61
macOS has checked app signatures online for over 2 years
Why does it take 2 years to realise that macOS has been checking signing certificate validity online?
New
The latest blog posts to take off on Hacker News. 612 posts.
62
How Rainbow Tables Work
I found the creator of Rainbow Table's paper, aimed at cryptanalysts, was pretty inaccessible considering the simplicity and elegance of Rainbow Tables, so this is an overview of it for a layman.
63
Android | Madaidan's Insecurities
By default, Android has a strong security model and incorporates full system SELinux policies , strong app sandboxing , full verified boot , modern exploit mitigations like fine-grained, forward-edge Control Flow Integrity and ShadowCallStack , widespread use of memory-safe languages (Java / Kotlin) and more. As such…
64
Someone attacked our company
At the start of November, someone decided that they would try to attack and destroy our company. Here’s how we stopped them.
65
Another free CA as an alternative to Let's Encrypt
Let's Encrypt is an amazing organisation doing an amazing thing by providing certificates at scale, for free. The problem though was that they were the only such organisation for a long time, but I'm glad to say that the ecosystem is changing. It's always a good idea
66
Police in Mississippi to Pilot a Program to Live-Stream Amazon Ring Cameras
The police surveillance center in Jackson, Mississippi, will be conducting a 45-day pilot program to live stream the security cameras, including Amazon Ring cameras, of participating residents.
67
Guidance to developers affected by effort to block less secure browsers, apps
We are always working to improve security protections of Google accounts. Our security systems automatically detect, alert and help protect our users against a range of security threats. One form of phishing, known as “ man-in-the-middle ”, is hard to detect when an embedded browser framework (e.g., Chromium Embedded…
68
GoDaddy employees used in attacks on multiple cryptocurrency services
Fraudsters redirected email and web traffic destined for several cryptocurrency trading platforms over the past week. The attacks were facilitated by scams targeting employees at GoDaddy , the world’s largest domain name registrar, KrebsOnSecurity has learned.
69
Cover Your Tracks
Today, we’re pleased to announce Cover Your Tracks, the newest edition and rebranding of our historic browser fingerprinting and tracker awareness tool Panopticlick. Cover Your Tracks picks up where Panopticlick left off. Panopticlick was about letting users know that browser fingerprinting was...
70
Mozilla DNS over HTTPS (DoH) and Trusted Recursive Resolver (TRR) Comment Period
We're crowdsourcing ideas and recommendations to help us enhance the privacy and security benefits of DNS-over-HTTPS (DoH) for users around the world
71
Firefox 83 introduces HTTPS-Only Mode
Security on the web matters. Whenever you connect to a web page and enter a password, a credit card number, or other sensitive information, you want to be sure ...
72
Big no on Big Sur: Mullvad disallows Apple apps to bypass firewall
Despite Apple’s changes to macOS with the release of Big Sur, we can confirm that the Mullvad app still performs as intended by not allowing Apple’s own apps to bypass our VPN firewall.
73
Ok Google: please publish your DKIM secret keys
The Internet is a dangerous place in the best of times. Sometimes Internet engineers find ways to mitigate the worst of these threats, and sometimes they fail. Every now and then, however, a major …
74
Does Apple really log every app you run? A technical look
Apple’s launch of macOS Big Sur was almost immediately followed by server issues which prevented users from running third-party apps on their computers. While a workaround was soon found by people on Twitter, others raised some privacy concerns related to that issue.
75
Application trust is hard, but Apple does it well
On November 12, 2020 Apple released macOS Big Sur. In the hours after the release went live, somewhere in Apple's infrastructure an OCSP esponder cried out in pain…
76
GNUnet 0.14.0
GNU's framework for secure p2p networking
77
Don't use third party auth to sign in
If a website offers you to sign-in using Google (or any third-party service, say Facebook, Github, etc.), don’t use that feature.
78
PokéWalker hacking: A complete device takeover and ROM dump using infrared
Dmitry.GR: Complete device takeover by blinking at it!
79
Hunting for Malicious Packages on PyPI
I installed every package on PyPI to look for malicious content. This is what I found.
80
Your Computer Isn't Yours
There have been several updates appended to this page as of 2020-11-16, please see below. Also available in: Türkçe Français Español Português Português…
81
Campaign “Reclaim Your Face” Calls for a Ban on Biometric Mass Surveillance
Civil society across Europe launches the “Reclaim Your Face” campaign, demanding that local and national authorities listen to their communities about the serious risks of using facial recognition and other biometric technologies in public spaces. The newly formed coalition calls to ban biometric mass surveillance, in…
82
Getting a biometric security key right
"Discover the upcoming YubiKey Bio with biometric capabilities. Enhance your security with our cutting-edge, FIDO-enabled device. Sign up for updates!
83
84
Body found in Canada identified as neo-nazi spam king
The body of a man found shot inside a burned out vehicle in Canada three years ago has been identified as that of Davis Wolfgang Hawke , a prolific spammer and neo-Nazi who led a failed anti-government march on Washington, D.C. in 1999, according to news reports.
85
RansomEXX Trojan attacks Linux systems
We recently discovered a new file-encrypting Trojan built as an ELF executable and intended to encrypt data on machines controlled by Linux-based operating systems.
86
87
US Government Continues Encryption War
Evergreen privacy guides, threat modeling, encryption, practical tutorials.
88
Fast open-source intrusion detection
The system, developed by Carnegie Mellon University CyLab researchers, achieves speeds of 100 gigabits per second using a single server.
89
Standing on our own two feet
Update, July 10, 2023 See our new blog post for details on the September 2024 expiration of the newer ISRG Root X1 cross-sign from IdenTrust. Update, December 21, 2020 Thanks to community feedback and our wonderful partners at IdenTrust, we will be able to continue to offer service without interruption to people using…
90
