside a counterfeit Macbook charger? After my Macbook charger teardown , a reader sent me a charger he suspected was counterfeit. ...
6681
Bypassing Antivirus with Ten Lines of Code
I had originally set out to write a long winded blog post on different antivirus bypass techniques. I went through what was supposed to be s...
6682
Arguments Supporting Warrantless Surveillance Wither When Exposed to Sunlight
The government recently declassified a secret letter, written in 2002 laying out the executive branch’s initial legal justifications for the vast expansion of electronic surveillance after September 11, 2001. Like many others, it was written by former DOJ Office of Legal Counsel attorney John Yoo,...
6683
BinDiff now available for free
Posted by Christian Blichmann, Software Engineer BinDiff is a comparison tool for binary files that helps to quickly find differences and ...
6684
DRM Non-Aggression on the Table at W3C
The World Wide Web Consortium (W3C) will consider adopting a DRM non-aggression covenant at its Advisory Committee meeting in Boston next week. EFF has attended several of these meetings before as a W3C member, always with the intent to persuade the W3C that supporting DRM is a bad idea for the Web...
6685
An XSS on Facebook via PNGs and Wonky Content Types
Bug Bounty & Application Security
6686
FBI Wants It to Be Impractical to Deploy Strong Encryption Without Key Escrow
The FBI wants strong encryption without key escrow, which is insecure at scale, to be illegal or impractical. Data breach risks rise as devices get less secure.
6687
How your data is collected and commoditised via “free” online services
I get a lot of people popping up with data breaches for Have I been pwned [https://haveibeenpwned.com/] (HIBP). There’s an interesting story in that itself actually, one I must get around to writing in the future as folks come from all sorts of different backgrounds and offer
6688
Thomas Jefferson and Apple versus the FBI
When Prohibition began, anti-alcohol crusaders demanded that the St. Louis Public Library burn every book that explained "the home production of alcohol for drinks". The librarian insisted on keeping the books but agreed to hide them from the "general public".
6689
The Difficulty of Private Contact Discovery
Building a social network is not easy. Social networks have value proportional to their size, so participants aren’t motivated to join new social networks which aren’t already large. It’s a paradox where if people haven’t already joined, people aren’t motivated to join. The trouble is that whi...
6690