1921
New
The latest blog posts to take off on Hacker News. 8,770 posts.
1922
Ten years isn't long enough for maximum age settings
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
1923
The Curious Case of MD5
Recently I came across a puzzling fact: the International Criminal Court hashes electronic evidence with MD5, even though MD5 is badly broken. So, why are lawyers using broken, outdated technology? The answer involves the common law system, cultural isolation, and a single man named Don L. Lewis.
1924
Someone was breaking into Orange Spain RIPE account (and break their /12)
Ah. Orange Spain has had their /12 (and likely others) broken by (what appears to be) someone breaking into their RIPE account and making RPKI ROA's to somewher...
1925
OpenBSD Workstation Hardening
In this blog post, you will learn different methods to harden your OpenBSD system, and in which situation they are useful
1926
Bitwarden Heist – How to break into password vaults without using passwords
Sometimes, making particular security design decisions can have unexpected consequences. For security-critical software, such as password managers, this can easily lead to catastrophic failure: In this blog post, we show how Bitwarden’s Windows Hello …
1927
AI generated security reports about curl
I have held back on writing anything about AI or how we (not) use AI for development in the curl factory. Now I can't hold back anymore. Let me show you the most significant effect of AI on curl as of today - with examples. Bug Bounty Having a bug bounty means that we offer … Continue reading The I in LLM stands for…
1928
Double encryption: Analyzing the NSA/GCHQ arguments against hybrids
In 2019, Google and Cloudflare ran an experiment where they upgraded HTTPS for many "real users’ connections" to use post-quantum encryption. They then reported statistics on how affordable this was. Google had also run a similar experiment in 2016: "While it's still very early days for quantum computers, we're…
1929
The funny rules of SpamAssassin in 2023
This investigation was surprising to me so I thought it would be interesting to share my findings and I hope you'll like it.
1930
1931
EFF Year in Review: Google's Corporate Paternalism in the Browser
It’s a big year for the oozing creep of corporate paternalism and ad-tracking technology online. Google and its subsidiary companies have tightened their grips on the throat of internet innovation, all while employing the now familiar tactic of marketing these things as beneficial for users. Here...
1932
Email addresses are not good 'permanent' identifiers for accounts
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
1933
37C3: Fuzzing the TCP/IP Stack
Our exploration begins with an honest appraisal of traditional fuzzing methodologies that have been applied to TCP/IP stacks before, like ISIC, revealing their inherent limitations, e.g., they can't reach beyond the TCP initial state. Recognizing the need for a more evolved approach, we take a different approach…
1934
In 2024, please switch to Firefox
This December, if there's one tech New Year's resolution I'd encourage you to have, it's switching to the only remaining ethical web browser, Firefox. According to recent posts on social media, Firefox's market share is slipping. We should not let that happen. There are two main reasons why switching is important…
1935
Kaspersky discloses iPhone hardware feature vital in Operation Triangulation
Kaspersky’s Global Research and Analysis Team (GReAT) has unveiled a previously unknown hardware feature in Apple iPhones, pivotal to the Operation Triangulation campaign. The team presented this discovery at the 37th Chaos Communication Congress in Hamburg.
1936
Unprivileged process injection techniques in Linux
I'm joev, a security engineer 👋 You may know me from my work at Apple or on Metasploit, or from my CVEs.
1937
No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability
A look at the messy reality of iOS vulnerabilities: which bugs get patched, which quietly linger, and the challenges of tracking real device risk over time.
1938
Operation Triangulation: What you get when attack iPhones of researchers
Recent iPhone models have additional hardware-based security protection for sensitive regions of the kernel memory. We discovered that to bypass this hardware-based security protection, the attackers used another hardware feature of Apple-designed SoCs.
1939
TKey is a RISC-V computer in a USB-C case, that can run security applications
Introduction # The Tillitis TKey is a small computer in a USB stick form factor that can run small device applications that are loaded onto it. The purpose of the TKey is to be a secure environment for applications that provide some kind of security function. Some examples of such security functions are: Time-based…
1940
1941
Memory safety is necessary, not sufficient
TL;DR: I think that a focus on memory safe languages (MSLs) versus non memory-safe languages is a bit of a red herring. The actual distinction is slightly…
1942
SSH over HTTPS
Tl;DR: to pass SSH through HTTPS you need to tweak client and server sides as the following:
1943
How to turn off Google's "privacy sandbox" ad tracking, and why you should
Google has rolled out "Privacy Sandbox," a Chrome feature first announced back in 2019 that, among other things, exchanges third-party cookies—the most common form of tracking technology—for what the company is now calling "Topics." Topics is a response to pushback against Google’s proposed...
1944
SMTP Smuggling – Spoofing Emails Worldwide
Introducing a novel technique for e-mail spoofing
1945
Apple allows some iOS apps to track user locations via lists of nearby SSIDs
苹果公司自诩为用户隐私的捍卫者，然而这并非事实。 在近十年的时间里，苹果允许应用程序具备跟踪用户位置的能力，而不提供关闭此功能或引起用户对此的关注的选项。 而且这是「只有苹果可以做到的」（Only Apple Can Do）！
1946
Google OAuth is broken (sort of)
Today I’m publicizing a Google OAuth vulnerability that allows employees at companies to retain indefinite access to applications like Slack and Zoom, after they’re off-boarded and removed from their company’s Google organization. The vulnerability is easy for a non-technical audience to understand and exploit.
1947
Looking into the Stadia Controller Bluetooth Mode Website
With the end of Google's Stadia platform on January 18, 2023, Google published a website allowing people to "Switch the Stadia Controller ...
1948
OpenAI Begins Tackling ChatGPT Data Leak Vulnerability
OpenAI seems to have implemented some mitigation steps for a well-known data exfiltration vulnerability in ChatGPT. Attackers can use image markdown rendering …
1949
How to Escape a Container
Panoptica by Outshift delivers advanced cloud-native security insights to help teams protect modern applications and infrastructure at scale.
1950
What's next for Tor and privacy online?
Ten years ago, Edward Snowden shared documents with the press that exposed the extent of the U.S. government’s mass surveillance program – and used Tor to protect himself while doing so. How has the perception of privacy changed since then, and what are the Tor Project’s challenges for the year to come?