4321
Peter Selinger: MD5 Collision Demo
C:\TEMP> md5sum hello.exe cdc47d670159eef60916ca03a9d4a007 C:\TEMP> .\hello.exe Hello, world! (press enter to quit) C:\TEMP>
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,337 posts.
4322
The Security Mindset
Uncle Milton Industries has been selling ant farms to children since 1956. Some years ago, I remember opening one up with a friend. There were no actual ants included in the box. Instead, there was a card that you filled in with your address, and the company would mail you some ants. My friend expressed surprise that…
4323
Firefox and Chromium
Firefox is sometimes recommended as a supposedly more secure browser because of its parent company's privacy practices. This article explains why this notion is not true and enumerates a number of security weaknesses in Firefox's security model when compared to Chromium. In particular, it covers the less granular…
4324
What science can tell us about C and C++'s security
There are not a lot of very strong empirical results in the field of programming languages . This is probably because there’s a huge amount of variables to control for, and most of the subjects available to researchers are CS undergraduates. However, I have recently found a result replicated across numerous codebases…
4325
Blocking-resistant communication through domain fronting
David Fifield, University of California, Berkeley Chang Lan, University of California, Berkeley Rod Hynes, Psiphon Inc Percy Wegmann, Brave New Software Vern Paxson, University of California, Berkeley and the International Computer Science Institute
4326
"Schneier's Law"
Back in 1998, I wrote: Anyone, from the most clueless amateur to the best cryptographer, can create an algorithm that he himself can’t break. In 2004, Cory Doctorow called this Schneier’s law: …what I think of as Schneier’s Law: “any person can invent a security system so clever that she or he can’t think of how to…
4327
On Covering Webcams
The problem isn’t your camera, it’s malware. Don’t install any software from unknown or sketchy sources, keep your OS up to date, and you should be fine. And if you do have malware on your Mac, the webcam is likely the least of your problems.
4328
Random Number Bug in Debian Linux
This is a big deal: On May 13th, 2008 the Debian project announced that Luciano Bello found an interesting vulnerability in the OpenSSL package they were distributing. The bug in question was caused by the removal of the following line of code from md_rand.c MD_Update(&m,buf,j); [ .. ] MD_Update(&m,buf,j); /* purify…
4329
Tracking Firm LocationSmart Leaked Location Data for Customers of All Major U.S. Mobile Carriers Without Consent in Real Time Via Its Web Site
LocationSmart , a U.S. based company that acts as an aggregator of real-time data about the precise location of mobile phone devices, has been leaking this information to anyone via a buggy component of its Web site — without the need for any password or other form of authentication or authorization — KrebsOnSecurity…
4330
F-Droid Security Issues
F-Droid is a popular alternative app repository for Android, especially known for its main repository dedicated to free and open-source software. F-Droid is often recommended among security and privacy enthusiasts, but how does it stack up against Play Store in practice? This write-up will attempt to emphasize major…
4331
How The Intercept Outed Reality Winner
Today, The Intercept released documents on election tampering from an NSA leaker. Later, the arrest warrant request for an NSA contractor ...
4332
My Open Wireless Network
Whenever I talk or write about my own security setup, the one thing that surprises people—and attracts the most criticism—is the fact that I run an open wireless network at home. There’s no password. There’s no encryption. Anyone with wireless capability who can see my network can use it to access the internet. To me…
4333
Write Down Your Password
Microsoft’s Jesper Johansson urged people to write down their passwords. This is good advice, and I’ve been saying it for years. Simply, people can no longer remember passwords good enough to reliably defend against dictionary attacks, and are much more secure if they choose a password too complicated to remember and…
4334
ImperialViolet
Thomas Ptacek laid out a number of arguments against DNSSEC recently (and in a follow up ). We don't fully agree on everything, but it did prompt me to write why, even if you assume DNSSEC, DANE (the standard for speaking about the intersection of TLS and DNSSEC) is not a foregone conclusion in web browsers.
4335
How the new Gmail image proxy works and what this means for you
Google recently announced that images in emails will be displayed automatically by default to Gmail users, thanks to an anonymizing proxy operated by them.
4336
I would like Debian to stop shipping XScreenSaver
If any of you reading this have decision-making ability along those lines, I would appreciate your assistance in making this happen. If you're wondering why: they are still shipping a version of my software that I released in 2014. Since that's roughly a decade in software years, it recently began popping up a single…
4337
Hacking with AI SASTs: An overview of ‘AI Security Engineers’ / ‘LLM Security Scanners’ for Penetration Testers and Security Teams
Reviewing AI Security Engineers: How ZeroPath found 200+ bugs in curl and why AI SASTs are becoming a viable replacement for traditional tools.