91
New
The latest blog posts to take off on Hacker News. 233 posts.
92
93
Lessons in website security anti-patterns by Tesco
Update, 14 Feb 2014: A year and a half on from writing this, Tesco has indeed suffered a serious security incident almost certainly as a result of some of the risks originally detailed here. Read more about it in The Tesco hack – here’s how it (probably) happened [https://www.
94
95
OAuth 3.0: the sane and simple way
I'm Tav, a 28-year old from London. I enjoy working on large-scale social, economic and technological systems.
96
97
Congress Must Act After US Government Admits To Warrantless Wiretapping
As Congress and the President rush to re-authorize the dangerous FISA Amendments Act (FAA)—the law shamefully passed after pressure to legalize certain portions of the NSA’s warrantless wiretapping program—EFF has been sounding the alarm that Americans’ communications are still being...
98
99
100
How the Norwegians Reacted to Terrorism
An antidote to the American cycle of threat, fear, and overspending in response to terrorism is this, about Norway on the first anniversary of its terrorist massacre: And at the political level, the Prime Minister Jens Stoltenberg pledged to do everything to ensure the country’s core values were not undermined. “The…
101
All you ever wanted to know about building a secure password reset (NSFW)
This content is now available in the Pluralsight course "Secure Account Management Fundamentals" [http://www.pluralsight.com/courses/secure-account-management-fundamentals] Recently I’ve had a couple of opportunities to think again about how a secure password reset function should operate, firstly whilst building this…
102
Living with HTTPS
( These are my notes from the first half of my talk at HOPE9 last weekend. I write notes like these not as a script, but so that I have at least some words ready in my head when I'm speaking. They are more conversational and less organised than a usual blog post, so please forgive me the rough edges. )
103
EFF Challenges National Security Letter Statute in Landmark Lawsuit
Since the first national security letter statute was passed in 1986, the FBI has issued hundreds of thousands of such letters seeking private telecommunications and financial records of Americans without any prior approval from courts. Indeed, for the period between 2003 and 2006 alone, almost 200,...
104
105
106
Here’s why we keep getting hacked – clear and present Billabong failures
It happened again last week. No, not Yahoo! Voices [https://www.troyhunt.com/2012/07/what-do-sony-and-yahoo-have-in-common.html], not the Phandroid Android forums [http://www.zdnet.com/android-forums-hacked-1-million-user-credentials-stolen-7000000817/] , not NVidia [http://www.zdnet.com/nvidia-confirms-
107
UK anti-encryption law
There was some surprise in the comments of yesterday's post over the fact that the United Kingdom has effectively outlawed encryption: the UK will...
108
Petition the U.S. Government to Force the TSA to Follow the Law
This is important: In July 2011, a federal appeals court ruled that the Transportation Security Administration had to conduct a notice-and-comment rulemaking on its policy of using “Advanced Imaging Technology” for primary screening at airports. TSA was supposed to publish the policy in the Federal Register, take…
109
Three NSA Whistleblowers Back EFF's Lawsuit Over Government Spying Program
San Francisco - Three whistleblowers – all former employees of the National Security Agency (NSA) – have come forward to give evidence in the Electronic Frontier Foundation's (EFF's) lawsuit against the government's illegal mass surveillance program, Jewel v. NSA. In a motion filed today, the three...
110
Drone hijacked by UT hackers with $1,000 spoofer
The Sophos Blog
111
So You Want to Be a Security Expert
I regularly receive e-mail from people who want advice on how to learn more about computer security, either as a course of study in college or as an IT person considering it as a career choice. First, know that there are many subspecialties in computer security. You can be an expert in keeping systems from being…
112
113
Vulnerabilities in Heroku's Build System
Last week I discovered a major security flaw in the Heroku Cedar stack build. This vulnerability exposed sensitive information including API keys, private keys and server credentials.
114
115
If malware authors ever learn how to spell we're all screwed
Forgive the lousy screenshot and transparency in the title bar, but I just got ...
116
117
118
Internet Archive Sues to Stop New Washington State Law
The Internet Archive has filed a federal challenge to a new Washington State law that intends to make online service providers criminally liable for providing access to third parties' offensive materials. There is a press release and an article about it.
119
120