2701
Why to not use JWT (2021)
We build advanced web apps
New
The latest blog posts to take off on Hacker News. 8,771 posts.
2702
JWT vs. Opaque Tokens
In this article, you'll learn why you need JWT and opaque tokens, what the differences are between the two, and in which case you should select one or the other.
2703
Ken Thompson really did launch his "trusting trust" trojan attack in real life
Ken Thompson's "Trusting Trust" compiler Trojan attack was not just a thought experiment. In fact, Usenet poster Jay Ashworth stated that, from personal communications, Thompson really did launch this attack in real life and successfully compromised the Unix Support Group at Bell Labs. Recently, I've rediscovered this…
2704
Turnstile: privacy-preserving alternative to CAPTCHA by Cloudflare
Any website can use a simple API to replace CAPTCHAs with our invisible alternative, whether they’re on the Cloudflare network or not.
2705
How Underground Groups Use Stolen Identities and Deepfakes
The growing appearance of deepfake attacks is significantly reshaping the threat landscape. These fakes brings attacks such as business email compromise (BEC) and identity verification bypassing to new levels.
2706
Someone is pretending to be me
One random day - someone spills the beans. They were picked to impersonate me and get a job using my information.
2707
Explained from scratch: private information retrieval and homomorphic encryption
This is a from-scratch explanation of private information retrieval built using homomorphic encryption. I try to assume only a general math / computer science background. To simplify things, my explanations may not always match academic definitions. You can check out this paper or code for more.
2708
Zero Trust SIM
We’re announcing the first Zero Trust SIM: the next major part of Cloudflare One, combining both software and hardware layers to rethink mobile device security for organizations
2709
Whois: Fragile, Unparseable, Obsolete
A rather unstructured look at one of the older and infuriatingly trivial internet protocols: WHOIS
2710
2711
Manifest V3, webRequest, and ad blockers
Vivaldi comes with its own built-in Ad and Tracker Blocker, tons of customization options, a built-in Mail and Calendar, and more. Will it follow Google’s strict reliance on Manifest V3?
2712
Passkeys
This is an opinionated, “quick-start” guide to using passkeys as a web developer. It’s hopefully broadly applicable, but one size will never fit all authentication needs and this guide ignores everything that’s optional. So take it as a worked example, but not as gospel.
2713
9M Australians affected by Optus data breach
Optus notifies customers of a cyberattack that has allowed unauthorised access to customers personal information.
2714
Using a Canon EOS camera as a webcam in Debian
Learn how to use your Canon EOS camera as a webcam on Debian Linux with secure boot enabled. Step-by-step guide for installing dependencies, signing the v4l2loopback module, and using the camera in applications. Works with many camera brands including Canon, Fuji, HP, Kodak, Nikon, Pentax, Sanyo, and Sony.
2715
2716
SIM swapper abducted, beaten, held for ransom
A Florida teenager who served as a lackey for a cybercriminal group that specializes in cryptocurrency thefts was beaten and kidnapped last week by a rival cybercrime gang. The teen’s captives held guns to his head while forcing him to record a video message pleading with his crew to fork over a $200,000 ransom in…
2717
You don’t want to be on Cloudflare’s naughty list
My home IP ended up on Cloudflare’s naughty list for six days. Most websites and many apps loaded slowly, partially, or not at all. Just had to wait it out.
2718
America’s Open Wound
The CIA is not your friend
2719
There is no “software supply chain”
In actual supply chains, money is changing hands. A server manufacturer is paying for PCB fabrication, who is paying their suppliers for raw materials and equipment, and so on until the whole thing eventually loops back on itself when a mining company needs to buy a server.
2720
Google removed our website from search because it uses YouTube-dl
Update: Google accepted our DMCA counter notice and reinstated all 317 Kapwing webpages that they took down. In the week that the takedown was in effect, our website traffic was down 30%. A week ago, we received an email that every website owner dreads - a notification of a DMCA
2721
How to Bypass Cloudflare: A Comprehensive Guide
Learn the best hands-on techniques to bypass Cloudflare Bot Management. Understand how it works, its sensor data, and evade detection.
2722
Malvertising on Microsoft Edge's news feed pushes tech support scams
While Google Chrome still dominates as the top browser, Microsoft Edge, which is based on the Chromium source code, is gradually gaining more...
2723
Hacking the PS4 / PS5 Through the PS2 Emulator
In this article I will discuss how I successfully escaped the PS2 emulator developed for the PlayStation 4. See also Part 2 , covering the next part of the exploit chain, and PlayStation's response to the research.
2724
The definitive guide to “modulo bias” and how to avoid it (2020)
The Latest News from Research at Kudelski Security
2725
Crazy Thin ‘Deep Insert’ ATM Skimmers
A number of financial institutions in and around New York City are dealing with a rash of super-thin “deep insert” skimming devices designed to fit inside the mouth of an ATM’s card acceptance slot. The card skimmers are paired with tiny pinhole cameras that are cleverly disguised as part of the cash machine. Here’s a…
2726
Privacy vs. “I have nothing to hide” (2019)
A recent post received numerous comments asking why I was so concerned about privacy and asking what I have to hide. Here's my reply...
2727
Signing Git commits with your SSH key (2021)
You could always sign Git commits with a GPG key, but now your SSH key is just as powerful!
2728
Planning Go 1.20 cryptography work
My plans for Go 1.20 include landing the crypto/ecdh package, making progress on moving math/big out of the security perimeter, and a batch of crypto/tls work.
2729
Prompt injection attacks against GPT-3
Riley Goodside, yesterday: Exploiting GPT-3 prompts with malicious inputs that order the model to ignore its previous directions. pic.twitter.com/I0NVr9LOJq- Riley Goodside (@goodside) September 12, 2022 Riley provided several examples. Here’s …
2730
