3871
Let's Not Encrypt (2019)
Let's Discuss the organization providing a false sense of security at an unbeatable price.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,337 posts.
3872
The quest for a family-friendly password manager
Personal blog of Julien (jvoisin) Voisin
3873
Kernel anti-cheat is an overreach
Modern PC games make you install a ring-0 anti-cheat driver you can't audit.
3874
Two types of privacy
"Privacy" can mean different things in different contexts. Tracking-reduction and tracking-evasion represent different goals with some conflict and overlap.
3875
Two-Factor Authentication and the Police State
In Britain - and many other countries - the police can legally force you to divulge your passwords. Whether it's to an encrypted file, a social network, or your email account, the state can legally rifle through your most intimate thoughts and (potentially) pose as you online. As we've recently seen, this can be done…
3876
3877
3878
Using Hinge as a Command and Control Server
A proof of concept demonstrating how to use the Hinge dating app as a C2.
3879
The Increasing Trend of Online Extortion
I heard about this guy, walked into a federal bank with a portable phone, handed the phone to the teller, the guy on the other end of the phone said: “We got this guy’s little girl, and if you don’t give him all your money, we’re gonna
3880
3881
Enable ARMv9 Memory Tagging Extension (MTE) on Pixel 8
The Pixel 8 hardware ( Tensor G3 ) supports the ARM Memory Tagging Extension (MTE) , and software support is available both in Android userspace and the Linux kernel. This feature is a powerful defense against linear buffer overflows and many types of use-after-free flaws. I’m extremely happy to see this hardware…
3882
3883
I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded
How four layers of authentication in a production anti-cheat driver still hand you a complete BYOVD toolkit
3884
Isolating Xwayland in a VM
In my last post, Qubes-lite with KVM and Wayland, I described setting up a Qubes-inspired Linux system that runs applications in virtual machines. A …
3885
Notorious ‘Hijack Factory’ Shunned from Web
Score one for the good guys: Bitcanal , a Portuguese Web hosting firm long accused of helping spammers hijack large swaths of dormant Internet address space over the years, was summarily kicked off the Internet this week after a half-dozen of the company’s bandwidth providers chose to sever ties with the company.
3886
The Default Trap: Why Anthropic's Data Policy Change Matters
A quick note on the importance of reading the terms of service!
3887
(Post-Quantum) Cryptographic Right Answers
In the tradition started by Colin Percival and Thomas Ptacek, a set of “Cryptographic Right Answers” updated for the accelerated post-quantum transition timeline.
3888
Security in 2020
There’s really no such thing as security in the abstract. Security can only be defined in relation to something else. You’re secure from something or against something. In the next 10 years, the traditional definition of IT security—that it protects you from hackers, criminals, and other bad guys—will undergo a…
3889
IDIV DoS (INT_MIN / -1)
A little fun for the last day of 2012: how to crash a program via division? x86’s IDIV instruction traps not only on division by zero, but also on INT_MIN / -1 (signed integer overflow).
3890
3891
3892
DEF CON 24 Badge Challenge
Council of 9 ventured forth to DEFCON 24 to compete in this year's badge challenge, brought to us each year by 1o57. There was determination among the team to win at DC24 to ensure that last year's...
3893
How to botch TLS forward secrecy
There's been some discussion about forward secret TLS recently, spurred, I think, by this piece from Declan McCullagh on CNET.
3894
The Trackers and SDKs in ChatGPT, Claude, Grok and Perplexity
Well for a quick weekend recap I’m going to look at which 3rd party SDKs and API calls I can find in the big 4 Android chat apps based. We’ll be using free data from AppGoblin which you can feel free to browse at any of the links below or on tables. Data is collected via de-compiled SDKs and MITM API traffic.
3895
A Unikernel Firewall for QubesOS
QubesOS provides a desktop operating system made up of multiple virtual machines, running under Xen. To protect against buggy network drivers, the …
3896
GDPR Hysteria Part II, Nuts and Bolts, Actionable Advice
Part I of this is here , if you haven’t read it yet please do so before reading this installment, it will help to establish context.
3897
3898
Remote Attestation
If it quacks like a duck...
3899
The Private Blockchain Fallacy
In all the blockchain hype, a simple, yet self-refuting idea keeps popping up: a Private Blockchain .
3900