4261
Stop Password Masking
Usability suffers when users type in passwords and the only feedback they get is a row of bullets. Typically, masking passwords doesn't even increase security, but it does cost you business due to login failures.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,337 posts.
4262
Faking votes on Hacker News
Hacker News is a site where users vote on links. When someone clicks on an up or down vote, their browser sends a GET request that looks like this: GET /vote?by= joesmith dir=upfor=8765309 A user can only vote if the by parameter matches their Hacker News login cookie. So for a third…
4263
I've Seen the Future, and It Has a Kill Switch
It used to be that just the entertainment industries wanted to control your computers—and televisions and iPods and everything else—to ensure that you didn’t violate any copyright rules. But now everyone else wants to get their hooks into your gear. OnStar will soon include the ability for the police to shut off your…
4264
4265
4266
Encrypt-then-MAC
First things first: Why use a composition of encryption and MAC instead of a single primitive which achieves both? Because people are very good at writing bad code. In my experience on the FreeBSD security team, writing dozens of security advisories, there are three types of code which are especially prone to have…
4267
Creative anti-debugger technique in Spotify for Windows
Spotify for Windows contains code so awesome that OllyDbg can't look at it without crashing.
4268
Countering Trusting Trust Through Diverse Double-Compiling (DDC)
David A. Wheeler's Page on Countering 'Trusting Trust' through Diverse Double-Compiling (DDC) - Countering Trojan Horse attacks on Compilers
4269
You Don't Want XTS
XTS is the de-facto standard disk encryption mode, which makes it look like a good general-purpose one. It isn't. What disk encryption actually promises, and why XTS's guarantees don't travel.
4270
4271
Why What3Words is not suitable for safety critical applications
What3Words is a widely promoted system that is used for sharing a location using just three words. For example, ///wedge.drill.mess is located in Hyde Park.The globe is divided into 3m squares, eac…
4272
Script kiddies have awesome tools
Wir ziehen mit dem Projekt ngra.de um. Sind Sie am Kauf der Domain ngra.de interessiert?
4273
Bank Robber Recruits Accomplices With Fake Job Ad on Craigslist
Now this is clever: “I came across the ad that was for a prevailing wage job for $28.50 an hour,” said Mike, who saw a Craigslist ad last week looking for workers for a road maintenance project in Monroe. He said he inquired and was e-mailed back with instructions to meet near the Bank of America in Monroe at 11 a.m…
4274
Twitter Exploit Still Works
I bet 10 years ago none of us thought that 140 characters would change the landscape of Social Media quite so much. However, with close to 289,000,000 active users sending around 6,000 tweets every second Twitter has proven its critics wrong. Obviously, having gotten over …
4275
4276
Corrupted Word Files for Sale
On one hand, this is clever: We offer a wide array of corrupted Word files that are guaranteed not to open on a Mac or PC. A corrupted file is a file that contains scrambled and unrecoverable data due to hardware or software failure. Files may become corrupted when something goes wrong while a file is being saved e.g…
4277
Palm Pre Privacy Invasion
I've been taking a closer look at the WebOS side of my Palm Pre tonight, and I noticed that it periodically uploads information to Palm, Inc.
4278
Nate Lawson Breaks Google Keyczar's HMAC Crypto Signatures
I recently found a security flaw in the Google Keyczar crypto library. The impact was that an attacker could forge signatures for data that was “signed” with the SHA-1 HMAC algorithm (t…
4279
How Credit Card Numbers Are Generated
Visa,Master Card,Discover, and American Express credit card validation and generation techniques using the luhn algorithm.
4280
The qmail security guarantee
Of course, ``security hole in qmail'' does not include problems outside of qmail: for example, NFS security problems, TCP/IP security problems, DNS security problems, bugs in scripts run from .forward files, and operating system bugs generally. It's silly to blame a problem on qmail if the system was already…
4281
Lessons from the Debian/OpenSSL Fiasco (2008)
Last week, Debian announced that in September 2006 they accidentally broke the OpenSSL pseudo-random number generator while trying to silence a Valgrind warning. One effect this had is that the ssh-keygen program installed on recent Debian systems (and Debian-derived systems like Ubuntu) could only generate 32,767…
4282
Datacenter Security: A Cautionary Tale from Last.fm
Last.fm has presence in three datacenters in the London area - this is currently more because of necessity than redundancy; datacenter space is at a real premium in the UK and we can’t fulfill our power growth needs at just one site. We operate our own 20 gigabit fibre ring between these, which means we can basically…
4283
"Goldman sachs code torrent" honeypot
.rar 32MB. A distributed real-time co-located high-frequency trading platform… A very low latency (microseconds) event-driven market data processing, strategy and order submission engine.
4284
4285
Complexity is insecurity
Complexity can be thought of as a type of code smell : It doesn't necessarily imply that there is a problem, but the presence of complexity is very strongly correlated with the presence of security vulnerabilities. In the design and construction of secure systems, it is important to not only consider mistakes which…
4286
4287
4288
Media Temple Hacked
I don’t normally do negative posts about another person or company, but I feel this needs to get out there. A few hours ago I received an email from MediaTemple , where I host several of my clients. It was an automated message informing me that:
4289
4290