91
Facebook's DKIM RSA key should be crackable
If Facebook sends you a mail they will sign it using DKIM . Here are the headers from a mail I received the other day: DKIM-Signature: v=1...
New
The latest blog posts to take off on Hacker News. 135 posts.
92
Schneier on Filming the Police
In at least three U.S. states, it is illegal to film an active duty policeman: The legal justification for arresting the “shooter” rests on existing wiretapping or eavesdropping laws, with statutes against obstructing law enforcement sometimes cited. Illinois, Massachusetts, and Maryland are among the 12 states in…
93
New Adobe Flash 0day, have a nice weekend
For the complete experience, please enable JavaScript in your browser. Thank you!
94
95
96
A new type of phishing attack. Works on savvy users.
In essence, a phishing attack is a kind of hack used by cybercriminals to trick victims into performing a certain activity. These emails are frequently sent
97
Don't Talk to the Cops
Don't talk to the cops about any significant crime ...ESPECIALLY if you're innocent. Here's why.
98
99
DuckDuckGo Searches Are Not Anonymous
DuckDuckGo didn't log IPs, but favicons loaded from Amazon S3 leaked every search term in the Referer header. It was fixed two days after I posted.
100
Microsoft patent trolls Salesforce
Microsoft has filed suit against Salesforce for infringing the following patent: Method and system for mapping between logical data and physical data System and method for providing and displaying a web page having an embedded menu Method and system for stacking toolbars in a computer display Aut…
101
Worst-Case Thinking
At a security conference recently, the moderator asked the panel of distinguished cybersecurity leaders what their nightmare scenario was. The answers were the predictable array of large-scale attacks: against our communications infrastructure, against the power grid, against the financial system, in combination with…
102
103
Facebook leaks user's IP addresses
Actually this is a common method of combatting spam, all of the various spam providers will block facebook as a whole if they don't include this information, which would obviously be a devastating annoyance. Go and send an e-mail from hotmail, or any kind of mailserver.. normal e-mail client, gmail, etc.. and you will…
104
The Evolution of Privacy on Facebook
Facebook is a great service. I have a profile , and so does nearly everyone I know under the age of 60.
105
EFF vs. Facebook: Part 2: "Facebook's Connections"
"Connections." It's an innocent-sounding word. But it's at the heart of some of the worst of Facebook's recent changes.Facebook first announced Connections a few weeks ago, and EFF quickly wrote at length about the problems they created. Basically, Facebook has transformed substantial personal...
106
Why Aren't There More Terrorist Attacks?
As the details of the Times Square car bomb attempt emerge in the wake of Faisal Shahzad’s arrest Monday night, one thing has already been made clear: Terrorism is fairly easy. All you need is a gun or a bomb, and a crowded target. Guns are easy to buy. Bombs are easy to make. Crowded targets—not only in New York, but…
107
The Security Mindset
Uncle Milton Industries has been selling ant farms to children since 1956. Some years ago, I remember opening one up with a friend. There were no actual ants included in the box. Instead, there was a card that you filled in with your address, and the company would mail you some ants. My friend expressed surprise that…
108
Fun with your bank's secret questions & answers
My new bank, Ally Bank , configures a security question and answer for customer service calls. In addition to your SSN, date of birth, and mother's maiden name they also ask you the question you specify and wait for the answer you've provided. This is good, because many standard questions are…
109
110
Deceiving Users with the Facebook Like Button
Facebook just launched a super-easy widget called "The Facebook Like Button". Website owners can add a simple iframe snippet to their html, enabling a nice "Like" button with a count of other people's "Likes" and a list of faces of people if any of them are your friends. The advantage of this new tool is that you…
111
112
Bringing Down a Copycat Site
Dec. 24, 2004: I received an e-mail from a former colleague in the shareware industry saying he had received an e-mail from a company selling our MailList King software and was surprised to hear we had sold it?
113
114
115
There’s a rootkit in the closet
Part 1: Finding the rootkit It's monday morning and I am for coffee in downtown Thessaloniki, a partner calls: - On machine XXX mysqld is not starting since Saturday. - Can I drink my coffee and come over later to check it ? Is it critical ? - Nope, come over anytime you can... Around
116
Rackspace passwords are visible to customer service
I just had a very disturbing conversation with a Rackspace Cloud CSR. It went something like this: CSR: Can I have your account user name a...
117
EFF on Apple's iPhone Developer Program Agreement
The entire family of devices built on the iPhone OS (iPhone, iPod Touch, iPad) have been designed to run only software that is approved by Apple—a major shift from the norms of the personal computer market. Software developers who want Apple's approval must first agree to the iPhone Developer...
118
Return-Oriented Programming without Returns (on the x86)
We show that on the x86 it is possible to mount a return-oriented programming attack without using any return instructions. Our new attack instead makes use of certain instruction sequences that behave like a return; we show that these sequences occur with sufficient frequency in large Linux libraries to allow…
119
Patriot Act Renewed Without Any New Civil Liberties Protections
Yesterday evening, the U.S. House of Representatives voted overwhelmingly to renew three expiring provisions of the USA PATRIOT Act, after the Senate abandoned the PATRIOT reform effort and approved the extension by a voice vote on Wednesday night. Disappointingly, the government's dangerously...
120