3961
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,337 posts.
3962
3963
About rel=noopener (2016)
2021 update: Browsers now implicitly set rel=noopener for any target=_blank link, following a spec change . If the demo on this page no longer seems scary, congratulations — you’re using a modern browser!
3964
The Most Incompetent TSA Story Yet?
The storyline: TSA screener finds two pipes in passenger’s bags. Screener determines that they’re not a threat. Screener confiscates them anyway, because of their “material and appearance.” Because they’re not actually a threat, screener leaves them at the checkpoint. Everyone forgets about them. Six hours later, the…
3965
3966
Implementing fast TCP fingerprinting with eBPF
In this article I want to document my journey implementing fast TCP fingerprinting in a golang webserver, using eBPF.
3967
One Year After ‘The Big Hack’
Today marks the one-year anniversary of Bloomberg’s publication of a story about Chinese intelligence intercepting the supply chain of Supermicro, a company which has built and sold servers to Amazon, Apple, the U.S. Department of Defense, and dozens of other companies. Apparently, they developed a chip that looked…
3968
On Web Extensions shortcomings and their impact on add-on security
Recently, I reported a security issue in the new Firefox Screenshots feature (fixed in Firefox 56). This issue is remarkable for a number of reasons. First of all, the vulnerable code was running within the Web Extensions sandbox, meaning that it didn’t have full privileges like regular Firefox code. This code was…
3969
Some OS X Applications Vulnerable to MITM Attacks
Facebook bug bounty and story behind a vulnerability
3970
Hopefully the last post I'll ever write on Dual EC DRBG
I’ve been working on some other blog posts, including a conclusion of (or at least an installment in) this exciting series on zero knowledge proofs. That’s coming soon, but first I want…
3971
Looking into the Nintendo Alarmo
While everyone was waiting on news for the successor of the Nintendo Switch, Nintendo released the Alarmo. A small plastic alarm clock that ...
3972
Locking down your GitHub-hosted Domains
The other day someone claimed a hostname on a domain I own and it took me a while to track down how. Turns out it was via GitHub pages.
3973
3974
Why does storing 2FA codes in your password manager make sense?
Modern login systems require a second factor (2FA) to log in, in addition to the standard username and password combination. A Time-based one-time password (TOTP) as a 6-digit number is often used. Password managers like [1Password](https://1password.com/), [KeePass (or respective forks)](https://keepass.info/) and…
3975
Apple Silicon MacBook batteries can't be replaced under warranty by third party
I bought a new M1 MacBook Pro in April 2022. A little over two years later, I'm seeing a service recommended message, and the maximum capacity of the battery is now down to 78%. Admittedly, my MacBook Pro experiences heavy usage: basically all day, every day. The batteries in my previous 2014 Intel MacBook Pro, which…
3976
Finding an authorization bypass on my own website
The mysqljs parameterized query parser handles objects as column name and key, leading to alterations of the query.
3977
TOFU: Do You Check?
Let’s say you’re on a fresh machine. Maybe you’ve just started a new job or you’ve wiped your machine. You’re about to push some code you’ve written and you get this: $ git push The authenticity of host 'github.com (140.82.121.4)' can't be established. ED25519 key fingerprint is…
3978
SSH Do’s and Don’ts
Do Use SSH Keys When ever you can use a key for SSH. Once you create it, you can distribute the public side widely to enable access where ever you need it. Generating one is easy: ssh-keygen -t dsa Don't Use a Blank Passphrase on Your Key This key is now your identity. Protect it.
3979
Certified Malice
One unfortunate (albeit entirely predictable) consequence of making HTTPS certificates “fast, open, automated, and free” is that both good guys and bad guys alike will take advantage of the offer a…
3980
Creating a rogue CA certificate with MD5 hash collisions
We have identified a vulnerability in the Internet Public Key Infrastructure (PKI) used to issue digital certificates for secure websites. As a proof of concept we executed a practical attack scenario and successfully created a rogue Certification Authority (CA) certificate trusted by all common web browsers. This…
3981
Why CISA Is Warning CISOs About a Breach at Sisense
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) said today it is investigating a breach at business intelligence company Sisense , whose products are designed to allow companies to view the status of multiple third-party online services in a single dashboard. CISA urged all Sisense customers to reset…
3982
How Jason Bourne Stores His Bitcoin
If you want to invest in bitcoin for the long-haul, you should address the thorny issue of how best to store them. Since people love stealing bitcoins from others more than just about anything else in this world, all storage systems must first and foremost:
3983
They told you not to reply (2008)
Breaking news, live coverage, investigations, analysis, video, photos and opinions from The Washington Post. Subscribe for the latest on U.S. and international news, politics, business, technology, climate change, health and wellness, sports, science, weather, lifestyle and more.
3984
Yubico with new 4096-bit keys and gpg-agent for ssh authentication
Collection of my projects and hacks.
3985
3986
3987
Towards a test suite for TOTP codes
Because I'm a massive nerd, I actually try to read specification documents. As I've ranted ad nauseam before, the current TOTP spec is irresponsibly obsolete. The three major implementations of the spec - Google, Apple, and Yubico - all subtly disagree on how it should be implemented. Every other MFA app has their own…
3988
Building Password Purgatory with Cloudflare Pages and Workers
I have lots of little ideas for various pet projects, most of which go nowhere ( Have I Been Pwned [https://haveibeenpwned.com/] being the exception), so I'm always looking for the fastest, cheapest way to get up and running. Last month as part of my blog post on How
3989
Bitsquatting: DNS Hijacking without exploitation
Researchers have exploited bit-errors before in amazing ways . But bit-errors can be detected and exploited in new ways on an Internet-wide scale. One of these means is by bitsquatting, or registering domain names one bit different than frequently resolved domains.
3990
2,000 NHS Security Vulnerabilities Disclosed
This is part 3 of a series of blog posts looking at the security of the UK Government's web infrastructure. Britain's National Health Service is riddled with old and insecure WordPress-based websites. Many of these sites have severe flaws including being vulnerable to XSS attacks. There is absolutely no suggestion…