1771
What to do if you’re stopped by the police
When I was 5, I saw the Karate Kid. I saw that bad guys could beat me up, and I had no recourse if I didn't know karate. I promptly signed up for martial arts classes.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,334 posts.
1772
Private and Public Mastodon
Here’s how to get into a lot of trouble: Suppose you (like me) love the intellectual wealth found in free-form text on the Internet. And (like me) are a reasonably competent programmer. And (like me) have derived value and pleasure searching Twitter. And (like me) you look at this nifty new Fediverse thing and see…
1773
The Moral Character of Cryptographic Work
Abstract: Cryptography rearranges power: it configures who can do what, from what. This makes cryptography an inherently political tool, and it confers on the field an intrinsically moral dimension. The Snowden revelations motivate a reassessment of the political and moral positioning of cryptography. They lead one to…
1774
I Found a $90k Remote Code Execution Vulnerability in Google
A Flask cookie on developers.google.com was signed with a secret it carried inside itself. Pulling that secret out turned a forged session into code execution across Google's developer sites.
1775
Against risk-based authentication (or, why I wouldn't trust Google Cloud)
If you were deciding on whether to use AWS, Azure or Google Cloud for a production application, what factors would you use to make the decision? There are probably many such factors you might think of, but I'd like to point out one that probably isn't commonly considered: the relative trustworthiness of Google's…
1776
European Union dedicated questionnaire on the Encryption of Data
On both sides of Atlantic the debate around strong cryptography frequently resurfaces. Proponents of weakening cryptography or introduction of backdoors (or "golden keys") cite national security. Technologists and activists oppose such proposals, citing freedoms and cybersecurity. Regulating cryptography is of course…
1777
Xerox Alto zero-day: cracking disk password protection on a 45 year old system
We've been archiving a bunch of old Xerox Alto disk packs from the 1970s. A few of them turned out to be password-protected, so I needed ...
1778
HDD Firmware Hacking
Do you know how a hard drive works? Come find out with me as I dump, reverse engineer, and modify the firmware on various HDDs and SSDs.
1779
I'm a security engineer and I still almost got scammed
I was in the park with my son and his best friend. I saw 2 missed calls from a number I didn’t recognise. I Googled it - it was my bank. I told the other adults that I should call back in case it was important.
1780
Should There Be Limits on Persuasive Technologies?
Persuasion is as old as our species. Both democracy and the market economy depend on it. Politicians persuade citizens to vote for them, or to support different policy positions. Businesses persuade consumers to buy their products or services. We all persuade our friends to accept our choice of restaurant, movie, and…
1781
Exploring the Paramilitary Leaks
In January, Distributed Denial of Secrets published over 200 gigabytes of chat logs and recordings from paramilitary groups and militias, including American Patriots Three Percent (APIIII) and the Oath Keepers. The files were obtained by John Williams, a wilderness survival trainer who spent years deep undercover…
1782
2048 Bit RSA and the Year 2030
The Call of the Open Sidewalk [The Call of the Open…2023239 points149 commentsSecurity & Privacy details
Update: NIST released a draft that modified their recommendations (Oct 2024) 1) . RSA 2048 is to be only considered “deprecated” after 2030. The draft states:
1783
FBI seizes bot shop ‘Genesis Market’ amid arrests targeting operators, suppliers
Several domain names tied to Genesis Market , a bustling cybercrime store that sold access to passwords and other data stolen from millions of computers infected with malicious software, were seized by the Federal Bureau of Investigation (FBI) today. The domain seizures coincided with more than a hundred arrests in…
1784
We value your privacy now, but maybe not later
Everybody knows these modal dialogs when visiting a website for the first time that ask you to accept cookies and consent to being tracked by third-party advertising networks. It actually became a habit for me to always click through these things and reject any kind of tracking or use of my personal information except…
1785
1786
1787
1788
1789
Kernel-hack-drill and exploiting CVE-2024-50264 in the Linux kernel
Some memory corruption bugs are much harder to exploit than others. They can involve race conditions, crash the system, and impose limitations that make a researcher's life difficult. Working with such fragile vulnerabilities demands significant time and effort. CVE-2024-50264 in the Linux kernel is one such hard bug…
1790
I found a second vote.gov – and it's registered to the White House
There is a moment in every investigation where the thing you have been looking for finds you instead.
1791
Is “acceptably non-dystopian” self-sovereign identity even possible?
In the recent paper about "soulbound" tokens, Vitalik Buterin et al. write that they aim to build technology that is "acceptably non-dystopian". Do any of today's self-sovereign identity projects fit that bill?
1792
Should you use Let's Encrypt for internal hostnames?
Julien Savoie has written a brilliant post explaining how you can enable https on your intranet. This is useful for several reasons. It means your employees aren't constantly fighting browser warnings when trying to submit stuff internally. All your http traffic is encrypted. You don't need to install a self-generated…
1793
Alert: NPM modules hijacked
<p><strong>EDIT : User @nj48 appears to <a href="https://twitter.com/seldo/status/712673227630313472">have no malicious intentions</a>.</strong></p>
1794
A mysterious bug in the firmware of Google's Titan M chip
Starting with the release of the Pixel 3, all of Google's Pixel Android smartphones come with the Titan M security chip on board. When I realized the Pixel 3a XL I purchased also had it, I decided to try to take advantage of it in an app I work on. It turned out that using the Titan M chip through the Android Keystore…
1795
1796
Who's Selling Credit Cards From Target
The previous two posts on this blog have featured stories about banks buying back credit and debit card accounts stolen in the Target hack and that ended up for sale on rescator[dot]la , a popular underground store. Today’s post looks a bit closer at open-source information on a possible real-life identity for the…
1797
NSA Hacked French President’s House
“Keith Alexander (Director of the NSA) told me he was disappointed because he never thought we would detect them and he even added: You guys are good.” Bernard Barbier French newspaper …
1798
1799
The Battle for Power on the Internet
We’re in the middle of an epic battle for power in cyberspace. On one side are the traditional, organized, institutional powers such as governments and large multinational corporations. On the other are the distributed and nimble: grassroots movements, dissident groups, hackers, and criminals. Initially, the Internet…
1800
What NPM should do to stop a new colors attack
Over the weekend, a developer named Marak Squires intentionally sabotaged his popular NPM package colors and his less popular package faker . As I write this, NPM claims 18,971 direct dependents for colors and 2,751 for faker . Open Source Insights counts at least 42,000 more indirect dependents for colors . Many…