8731
New
The latest blog posts to take off on Hacker News. 8,778 posts.
8732
Schneier on Security: Software Problems with a Breath Alcohol Detector
This is an excellent lesson in the security problems inherent in trusting proprietary software: After two years of attempting to get the computer based source code for the Alcotest 7110 MKIII-C, defense counsel in State v. Chun were successful in obtaining the code, and had it analyzed by Base One Technologies, Inc…
8733
8734
Bcrypt is now obsolete
I am speaking today at BSDCan'09 about my work on the scrypt key derivation function. In the context of hardware brute-force attacks, scrypt is thousands of times more secure than existing "best practice" solutions such as bcrypt and PBKDF2; in fact, under reasonable assumptions it is provably as strong as possible…
8735
8736
8737
8738
8739
Dear Mozilla community: I screwed up. Big time.
I screwed up. Big time. Not just with Adblock Plus users but with the Mozilla community at large.
8740
8741
8742
Diceware Passphrase Home
This page offers a better way to create a strong, yet easy to remember, passphrase for use with encryption and security programs. Weak passwords and passphrases are one of the most common flaws in computer security. Take a few minutes and learn how to do it right. The information presented here can be used by anyone…
8743
How 4chan hacked ReCAPTCHA to win the TIME 100 Poll
This morning Time.com published the final result for their annual TIME 100 Poll. Time reports that the new owner of the title ‘Worlds’s most influential person, is moot’. What T…
8744
8745
Boston College Campus Police: "Using Prompt Commands" May Be a Sign of Criminal Activity
On Friday, EFF and the law firm of Fish and Richardson filed an emergency motion to quash [pdf] and for the return of seized property on behalf of a Boston College computer science student whose computers, cell phone, and other property were seized as part of an investigation into who sent an e-...
8746
8747
8748
8749
Faking votes on Hacker News
Hacker News is a site where users vote on links. When someone clicks on an up or down vote, their browser sends a GET request that looks like this: GET /vote?by= joesmith dir=upfor=8765309 A user can only vote if the by parameter matches their Hacker News login cookie. So for a third…
8750
Datacenter Security: A Cautionary Tale from Last.fm
Last.fm has presence in three datacenters in the London area - this is currently more because of necessity than redundancy; datacenter space is at a real premium in the UK and we can’t fulfill our power growth needs at just one site. We operate our own 20 gigabit fibre ring between these, which means we can basically…
8751
8752
8753
Smashing the Stack for Fun and Profit by Aleph One
An excellent (if a bit dated) article/tutorial on exploiting buffer overflow vulnerabilities. It was written by Aleph One for Phrack 49.
8754
My NSA polygraph experiences
AntiPolygraph.org Message Board - Index
8755
8756
Creating a rogue CA certificate with MD5 hash collisions
We have identified a vulnerability in the Internet Public Key Infrastructure (PKI) used to issue digital certificates for secure websites. As a proof of concept we executed a practical attack scenario and successfully created a rogue Certification Authority (CA) certificate trusted by all common web browsers. This…
8757
8758
I've Seen the Future, and It Has a Kill Switch
It used to be that just the entertainment industries wanted to control your computers—and televisions and iPods and everything else—to ensure that you didn’t violate any copyright rules. But now everyone else wants to get their hooks into your gear. OnStar will soon include the ability for the police to shut off your…
8759
8760
Schneier reviews: Here Comes Everybody
In 1937, Ronald Coase answered one of the most perplexing questions in economics: if markets are so great, why do organizations exist? Why don’t people just buy and sell their own services in a market instead? Coase, who won the 1991 Nobel Prize in Economics, answered the question by noting a market’s transaction…