Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,335 posts.
We've identified 15,579 websites that are currently infected with malicious JavaScript and between them, we conservatively estimate that they receive more than 135 million visits every month. We know they're infected, and we have the evidence to back that up, but there's a problem: how on
A machine learning craftsmanship blog.
A summary of all iOS 8 Security and Privacy updates and their importance.
Over the past several years I’ve been privileged to observe two contradictory and fascinating trends. The first is that we’re finally starting to use the cryptography that researchers h…
When the marital infidelity website AshleyMadison.com learned in July 2015 that hackers were threatening to publish data stolen from 37 million users, the company’s then-CEO Noel Biderman was quick to point the finger at an unnamed former contractor. But as a new documentary series on Hulu reveals [ SPOILER ALERT! ]…
It started innocently enough. I saw a tweet about a new product offering from one of my favorite companies, Cloudflare. Neat! I clicked through to the site and there it is: And huzzah!, my preferre…
Yikes, looks like the new version of Outlook 20016 has broken the POP3 implementation. If you are currently using the “leave on server and delete after x days” function, the you should check your account because it seems like that the new Outlook is actually deleting your emails almost immediately after retrieving…
I reported an issue to Google, which allows an attacker to confirm whether someone is logged in to any one of a list of specific Google accounts.
With the advent of anonymous online money transactions (read Bitcoin ) ransomware has become a profitable business in the cybercrime indu...
Two months ago I have published a detailed survey of varioussecurity-related problems plaguing the Intel x86 platforms. While the picturepainted in the paper...
Security Researcher | Ethical Hacker | Web Application Security
Containers allow for cookies (a small file used for storing information) as well as other relevant files to be isolated either independently or collectively as a group (for example you could have a finance container). Isolating cookies inside of containers prevents other sites from being able to access them, thus…
Let’s talk about that thing nobody’s talking about. Let’s talk about a vulnerability that’s exposing 2018-2020 Macs while most are declining to act nor report about the matter. Oh, and did I mention it’s unpatchable?
I really like Secure by Design. The key idea is that there is a big overlap between secure code and good software design. Code that is strict, clear and focused will be easier to reason about, and …
This isn’t phishing; it’s not even spear phishing. It’s laser-guided precision phishing: One of the leaked diplomatic cables referred to one attack via email on US officials who were on a trip in Copenhagen to debate issues surrounding climate change. “The message had the subject line ‘China and Climate Change’ and…
It’s super late at night on Thanksgiving weekend in Canada. I shouldn’t be thinking about weird internet drama, but here we are.
KPTI/KAISER Meltdown Initial Performance Regressions
Y esterday I was rudely summoned away from a beautiful autumn day of wild foraging by The King.
We're all impatiently waiting on quantum-proof asymmetrical crypto algorithms to become commonplace. Until that happens, we must all live with the assumption that all currently used asymmetric crypto will be trivially decryptable once quantum computers become powerful enough. This is probably the reason why government…
ICE is using a smartphone app called “Mobile Fortify” to scan faces and capture contactless fingerprints, instantly pulling back names and biographical data — and court filings say the same encounters are being followed by revocations of Global Entry and TSA PreCheck. That turns “trusted traveler” into chilling of…
“The devil is in the details,” they say.
The Keybase browser extension subverts the app's end-to-end encryption. Keybase considers that "an acceptable risk" and not worth fixing.
