The latest blog posts to take off on Hacker News. 578 posts.
It’s over. The voting went smoothly. As of the time of writing, there are no serious fraud allegations, nor credible evidence that anyone tampered with voting rolls or voting machines. And most important, the results are not in doubt. While we may breathe a collective sigh of relief about that, we can’t ignore the…
Security has always been critical to the web, but challenges involved in site migration have inhibited HTTPS adoption for several years. In the interest of a safer web for all, at Google we've worked alongside many others across the online ecosystem to better understand and address these challenges, resulting in real…
Ten rules for writing safety critical code, to facilitate analysis and increase software reliability
The latest Signal release for Android includes support for GIF search and browsing. Signal has long supported sending and receiving GIFs, but this is an experiment that allows users to browse, search, and select popular GIFs from within Signal.
The community team is excited to announce the new Tor Browser User Manual! The manual is...
Rogue cellular infrastructure disguised as office printer Oliver, 2015
Today we kicked off our first crowdfunding campaign with the goal of raising enough funds to cover about one month of our operations - $200,000. That amount covers the operational and engineering staff, the hardware and the software, and general operating expenses needed to securely and reliably issue and manage many…
Appcanary makes sure you never run vulnerable software on your servers. Like our blog? Subscribe to our newsletter or podcast . Browse the archive , or follow us on twitter , github or rss .
Posted by Neel Mehta and Billy Leonard, Threat Analysis Group On Friday, October 21st, we reported 0-day vulnerabilities — previously publi...
The vulnerability — which has since been fixed, or else I would not be writing about it publicly — was in Stripe's bitcoin payment functionality . Some background for readers not familiar with this: Stripe provides payment processing services, originally for credit cards but now also supporting ACH, Apple Pay, Alipay…
The Zcash blockchain is live! We released the genesis block this morning, and people all around our planet have begun mining and transacting on it. Our homepage links to a download page where you can…
Posted by Ian Beer, Project ZeroThis post discusses a design issue at the core of the XNU kernel ...
Mozilla has discovered that a Certificate Authority (CA) called WoSign has had a number of technical and management failures. Most seriously, we discovered they were backdating SSL certificates in order ...
Emailed password reset links are a common part of web applications. Is your site leaking these confidential links to third party sites?
Chrome and Firefox disagree on IDN addresses in type=email inputs: punycode, validity and the value JavaScript sees. Feature detection is the workaround.
NIST is no longer recommending two-factor authentication systems that use SMS, because of their many insecurities. In the latest draft of its Digital Authentication Guideline, there’s the line: [Out of band verification] using SMS is deprecated, and will no longer be allowed in future releases of this guidance.
Security and Vulnerability Research
This post exposes how real-world highly advanced poker cheating devices work.
Distributed Denial of Service (DDoS) attempts to make a machine or network unavailable by flooding it with overwhelming amounts of traffic.
Learn how Sophos CTU researchers tracked the activities of a Russian-based threat group targeting the Hillary Clinton Presidential Campaign.
Recently, account takeovers, email hacking, and targeted phishing attacks have been all over the news. Hacks of various politicians, allegedly carried out by Russian hackers, have yielded troves of data. Despite the supposed involvement of state-sponsored agents, some hacks were not reliant on complex zero-day…
