The latest blog posts to take off on Hacker News. 642 posts.
Login attempts fail because computer users can't remember their email or didn't input the right password. Most websites on the Internet won't tell you which one is actually incorrect.
Here is a short and curious Twitter thread from app developers and security researchers Tommy Mysk and Talal Haj Bakry: Apple’s analytics data include an ID called “dsId”. We were able to verify that “dsId” is the “Directory Services Identifier”, an ID that uniquely identifies an iCloud account. Meaning, Apple’s…
So recently a very hyped memory corruption security vulnerability was discovered in the OpenSSL punycode parser. Some folks including Hanno ...
Find out how homomorphic encryption works and why it could be the future of (crypto) data privacy
How deep learning models are moderated
Peter is an IT manager for a technology manufacturer that got hit with a Russian ransomware strain called “ Zeppelin ” in May 2020. He’d been on the job less than six months, and because of the way his predecessor architected things, the company’s data backups also were encrypted by Zeppelin. After two weeks of…
Proper implementation of email hardening techniques can be beneficial even to (sub)domains that are not intended to be used with email.
Copilot may be a glimpse into the future of AI, but it comes with a lot of legal and security baggage.
Certificate authorities (CAs) are a critical backbone of internet security; when they are compromised, users lose the ability to securely connect to websites without fear of interception. Websites cannot insulate themselves against a fully-compromised CA, even if they normally use other CAs.
This is going to be a highly opinionated blog post. I think AWS is great and use it daily, but their implementation of IAM is unnecessarily complicated.
Guide on using remote attestation in a way that's compatible with GrapheneOS.
Anybody who runs an internet-facing webserver has seen their fair share of spammy scanners in the logs. It varies server to server, but some of mine get up to 15,000 scans per day. Almost all of these are harmless network mappers, but they still annoy me. Many are compromised hosts or belong to hackers & organized…
The French Court of Cassation has ruled that people who are suspected or accused of a crime are obliged to reveal the passcode of their mobile phone to the investigative authorities.
David Schütz's bug bounty writeups
The other day I set up a new OpenBSD instance with a nice RAID array, encrypted with Full Disk Encryption. And promptly proceeded to forget part of the passphrase.
Were you aware of it: Microsoft is phoning home the content of your PowerPoint slides. Don't just take my word for it: open up the network monitor of your...
Portmaster is a free and open-source application that puts you back in charge over all your computer's network connections. Increase your privacy and security. Get peace of mind.
It started simply enough...
“An AWS account just for getting into other AWS accounts” has moved to https://src-bin.com/substrate/blog/an-aws-account-just-for-getting-into-other-aws-accounts/ .
We look at how fuzzing should have caught the OpenSSL Punycode vulnerability, and why that code was even necessary in the first place.
Guest Post: How to use PF features and tools.
Today we published an advisory about CVE-2022-3786 (“X.509 Email Address Variable Length Buffer Overflow”) and CVE-2022-3602 (“X.509 Email Address 4-byte Buffer Overflow”).
BYOPM is a self hosted portable Password Manager implementation based on BitWarden and Raspberry PI Zero.
