151
Coalfire Comments on Penetration Tests for Iowa Judicial Branch
Coalfire is a cybersecurity and compliance services company that works with enterprises and tech businesses in FedRAMP, cloud migration, AI Risk, pen…
New
The latest blog posts to take off on Hacker News. 579 posts.
152
How we hacked Blackboard and changed our grades (2018)
A technical walk-through of how we hacked Blackboard and changed our grades.
153
Banks, Arbitrary Password Restrictions and Why They Don't Matter
Allow me to be controversial for a moment: arbitrary password restrictions on banks such as short max lengths and disallowed characters don't matter. Also, allow me to argue with myself for a moment: banks shouldn't have these restrictions in place anyway. I want to put forward cases for
154
Handshake: Decentralizing DNS to Improve the Security of the Internet
News and announcements from Namebase.
155
EasyDNS threatened with criminal complaint if client data not disclosed
UPDATE (as of Sept 2021): This post seems to be the de facto clearing house for people receiving these threats from Fechner and crew all over the world. Here is everything you need to know: You can ignore it Nobody has actually been sued We recently received a copyright notice…
156
HP printers try to send data back to HP about your devices and what you print
Last week my in-laws politely but firmly asked me to set up their new HP printer. I protested that I’m completely clueless about that sort of thing, despite my tax-return-job-title of “software engineer”. Still remonstrating, I was gently bundled into their study with an instruction pamphlet, a cup of tea, a promise…
157
Curryfinger – Find the Server Behind the CDN
CURRYFINGER quickly and effectively identifies the real hosts behind CDN networks like CloudFlare - and outperforms existing tools. Find out how to use it.
158
SSL added and removed here ;-)
This post is part of our ongoing series about networks, privacy, governments and (of course) online security tools like Cloak. Last week, the Washington Post unleashed yet another bombshell revelation from the Snowden documents.
159
NY Payroll Company Vanishes with $35M
MyPayrollHR , a now defunct cloud-based payroll processing firm based in upstate New York, abruptly ceased operations this past week after stiffing employees at thousands of companies. The ongoing debacle, which allegedly involves malfeasance on the part of the payroll company’s CEO, resulted in countless people…
160
I revoked $1M worth of EV certificates
Personal like or dislike of EV aside for a moment, we can all agree on what the name of EV certs implies. Organisations get their company details in the certificate and CAs have to do some extended validation of that data compared to a normal certificate. Turns out, that doesn'
161
Harvesting LinkedIn data for fun and profit
A few years ago, before the GDPR era, I was involved in a stealth marketing startup. We went out of
162
Turn off DoH, Firefox
Affordable VM hosting in Glarus, Switzerland, operated by 100% hydropower. Devuan, debian, freebsd, ubuntu, centos. Our tech stack is fully open source.
163
Firefox’s Test Pilot Program Returns
Like a cat, the Test Pilot program has had many lives. It originally started as an Add-on before we relaunched it three years ago. Then in January, we anno
164
Unencrypted patient medical information is being broadcast across Vancouver
The Open Privacy Research Society is a non-profit Canadian group based in Vancouver, British Columbia. We believe that moral systems enable consent. Our society exists to invent, create, build, test, publish, deploy, promote, and to encourage the development of such systems
165
166
Clarifying ProtonMail and Huawei
Proton Mail official clarification about Huawei partnership.
167
Malicious attack on Wikipedia – what we know and what we’re doing
Today, Wikipedia was hit with a malicious attack that has taken it offline in several countries for intermittent periods. The attack is ongoing and our Site Reliability Engineering team is working hard to stop it and restore access to the site. As one of the world’s most popular sites, Wikipedia sometimes attracts…
168
What’s Next in Making Encrypted DNS-over-HTTPS the Default
More than 70,000 users have already chosen on their own to explicitly enable DoH in Firefox Release edition. We are close to releasing DoH in the USA, and we have a few updates to share.
169
CSRF is really dead
A little while back I wrote a blog post about how "CSRF is dead". It focused on SameSite cookies, a powerful yet simple feature to protect your website against CSRF attacks. As powerful as it was, and as much as it will kill CSRF, you had to enable it on
170
Let's Encrypt makes certs for 30% of web domains
Looking at a dataset of 350 million ssl connections inspires some initial questions:
171
A Message about iOS Security
iOS security is unmatched because we take end-to-end responsibility for the security of our hardware and software.
172
Segment Security Incident
Segment's Incident and Scheduled Maintenance History
173
Enabling developers and organizations to use differential privacy
Whether you're a city planner, a small business owner, or a software developer, gaining useful insights from data can help make services work better and answer important questions. But, without strong privacy protections, you risk losing the trust of your citizens, customers, and users.
174
Browser Fingerprinting: An Introduction and the Challenges Ahead
In the past few years, a technique called browser fingerprinting has received a lot of attention because of the risks it can pose to privacy. What is it? How is it used? What is Tor Browser doing against it? In this blog post, I’m here to answer these questions.
175
Dear Search Guard Users
We’ve filed a lawsuit against the makers of Search Guard. Here is what we know, the actions we’re taking, and potential impact to Search Guard users.
176
177
Google’s GDPR Workaround
Brave presents new RTB evidence, and has uncovered a mechanism by which Google appears to be circumventing its purported GDPR privacy protections.
178
Teardown of a Failed Linux LTS Spectre Fix
An in-depth analysis of the journey of a Spectre fix into the upstream LTS kernels that left its users with nothing more than a false sense of security.
179
Spam in Your Calendar? Here’s What to Do
Many spam trends are cyclical: Spammers tend to switch tactics when one method of hijacking your time and attention stops working. But periodically they circle back to old tricks, and few spam trends are as perennial as calendar spam, in which invitations to click on dodgy links show up unbidden in your digital…
180
RSA: Theory and Implementation
RSA has been a staple of public key cryptography for over 40 years, and is still being used today for some tasks in the newest TLS 1.3 standard. This post describes the theory behind RSA - the math that makes it work, as well as some practical considerations; it also presents a complete implementation of RSA key…