3931
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,337 posts.
3932
XSS in Gmail through Rapportive
A blog on security, malware, cryptography, pentesting, javascript, php and whatnots
3933
3934
3935
3936
When did “privacy issues” start to mean “too much privacy”?
Clubhouse draws the ire of journalists
3937
Opportunistic Encryption for Firefox
Firefox 37 brings more encryption to the web through opportunistic encryption of some http:// based resources. It will be released the week ...
3938
Becoming physically immune to brute-force attacks (2021)
Using thermal physics, cosmology, and computer science to calculate password vulnerability to the biggest possible brute-force attack.
3939
3940
Ransomware, Data Breaches at Hospitals Tied to Uptick in Fatal Heart Attacks
Hospitals that have been hit by a data breach or ransomware attack can expect to see an increase in the death rate among heart patients in the following months or years because of cybersecurity remediation efforts, a new study posits. Health industry experts say the findings should prompt a larger review of how…
3941
Someone cloned my website and is using it to scam people
I was looking on the DuckDuckGo search results for "anonymous bitcoin sms" today, just to see what was out there. My SMS Privacy was the top result, as expected. But the second result was new to me:
3942
How to Block Stingray Devices
Disable 2G On Android To Block Stingray Devices 1) Pull up the phone dialer and dial *#*#4636#*#* (that spells INFO) 2) This brings you to the testing screen, select "Phone/Device information". 3) Scroll down a little to "preferred network type", select the arrow. 4) Change it to LTE/WCDMA Only. It…
3943
On CPU backdoors - Trusting hardware
So, you're a decent paranoid person, running only open source software on your box: Linux, GNU, etc. You have the feeling you could, if you ...
3944
Cracking random number generators (xoroshiro128+)
In software, we generate random numbers by calling a function called a "random number generator". Such functions have hidden states, so that repeated calls to the function generate new numbers that appear random. If you know this state, you can predict all future outcomes of the random number generators. O'Neill, a…
3945
Flight stats, entertainment, and trying to crack Widevine
Investigating onboard flight entertainment APIs, flight telemetry, and Widevine-protected media.
3946
Is Unicode Safe?
Unicode is just too complex to ever be secure.  — Bruce Schneier, 2000 Over the last 25 years Unicode has succeeded. It hasn't displaced all other character encodings, but it's clearly on its way there. It's supported widely enough that it's a compatible choice, new projects use it, and it's becoming the…
3947
3948
Bash 'shellshock' scan of the Internet
NOTE: malware is now using this as their User-agent. I haven't run a scan now for over two days. I'm running a scan right now of the I...
3949
Cell Phone OPSEC for Border Crossings
I have heard stories of more aggressive interrogation of electronic devices at US border crossings. I know a lot about securing computers, but very little about securing phones. Are there easy ways to delete data—files, photos, etc.—on phones so it can’t be recovered? Does resetting a phone to factory defaults erase…
3950
3951
Implementing a Tor relay from scratch in golang (2015)
Update from the author, over a decade later: Go has improved and so have my own skills. The conclusion of this article was that Go isn't the right language for the task I gave it, and that's no longer true today, but also wasn't true when I wrote the article. This article is user error, not a language issue.
3952
Schneier: The Value of Privacy
Last week, revelation of yet another NSA surveillance effort against the American people has rekindled the privacy debate. Those in favor of these programs have trotted out the same rhetorical question we hear every time privacy advocates oppose ID checks, video cameras, massive databases, data mining, and other…
3953
Inline PGP signatures considered harmful
People often suggest that inline PGP signatures in e-mail are somehow more compatible or more acceptable than using PGP/MIME . This is a mistake. Inline PGP signatures are prone to several failure modes, up to and including undetectable message tampering.
3954
3955
Reverse Engineering Vercel's BotID
Vercel recently announced BotID, an anti-bot meant to protect against bots without requiring manual intervention. This post reverse-engineers the script and takes a peek inside.
3956
Third-Party Audit of Rustls
In May and June 2020, Cure53 completed an audit of ring , webpki , and rustls . Their report ( PDF ) fully describes the audit, and makes for interesting reading.
3957
Anomalous keys in Tor relays
Counting almost 7,000 relays , the Tor network is one of the largest volunteer-run anonymity networks operating today. Most of the volunteers who operate these relays choose to remain anonymous, and little is known about how they set up or operate their relays. As a result, it is not clear if all relays correctly…
3958
1971 Social Engineering Attack
From Betty Medsger’s book on the 1971 FBI burglary (page 22): As burglars, they used some unusual techniques, ones Davidon enjoyed recalling years later, such as what some of them did in 1970 at a draft board office in Delaware. During their casing, they had noticed that the interior door that opened to the draft…
3959
Fuzzing with AFL is an Art
Using one of the test cases from the previous post , I examine what affects AFL's ability to find a bug placed by LAVA in a program. Along ...
3960
Beware of strncpy and strncat
Most C programmers also know to avoid the legacy strcpy() and strcat() functions, as these commonly introduce buffer-overflow problems. Instead, C programmers should use the newer strncpy() and strncat() functions, which check the size of the buffer they're copying data into.