The latest blog posts to take off on Hacker News. 8,773 posts.
What does the FBI want when it comes to the encryption “debate”? At an oversight hearing before the Senate Judiciary Committee today, FBI Director James Comey offered what he called the “good news” that it’s not a debate at all. In fact, he said, government and the tech industry all want the same...
Today we’re pleased to announce the launch of Focus by Firefox, a free content blocker for Safari users on iOS 9 that gives users greater control of their mobile Web ...
I recently heard from a source in law enforcement who had a peculiar problem. The source investigates cybercrime, and he was reaching out for advice after trying but failing to conduct undercover buys of stolen credit cards from a well-known underground card market. Turns out, the cybercrime bazaar’s own security…
The United States Court of Appeals for the Second Circuit issued an opinion rejecting the government’s attempt to hold an employee criminally liable under the federal hacking statute—the Computer Fraud and Abuse Act (“CFAA”)—for violating his employer-imposed computer use restrictions. The decision...
Multiple recent reports on serious security vulnerabilities in cable modems and routers paint a dire picture of the state of security of the devices that millions of users depend upon to connect to the Internet. Such vulnerabilities can be exploited to disable our access, snoop on our personal...
Abstract: Cryptography rearranges power: it configures who can do what, from what. This makes cryptography an inherently political tool, and it confers on the field an intrinsically moral dimension. The Snowden revelations motivate a reassessment of the political and moral positioning of cryptography. They lead one to…
We’re happy to announce that Let’s Encrypt has entered Public Beta. Invitations are no longer needed in order to get free certificates from Let’s Encrypt. It’s time for the Web to take a big step forward in terms of security and privacy. We want to see HTTPS become the default. Let’s Encrypt was built to enable that…
We’re happy to share today that Facebook is the newest Gold sponsor of Let’s Encrypt. Facebook has taken multiple important steps to support and advance encryption this year, and we are glad to see Let’s Encrypt as the latest example. According to Alex Stamos, Chief Security Officer at Facebook, “Making it easier for…
NOTE: This article is old, this hack is no longer necessary, as Debian includes dehydrated that makes all the work. Free SSL certificates for everyone! the https://letsencrypt.org/ initiative backed by Akamai, Cisco, Mozilla and EFF, is going to offer free certificates. On this post I am going to explain how I have…
Today we’re making the Signal Desktop beta available. Signal Desktop brings the trusted private messaging experience of Signal to the desktop, with a simplicity that allows you to seamlessly continue conversations back and forth between your mobile device and your desktop computer.
San Francisco—The Electronic Frontier Foundation (EFF) filed a complaint today with the Federal Trade Commission (FTC) against Google for collecting and data mining school children’s personal information, including their Internet searches—a practice EFF uncovered while researching its “Spying on...
Update: This article has been superseded by a new post which hopefully explains it more clearly: Spoofing TCP connections without sequence number prediction
Every FPGA vendor keeps the bitstream format for their device secret. Only the tools provided in binary-only format by the vendor (and a select few third parties under NDA) can generate these bitstreams.
Update 20151216: This quick post got far more attention than expected. I regret not mentioning that the leakage can easily be prevented via a setting. In practice the problem remains, users in general will have no idea about this being a relevant setting to change and will stay with the default. The best discussion on…
If you're setting up a service where people can register their own usernames to be used as a hostname (username.example.com), email address (username@example.com), or URL path (example.com/username) within your domain, there are some common names you should avoid letting the general public register. Many …
Some time ago, I was doing a web application penetration test, and noticed that the authentication tokens were UUIDs. This I knew was risky, and in fact if you read the UUID rfc, section 6 of it wa…
I just noticed the website of an old employer has been hacked and some JavaScript is injected into their corporate website that runs on WordPress. Ouch. Of course I notified them about it and they’re just trying to figure out what happened and how to fix it.
About six months ago, United Airlines announced their Bug Bounty program and, almost immediately, it received a ton of press. Though I initially wasn’t interested in pursuing the program (mainly due to its popularity), I decided to take a look a week or two after its launch despite being late to the party. Shortly…
[An in-depth blog post by Daniel J. Bernstein, crossposted between the ECRYPT blog and the cr.yp.to blog .]
Like clockwork, cynical calls to expand mass surveillance practices—by continuing the domestic telephone records collection and restricting access to strong encryption—came immediately following the Paris attacks. These calls came before the smoke had even cleared, much less before a serious...
Upcoming plans revealed from two of the largest commercial CAs
Popular Google Chrome extensions are constantly tracking you per default, making it very difficult or impossible for you to opt-out.
