151
Disqus Security Alert: User Info Breach
More publishers trust us to engage, grow, and understand their audiences than any other. Build your on-site community with Disqus.
New
The latest blog posts to take off on Hacker News. 616 posts.
152
How to defeat Ed25519 and EdDSA using faults
The Latest News from Research at Kudelski Security
153
iOS 11's Misleading "Off-Ish" Setting for Radios Is Bad for User Security
Turning off your Bluetooth and Wi-Fi radios when you’re not using them is good security practice (not to mention good for your battery usage). When you consider Bluetooth’s known vulnerabilities, it’s especially important to make sure your Bluetooth and Wi-Fi settings are doing what you want them...
154
EFF Asks Court to Undo Damage Done to First Amendment in Flawed NSL Ruling
EFF has petitioned a federal appeals court to reconsider its flawed ruling in our national security letter case on behalf of CREDO Mobile and Cloudflare. In July, the Ninth Circuit in San Francisco upheld the NSL statute against our First Amendment challenge. The court ruled that the FBI is...
155
Grand jury subpoena for Signal user data, Eastern District of Virginia
In the “first half of 2016” (the most specific we’re permitted to be), we received a subpoena from the Eastern District of Virginia. The subpoena required us to provide information about two Signal users for a federal grand jury investigation. We’ve designed the Signal service to minimize the dat...
156
Keybase launches encrypted Git
You're reading the Keybase blog. There are more posts . When you're done, you can install Keybase .
157
An Update on Firefox Containers
Containers is now available as a Firefox Extension, accessible to all Firefox users. Download Firefox Multi-Account Containers here. Back in June 2016, we started experimenting with “Containers” as a way to explore Contextual Identities on the web. Firefox Containers are a way for users to isolate their online…
158
Stop the Border Surveillance Bills
UPDATE: EFF also opposes H.R. 3548. Like S. 1757, it would expand border surveillance with biometric, drone, and ALPR technologies. The bill, styled the Border Security for America Act, was introduced by Rep. McCaul in July. EFF opposes a new federal bill that would dramatically expand dragnet...
159
USPS ‘Informed Delivery’ Is Stalker’s Dream
A free new service from the U.S. Postal Service that provides scanned images of incoming mail before it is slated to arrive at its destination address is raising eyebrows among security experts who worry about the service’s potential for misuse by private investigators, identity thieves, stalkers or abusive…
160
Behind the Masq: Yet More DNS and DHCP Vulnerabilities
Posted by Fermin J. Serna, Staff Software Engineer, Matt Linton, Senior Security Engineer and Kevin Stadmeyer, Technical Program Manager O...
161
Think twice before encrypting your HFS+ volumes on High Sierra
Advanced backup and copying for macOS. Schedule automated backups, take snapshots, and restore your Mac with confidence. Download a free 30-day trial.
162
Exploiting the Wi-Fi Stack on Apple Devices
Posted by Gal Beniamini, Project ZeroEarlier this year we performed research into Broadcom’...
163
TLS 1.2 Session Tickets
Session Tickets, specified in RFC 5077 , are a technique to resume TLS sessions by storing key material encrypted on the clients. In TLS 1.2 they speed up the handshake from two to one round-trips.
164
Breach at Sonic Drive-In May Have Impacted Millions of Credit, Debit Cards
Sonic Drive-In , a fast-food chain with nearly 3,600 locations across 45 U.S. states, has acknowledged a breach affecting an unknown number of store payment systems. The ongoing breach may have led to a fire sale on millions of stolen credit and debit card accounts that are now being peddled in shadowy underground…
165
166
The Difficulty Of Private Contact Discovery
Building a social network is not easy. Social networks have value proportional to their size, so participants aren’t motivated to join new social networks which aren’t already large. It’s a paradox where if people haven’t already joined, people aren’t motivated to join. The trouble is that whi...
167
Technology preview: Private contact discovery for Signal
At Signal, we’ve been thinking about the difficulty of private contact discovery for a long time. We’ve been working on strategies to improve our current design, and today we’ve published a new private contact discovery service. Using this service, Signal clients will be able to efficiently and s...
168
Disqus comments adding third-party ad-tracking
I'm killing Disqus comments on my blog. Here's why.
169
Equifax or Equiphish?
More than a week after it said most people would be eligible to enroll in a free year of its TrustedID identity theft monitoring service, big three consumer credit bureau Equifax has begun sending out email notifications to people who were able to take the company up on its offer. But in yet another security stumble…
170
171
172
The Ethics of Running a Data Breach Search Service
No matter how much anyone tries to sugar coat it, a service like Have I been pwned [https://haveibeenpwned.com/] (HIBP) which deals with billions of records hacked out of other peoples' systems is always going to sit in a grey area. There are degrees, of course; at one end
173
Mac OS High Sierra automatically checks EFI firmware each week
Every week, Macs running High Sierra will check the integrity of their EFI firmware, in a bid to detect tampering by malware.
174
Duck Duck Go: Illusion of Privacy (2013)
There have been several articles in the press recently about users flocking to DuckDuckGo in the wake of the recent NSA snooping revel...
175
Post a boarding pass on Facebook, get your account stolen
Article removed for legal reasons, sorry. After receiving a Czech version of a cease and desist letter from a legal representative of A. F., I've removed the article. You'll find articles based on my story in “Recommended reading” below, go read them.
176
177
The Great DOM Fuzz-Off of 2017
Posted by Ivan Fratric, Project ZeroIntroductionHistorically, DOM engines have been one of the la...
178
Experian Site Can Give Anyone Your Credit Freeze PIN
An alert reader recently pointed my attention to a free online service offered by big-three credit bureau Experian that allows anyone to request the personal identification number (PIN) needed to unlock a consumer credit file that was previously frozen at Experian.
179
Zero-knowledge proofs, Zcash, and Ethereum
Part 3 of a series on “Privacy on the Blockchain”.
180