181
Your face is not a bar code: arguments against automatic face recognition (2001)
An abridged version of this article appeared in Whole Earth 106, Winter 2001, pages 74-77.
New
The latest blog posts to take off on Hacker News. 678 posts.
182
183
Authenticated Boot and Disk Encryption on Linux
Posts and writings by Lennart Poettering
184
185
How WhatsApp enables multi-device capability
For years, people have been asking us to create a true multi-device experience that allows people to use WhatsApp on other devices without requiring a smartphone connection. Today, we’re announcing…
186
187
Database containing personal info of 106M visitors to Thailand exposed online
Just how safe is your personal information? With more than thousand reported data breaches since 2004, the odds are not in your favor.
188
189
Microsoft ruined passwords, now aims for a passwordless future
Purism makes premium phones, laptops, mini PCs and servers running free software on PureOS. Purism products respect people's privacy and freedom while protecting their security.
190
Let's Encrypt's old root certificate is expiring
On 30th September 2021, the root certificate that Let's Encrypt are currently using, the IdentTrust DST Root CA X3 certificate, will expire. You may or may not need to do anything about this Root CA expiring, but I'm betting a few things will probably break on that day
191
Google Docs in a clean-room browser
A detailed description of how we made Google Docs run inside the new Flow Browser. The number of websites that work in Flow is increasing regularly.
192
Imaging mounted disk volumes under duress
Backups are critical. If you are lucky and organised you have a set of useful backup primitives, such as Point in Time snapshots on your Infrastructure As A Service (IaaS), your disk array controller, or volume manager. However there always seems to be some critical machine in my life that does not fall into these…
193
VPN users unmasked by zero-day vulnerability in Virgin Media routers
We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.
194
Zerotier – multiple vulnerabilities lead to private network access
Zerotier - Multiple vulnerabilities leading to identity hijacking and unauthorised private network access.
195
196
The pitfalls of using SSH-agent, or how to use an agent safely
Unfortunately for you, we promised a follow up to talk about the security implications of using such an agent. So, here we are.
197
Alexa leaks private wishlists
This morning, my wife noticed that Alexa was insistently flashing its little blue lights. "Alexa... Notifications?" "You have one notification. An item on your wishlist has dropped in price. The … is now only £…" And that's how my wife found out what I planned to get her for her birthday! What happened to cause this?…
198
Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders
The Lumen blog and newsroom is your source for business technology news and insights, customer stories, press and media, and trending articles.
199
You don't need to burn off your fingertips (and other biometric myths)
111 years ago almost to the day, a murder was committed which ultimately led to the first criminal trial to use fingerprints as evidence [https://www.smithsonianmag.com/history/first-case-where-fingerprints-were-used-evidence-180970883/] . We've all since watched enough crime shows to understand that fingerprints are
200
Tracing SSL/TLS connections using eBPF
Pixie Blog
201
The ownership and future of Mullvad VPN
This article is by our founders and sole shareholders, Daniel Berntsson and Fredrik Strömberg. Mullvad VPN is here to stay, and we are not interested in ever selling it.
202
Weaponizing Middleboxes for TCP Reflected Amplification
Censors pose a threat to the entire Internet.
203
Why Authorization Is Hard
There's a fundamental tension in authorization. Is it business logic or authorization logic? Should it be in the app, or separate? Let’s talk about what makes a
204
Automatic cipher suite ordering in Go’s crypto/tls
Go 1.17 is making TLS configuration easier and safer by automating TLS cipher suite preference ordering.
205
OpenBSD's Pledge and Unveil from Python
Years ago, OpenBSD gained two new security system calls, pledge(2) (originally tame(2) ) and unveil . In both, an application surrenders capabilities at run-time. The idea is to perform initialization like usual, then drop capabilities before handling untrusted input, limiting unwanted side effects. This feature is…
206
207
"Secret" Agent Exposes Azure Customers to Unauthorized Code Execution
Wiz Research recently discovered a series of alarming vulnerabilities that highlight the supply chain risk of open source code, particularly for customers of cloud computing services.
208
(L)Awful Interception
One of democracy's foundations is the fact that all human beings have certain inalienable rights and freedoms. Suspended by trust and shared values. Today, trust and shared values are being replaced by “control and surveillance”.
209
NSO Group iMessage Zero-Click Exploit Captured in the Wild
While analyzing the phone of a Saudi activist infected with NSO Group’s Pegasus spyware, we discovered a zero-day zero-click exploit against iMessage. The exploit, which we call FORCEDENTRY, targets Apple’s image rendering library, and was effective against Apple iOS, MacOS and WatchOS devices.
210
Disclosing E2EE vulnerability in multiple Matrix clients
Matrix, the open protocol for secure decentralised communications