1
ProtonCalendar beta
The Proton Calendar uses an innovative encryption model to deliver the high level of security Proton users expect.
New
The latest blog posts to take off on Hacker News. 579 posts.
2
One Year After ‘The Big Hack’
Today marks the one-year anniversary of Bloomberg’s publication of a story about Chinese intelligence intercepting the supply chain of Supermicro, a company which has built and sold servers to Amazon, Apple, the U.S. Department of Defense, and dozens of other companies. Apparently, they developed a chip that looked…
3
The StingRay Is Why the 4th Amendment Was Written (2017)
The drafters of the Constitution recognized that restricting the government from violating privacy is essential for a free society. That's why the Fourth Amendment exists. The StingRay clearly violates these standards.
4
Behind the One-Way Mirror: A Dive into the Technology of Corporate Surveillance
It's time to shed light on the technical methods and business practices behind third-party tracking. For journalists, policy makers, and concerned consumers, this paper will demystify the fundamentals of third-party tracking, explain the scope of the problem, and suggest ways for users and legislation to fight back…
5
6
NPM lockfiles can be a security blindspot for injecting malicious modules in PRs
In this post, we show you how easy it is to introduce back doors that are easily missed by project owners… leaving your code insecure.
7
Flight stats, entertainment, and trying to crack Widevine
Investigating onboard flight entertainment APIs, flight telemetry, and Widevine-protected media.
8
The investigation into ToTok
triaging a massively popular iOS application, with a dark side
9
Windows 0-day exploit used in Operation WizardOpium
During our investigation, we discovered that yet another 0-day exploit (CVE-2019-1458) was used in Operation WizardOpium attacks.
10
NSA's Backdoor Key from Lotus Notes (2002)
Before the US crypto export regulations were finally disolved the export version of Lotus Notes used to include a key escrow / backdoor feature called differential cryptography. The idea was that they got permission to export 64 bit crypto if 24 of those bits were encrypted for the NSA's public key. The NSA would then…
11
Use GitHub actions at your own risk
Malicious code can be inserted into any GitHub action, even those which are tagged.
12
On Linux's Random Number Generation
Cutting-edge cyber security research from NCC Group. Find public reports, technical advisories, analyses, & other novel insights from our global experts.
13
267M Facebook users IDs and phone numbers exposed online
Databases exposed by a criminal group leaked more than 300 million Facebook user IDs, names, and phone numbers on the web.
14
Google Cloud Platform Security Best Practices
A walkthrough of a couple of Google Cloud Platform (GCP) features with security recommendations and advice on how to configure your GCP environments.
15
Technology Preview for secure value recovery
At Signal, we want to make privacy simple. From the beginning, we’ve designed Signal so that your information is in your hands rather than ours. Technologies like Signal Protocol secure your messages so that they are never visible by anyone but you and the intended recipients. Technologies like p...
16
Cisco devices must regenerate self-signed certificates before 2020
Self-signed X.509 PKI certificates (SSC) that were generated on devices that run affected Cisco IOS® or Cisco IOS XE software releases expire on 2020-01-01 00:00:00 UTC. New self-signed certificates cannot be created on affected devices after 2020-01-01 00:00:00 UTC. Any service that relies on these self-signed…
17
18
PIA open-sources and announces audit plans
The VPN industry looks just like the world of religion - everyone has their different beliefs on who to trust. However, even the diamond in the rough lied
19
NextDNS Joins Firefox’s Trusted Recursive Resolver
NextDNS Joins Firefox’s Trusted Recursive Resolver Program Committing to Data Retention and Transparency Requirements that Respect User Privacy Firefox a
20
Ransomware gangs now outing victim businesses that don't pay
As if the scourge of ransomware wasn’t bad enough already: Several prominent purveyors of ransomware have signaled they plan to start publishing data stolen from victims who refuse to pay up. To make matters worse, one ransomware gang has now created a public Web site identifying recent victim companies that have…
21
Still Why No HTTPS?
Back in July last year, Scott Helme and I shipped a little pet project that tracked the world's largest websites not implementing HTTPS by default [https://www.troyhunt.com/why-no-https-heres-the-worlds-largest-websites-not-redirecting-insecure-requests/] . We called it Why No HTTPS? [https://whynohttps.
22
#include </etc/shadow>
This blog is written by Hanno Böck. Unless noted otherwise, its content is licensed as CC0 .
23
24
‘Evil Corp,’ a $100M Cybercrime Menace
The U.S. Justice Department this month offered a $5 million bounty for information leading to the arrest and conviction of a Russian man indicted for allegedly orchestrating a vast, international cybercrime network that called itself “ Evil Corp ” and stole roughly $100 million from businesses and consumers. As it…
25
Cracking LUKS/dm-crypt passphrases
Linux uses dm-crypt in order to provide transparent disk or partition encryption. What are the options in case you need to recover passphrase from such encryption? There are already ready-made tools, but we have also produced and published our own in order to support newer LUKS format/ciphers/hashing.
26
49% of workers, forced to change passwords, reuse same one with minor change
A new survey has revealed some alarming news about the way users are choosing their passwords in their homes and workplace.
27
Learning from OpenBSD can make computers marginally less horrible
telegra.ph/why-openbsd-is-marginally-less-horrible-12-052019220 points127 commentsSystems & Performance details
The following document is an attempt to consolidate down a number of threads spanning separate discussions from around the 'net I have been having on the subject of operating system development models and OpenBSD. I will break up this document into several sections each of which will handle separate pillars of my…
28
Warrantless encryption is a first amendment issue
Encryption is privacy incarnate – don’t ban it
29
Scaring People into Supporting Backdoors
Back in 1998, Tim May warned us of the “Four Horsemen of the Infocalypse”: “terrorists, pedophiles, drug dealers, and money launderers.” I tended to cast it slightly differently. This is me from 2005: Beware the Four Horsemen of the Information Apocalypse: terrorists, drug dealers, kidnappers, and child pornographers…
30
The Great $50M African IP Address Heist
A top executive at the nonprofit entity responsible for doling out chunks of Internet addresses to businesses and other organizations in Africa has resigned his post following accusations that he secretly operated several companies which sold tens of millions of dollars worth of the increasingly scarce resource to…