61
If you care about user privacy, don’t use Facebook JavaScript SDK
With email aliases , you can be anonymous online and protect your inbox against spams and phishing.
New
The latest blog posts to take off on Hacker News. 579 posts.
62
Personal and social information of 1.2B people discovered in data leak
Bespoke cyber investigations and dark web intelligence — threat actor attribution, asset tracing, digital forensics, and ransomware negotiation.
63
Flan Scan: Lightweight Network Vulnerability Scanner
Flan Scan is a thin wrapper around Nmap that converts this popular open source tool into a vulnerability scanner with an easy deployment.
64
Cname cloaking, a disguise of third-party trackers
An in-depth exploration of a new method used by tracking companies to disguise their third-party trackers as first-party trackers.
65
66
Bad Binder: Android In-the-Wild Exploit
Posted by Maddie Stone, Project ZeroIntroductionOn October 3, 2019, we disclosed issue 1942 (CVE-...
67
The trouble with VPN and privacy review sites
Evergreen privacy guides, threat modeling, encryption, practical tutorials.
68
How Cybercriminals Profit by Tapping Your Email
A few days ago I came across the CBC story on how a Canadian man had been defrauded out of $800,000 when cybercriminals inserted themselves into a real estate deal and had the funds diverted to themselves: Here is the "Whois" record for the fake domain used to send the…
69
Facebook: We don’t need your consent
The world's largest social network believes it has found a way to bypass Europe’s strict privacy laws.
70
Windows will improve user privacy with DNS over HTTPS
Announcing and explaining our intention to support DNS over HTTPS in future versions of Windows
71
Infectious Executable Stacks
In software development there are many concepts that at first glance seem useful and sound, but, after considering the consequences of their implementation and use, are actually horrifying. Examples include thread cancellation , variable length arrays , and memory aliasing . GCC’s closure extension to C is another…
72
73
CVE-2019-1347: When a mouse over a file is enough to crash your system
Advanced security testing platforms for hardware and software investigations. Collaborative tools, proven attack libraries, and expert services for security teams.
74
75
We Can Choose an Internet Without Surveillance
The internet is not just a network of computers—it’s a network of people. We hold great power in deciding its future.
76
Privacy: Is That iPhone?
A new Mozilla-Ipsos poll reveals that a majority of iPhone users treasure privacy — but aren’t aware of the device's ad tracking
77
Court: Suspicionless Searches of Travelers’ Phones and Laptops Unconstitutional
Government Must Have Reasonable Suspicion of Digital Contraband Before Searching Electronic Devices at the U.S. Border
78
79
I got my money back from a scammer by contacting his mom on Facebook (2016)
Personal Blog of Christian Haschek
80
81
Sendy Is Insecure: How Not to Implement ReCAPTCHA
Sendy's reCAPTCHA implementation doesn't do anything.
82
Ransomware, Data Breaches at Hospitals Tied to Uptick in Fatal Heart Attacks
Hospitals that have been hit by a data breach or ransomware attack can expect to see an increase in the death rate among heart patients in the following months or years because of cybersecurity remediation efforts, a new study posits. Health industry experts say the findings should prompt a larger review of how…
83
Security assessment techniques for Go projects
The Trail of Bits Assurance practice has received an influx of Go projects, following the success of our Kubernetes assessment this summer. As a result, we’ve been adapting for Go projects some of the security assessment techniques and tactics we’ve used with other compiled languages. We started by understanding the…
84
Bypassing GitHub's OAuth Flow with a Head Request
For the past few years, security research has been something I’ve done in my spare time. I know there are people that make a living off of bug bounty programs, but I’ve personally just spent a few hours here and there whenever I feel like it.
85
Biometric YubiKey
Learn more about what's happening within the tech and cybersecurity industry and the developments in our business and security keys within our Yubico Blog.
86
DNS Wars
NANOG is now quite an institution in the Internet, particularly in the North American Internet community. It was an offshoot of the Regional Techs meetings, which were part of the NSFNET framework of the late 80s and early 90s. NANOG has thrived since then and is certainly one of the major network operational forums…
87
Audio Fingerprinting using the AudioContext API
Audio fingerprinting takes advantage of device performance specs to build up an identifying fingerprint of a user. It uses the AudioContext API for this
88
Adding Client-Side Scanning Breaks End-to-End Encryption
Recent attacks on encryption have diverged. On the one hand, we’ve seen Attorney General William Barr call for “lawful access” to encrypted communications, using arguments that have barely changed since the 1990’s. But we’ve also seen suggestions from a different set of actors for more purportedly...
89
Stuxnet was embarrassing, not amazing (2011)
As the New York Times posts yet another breathless story about Stuxnet, I’m surprised that no one has pointed out its obvious deficiencies. Everyone seems to be hyperventilating about its pur…
90
SSH Handshake Explained
Secure Shell (SSH) is a widely used Transport Layer Protocol to secure connections between clients and servers. In this post we explain how SSH handshake works.