2191
Help I accidently enabled HSTS on localhost
I ran into an issue after accidently enabling HSTS for a website on localhost. This was not an issue for the original website that was runni...
New
The latest blog posts to take off on Hacker News. 8,770 posts.
2192
Evading JavaScript anti-debugging techniques
Debuggers serve as invaluable tools that empower developers to halt code execution and thoroughly analyze its behavior at any given moment. By utilizing debuggers, developers can efficiently identify and resolve issues within their code, making it an indispensable part of their toolkit.
2193
“Web Environment Integrity”: Locking Down the Web
Brave strongly opposes Google's "Web Environment Integrity" proposal, the latest in Google's efforts to prevent users from being in control of how they use the Web.
2194
2195
CloudFlare’s last Warrant Canary was published over a year ago
A warrant canary is a method by which a communications service provider informs users that it has NOT been served with a secret government subpoena.
2196
A Year in Review of 0-days Exploited In-the-Wild in 2022
Maddie Stone, Security Researcher, Threat Analysis Group (TAG) This is Google’s fourth annual year-in-review of 0-days exploited in-the-wild...
2197
The Right to Lie and Google’s “Web Environment Integrity”
This is a fundamental principle of free and open source software. The World Wide Web abides by this principle, although we don’t often think of it that way. The Web is just an agreed-on set of programmatic interfaces: if you send me this, I’ll send you that. Your computer can construct the “this” by whatever means it…
2198
The Reluctant Sysadmin's Guide to Securing a Linux Server
I wrote a follow-up to this guide, which you should probably consider along with this article.
2199
The U.K. government is close to eroding encryption worldwide
The U.K. Parliament is pushing ahead with a sprawling internet regulation bill that will, among other things, undermine the privacy of people around the world. The Online Safety Bill, now at the final stage before passage in the House of Lords, gives the British government the ability to force backdoors into messaging…
2200
2201
2202
Kids Online Safety Act is still a danger to our rights online
Are you a young person fighting back against bad bills like KOSA? Become an EFF member at a new, discounted Neon membership level specifically for you--stickers included! Congress has resurrected the Kids Online Safety Act (KOSA), a bill that would increase surveillance and restrict access to...
2203
UK version of “Online Harms Bill” wants to prefilter content without due process
Experts warn that ISPs would use black-box AI to comply Like our piece on Canada's Cyber-Security Bill earlier this year, this item was flagged in my work for the Internet Society, Canada Chapter, but this post does not necessarily reflect the opinion of the ISCC. It concerns a legal opinion…
2204
Unpacking Google’s Web Environment Integrity specification
Why Vivaldi browser thinks Google’s new proposal, the Web-Environment-Integrity spec, is a major threat to the open web and should be pushed back.
2205
2206
Apple already shipped attestation on the web, and we barely noticed
There's been a lot of concern recently about the Web Environment Integrity proposal, developed by a selection of authors from Google, and apparently being...
2207
Zenbleed
If you remove the first word from the string "hello world" , what should the result be? This is the story of how we discovered that the answer could be your root password!
2208
ldd arbitrary code execution (2009)
The `ldd` utility is more vulnerable than you think. It's frequently used by programmers and system administrators to determine the dynamic library dependencies of executables. Sounds pretty innocent, right? Wrong! In this article I am going to show you how to create an executable that runs arbitrary code if it's...
2209
What every IT person needs to know about OpenBSD (2021)
How to have fun with the world’s most important free software project "Functional, free and secure by default", OpenBSD remains a crucial yet largely unacknowledged player in the open source field. This talk aims to highlight the project's signature security features and development practices -- razor sharp focus on…
2210
Why even let users set their own passwords?
Today we seem to be living through a war on passwords. This is manifested in various ways; in its most passive form, it takes the form of people blogging about how passwords are bad. The more material changes are the general trend towards no longer treating passwords as a sufficient condition for access in favour of…
2211
Compromised Microsoft key: More impactful than we thought
Our investigation of the security incident disclosed by Microsoft and CISA and attributed to Chinese threat actor Storm-0558, found that this incident seems to have a broader scope than originally assumed. Organizations using Microsoft and Azure services should take steps to assess potential impact.
2212
RFC 9420 a.k.a. Messaging Layer Security
Messaging Layer Security has been published. MLS is the first standardized, fully specified, freely accessible end-to-end encryption protocol.
2213
Become Ungoogleable
I've removed my website from indexing by Google . The proximate cause is Google's new effort to DRM the web ( archive ) but there is of course so much more.
2214
A framework to securely use LLMs in companies – Part 1: Overview of Risks
Part 1 of a multi-part series on using LLMs securely within your organisation. This post provides a framework to categorize risks based on different use cases and deployment type.
2215
Remote code execution in OpenSSH’s forwarded SSH-agent
CVE-2023-38408 is a remote code execution flaw in OpenSSH’s forwarded ssh-agent. Get full exploit details, impact analysis, and Qualys detection guidance.
2216
Target's EasySweep – Simplifying Skimmer Detection
An article by Anonymous : Target's patented EasySweep device protects guests' data from skimmers.
2217
The Death of Infosec Twitter
"Infosec Twitter," a vibrant community of security practitioners, known for its insight, inspiration, and entertainment, is coming to an end.
2218
Enigma Crypto Transmission from KPH at 426 KHz and Shortwave
DA was a part of our KPH project from the beginning. She learned her trade at US Coast Guard master station NMC, adjacent to KPH. At NMC she earned the coveted gold lightning bolt radnoman’s insignia (there was no such thing as a radiowoman in the Coast Guard). She also acquired the salty vocabulary she needed to hold…
2219
Analysis of Storm-0558 techniques for unauthorized email access
Deeper analysis of Storm-0558 techniques for obtaining unauthorized access to email data, tools, and unique infrastructure characteristics.
2220
A surprisingly simple way to foil car thieves
Skyrocketing vehicle theft rates in some U.S. cities have drawn attention to an inconvenient truth: the increasing amount of technology in our vehicles can make them increasingly vulnerable to hacking or theft.