2311
How I created two images with the same MD5 hash
I posted the following images the other day which although looking totally different have exactly the same MD5 hash ( e06723d4961a0a3f950e...
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,335 posts.
2312
Three Charged in Fatal Kansas ‘Swatting’ Attack
Federal prosecutors have charged three men with carrying out a deadly hoax known as “swatting,” in which perpetrators call or message a target’s local 911 operators claiming a fake hostage situation or a bomb threat in progress at the target’s address — with the expectation that local police may respond to the scene…
2313
Yep, Passkeys Still Have Problems
Firstyear's blog
2314
The Rise of One-Time Password Interception Bots
In February, KrebsOnSecurity wrote about a novel cybercrime service that helped attackers intercept the one-time passwords (OTPs) that many websites require as a second authentication factor in addition to passwords. That service quickly went offline, but new research reveals a number of competitors have since…
2315
Rolling Your Own Crypto
So you want to roll your own crypto. Well, be careful. Be very careful.
2316
Software Freedom Doesn't Kill People, Security Through Obscurity Kills People
The time has come that I must speak out against the inappropriate rhetoric used by those who (ostensibly) advocate for FLOSS usage in automotive applications.
2317
Some thoughts about Anthropic's new cryptanalysis results
Yesterday Anthropic published two new cryptanalysis results, both outputs of Claude Mythos, their (still) unreleased advanced model. The first of these results attacks a signature scheme called HAW…
2318
Disqus comments adding third-party ad-tracking
I'm killing Disqus comments on my blog. Here's why.
2319
2320
2321
The XAES-256-GCM extended-nonce AEAD
XAES-256-GCM is a new AEAD extended-nonce algorithm designed for high-level APIs and FIPS 140 compliance.
2322
Why Samsung Knox Isn't Really a Fort Knox
UPDATE #2: Apparently Samsung said in their press release that user should try out My Knox, as Knox Personal is deprecated. I just tried t...
2323
Changes to the Blog
I have made a few changes to my blog that I’d like to talk about. The first is the various buttons associated with each post: a Facebook Like button, a Retweet button, and so on. These buttons are ubiquitous on the Internet now. We publishers like them because it makes it easier for our readers to share our content. I…
2324
Reverse engineering a restaurant pager system
Let's reverse engineer a restaurant pager system I bought off the internet!
2325
The limitations of Android N Encryption
Over the past few years we’ve heard more about smartphone encryption than, quite frankly, most of us expected to hear in a lifetime. We learned that proper encryption can slow down even sophi…
2326
2327
Will California Eliminate Anonymous Web Browsing? (Comments on CA AB 2273)
I’m continuing my coverage of dangerous Internet bills in the California legislature. This job is especially challenging during an election year, when legislators rally behind the “protect the kids” mantra to pursue bills that are likely to hurt, or at...
2328
Trusting clients is probably a security flaw
If your service needs to trust the clients, hold my Big Mac
2329
Everything we're told about website identity assurance is wrong
I have a vehement dislike for misleading advertising. We see it every day; weight loss pills, make money fast schemes and if you travel in the same circles I do, claims that extended validation (EV) certificates actually do something useful: > Why are you still claiming this @digicert [https://twitter.com/
2330
German freemail sites trick Firefox and Chrome users into removing AdBlock
German freemail heavyweights web.de and gmx.net (several millions of users combined) are using deceptive techniques in order to manipulate Firefox and Chrome users into removing AdBlock and its var…
2331
We got hit by an alarmingly well-prepared phish spammer
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
2332
How printers and Photoshop detect and refuse to process images of currency
Professor Steven J. Murdoch
2333
When you deleted /lib on Linux while still connected via SSH (2022)
Let's first not talk about why this can happen, but deleting /lib, /usr/lib, or some other essential runtime files happens quite a lot (as you can see: here, here, here, and here). In this post, I will only discuss what happens when you delete /lib on Linux and how to recover from that. The easy
2334
2335
Blue Team Rust: What Is “Memory Safety”, Really?
A brief technical primer on Rust's key security feature, with embedded-specific context.
2336
WoSign's secret purchase of StartCom: WoSign threatened legal actions
This website is for sale! percya.com is your first and best source for information about percya. Here you will also find topics relating to issues of general interest. We hope you find what you are looking for!
2337
VPN over SSH? The Socks Proxy
Some resources on the internet might be only accessible from clients with particular IP addresses. For example, suppose you want to…
2338
Behavioral Profiling: The password you can't change
You can be identified by how you type, even behind proxies and Tor. Protect yourself with KeyboardPrivacy.
2339
Scary fraud ensues when ID theft and usury collide
What’s worse than finding out that identity thieves took out a 546 percent interest payday loan in your name? How about a 900 percent interest loan? Or how about not learning of the fraudulent loan until it gets handed off to collection agents? One reader’s nightmare experience spotlights what can happen when ID…
2340
Careers in security, ethical hacking and advice on where to get started
Many people will disagree with this post, not so much because it's flat out wrong but because there are so many different approaches one can take. It's a very subjective realm but I'm going to put forward some suggestions, make some considered arguments and leave it at