1
Why Deleting Sensitive Information from GitHub Doesn't Save You
Security and Programming Blog
New
The latest blog posts to take off on Hacker News. 391 posts.
2
On the new Snowden documents
If you don’t follow NSA news obsessively, you might have missed yesterday’s massive Snowden document dump from Der Spiegel. The documents provide a great deal of insight into how the NSA brea…
3
sean cassidy : Don't Pipe to your Shell
It's everywhere . Sometimes they tell you to ignore certificates as well (looking at you, Salt). That's dumb.
4
When security goes right
A few weeks ago, I heard that my slow and unreliable ISP was raising their prices, and I decided to look around for a better ISP. I found one in the form of Novus , which has fibre runs to towers around the Vancouver area. I signed up; they came to the building and placed the necessary patch cable in the basement…
5
Did North Korea Really Attack Sony?
I am deeply skeptical of the FBI’s announcement on Friday that North Korea was behind last month’s Sony hack. The agency’s evidence is tenuous, and I have a hard time believing it. But I also have trouble believing that the US government would make the accusation this formally if officials didn’t believe it. Clues in…
6
Docker Image Insecurity
Docker's report that a downloaded image is "verified" is based solely on the presence of a signed manifest, and Docker never verifies the image checksum from the manifest.
7
8
9
Possible upcoming attempts to disable the Tor network
The Tor Project has learned that there may be an attempt to incapacitate our network in the next...
10
EFF in Court to Argue NSA Collection from Internet Backbone Is Unconstitutional
Oakland - The Electronic Frontier Foundation (EFF) will argue on Friday before a federal court that the National Security Agency (NSA) is violating the Fourth Amendment by copying and searching data that it collects by tapping into the Internet backbone. The hearing on a motion for partial summary...
11
Why the Sony hack is unlikely to be the work of North Korea
Everyone seems to be eager to pin the blame for the Sony hack on North Korea. However, I think it’s unlikely. Here’s why:1. The broken English looks deliberately bad and doesn’t e…
12
CSRF in Doorkeeper OAuth2 gem
I read a post about CSRF on DigitalOcean (in Russian) by Sergey Belove . My first reaction was, obviously, how come ? DigitalOcean is not k...
13
14
An Update to End-To-End
Posted by Stephan Somogyi, Product Manager, Security and Privacy In June, we announced and launched End-To-End , a tool for those who need...
15
16
Federal Court Throws Out Six Weeks of Warrantless Video Surveillance
Update: On December 15, Judge Edward Shea issued his written opinion in United States v. Vargas, which you can read here. The public got an early holiday gift today when a federal court agreed with us that six weeks of continually video recording the frontyard of someone's home without a search...
17
18
Comments on the Sony Hack
I don’t have a lot to say about the Sony hack, which seems to still be ongoing. I want to highlight a few points, though. At this point, the attacks seem to be a few hackers and not the North Korean government. (My guess is that it’s not an insider, either.) That we live in the world where we aren’t sure if any given…
19
Illinois General Assembly passes bill to ban citizens from recording police
The Illinois General Assembly just passed a bill that would prevent citizens from recording the police.
20
Yik Yak Hack
Yik Yak is an anonymous, controversial social media application that allows people to make posts that are visible to other users within ~2 miles. Often landing a top 10 spot in the iOS App Store, this app has become increasingly popular with high school and college students. Due to the anonymous nature of the app…
21
New Paypal gateway UI susceptible to spoofing
Hey. I decided to get a paid plan on Github and Paypal looked like a good payment option to me. Click the blue button here : This looks ...
22
Chaos Computer Club Website Blocked by UK ISPs
A significant portion of British citizens are currently blocked from accessing the Chaos Computer Club's (CCC) website. On top of that, Vodafone customers are blocked from accessing the ticket sale...
23
Apple CoreGraphics framework logging input data to /tmp
Security researcher Kent Howard reported an Apple issue present in OS X 10.10 (Yosemite) where log files are created by the CoreGraphics framework of OS X in the /tmp local directory. These log files contain a record of all inputs into Mozilla programs during their operation. In versions of OS X from versions 10.6…
24
The No CAPTCHA problem
When I read about No CAPTCHA for the first time I was really excited. Did we finally find a better solution? Hashcash? Or what? Finally it...
25
Hacking PayPal Accounts with one click
Today I am going to publicly disclose a critical vulnerability I have found during my research in PayPal, This vulnerability enabled me to completely bypass the CSRF Prevention System implemented by PayPal, The vulnerability is patched very fast and PayPal paid me the maximum bounty they give ;).
26
Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”
Posted by Vinay Shet, Product Manager, reCAPTCHA reCAPTCHA protects the websites you love from spam and abuse. So, when you go online—say...
27
Incident Report – DDoS Attack
On Monday, December 1st, 2014, we experienced a major volumetric DDoS attack aimed at a customer's domain. Here is our full report.
28
A Shark on the Network
DISCLAIMER: I do not condone monitoring network traffic with intent to spy or otherwise cause harm to people. My interest in the techniques described below is academic. I write in the hope that I can improve Internet security, or at least increase public awareness of vulnerabilities. If you are attempting to replicate…
29
“Invalid username or password” is a useless security measure
Login attempts fail because computer users can't remember their email or didn't input the right password. Most websites on the Internet won't tell you which one is actually incorrect.
30
How NSA and GCHQ are tapping internet cables
A weblog about Signals Intelligence, Communications Security and top level telecommunications equipment