2851
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,335 posts.
2852
Common Google XSS
A simple XSS in Google application
2853
2854
Weakening TLS protection, South Korean style
TLS protocol is fundamental to internet security. All South Korean security applications add their own “trusted” Certificate Authorities however, weakening this protocol severely.
2855
T-Mobile USA doesn't comply with its German parent company’s GDPR policies
The Practical Nomad: Edward Hasbrouck's blog
2856
Being Sneaky in C
I entered the 2014 Underhanded C Contest last year. Didn't win, but hey-ho what can you do. Still, I thought I'd post my entry and a write-up of it, in case anyone found it interesting.
2857
Lockdown: The coming war on general-purpose computing (2012)
This article is based on a keynote speech to the Chaos Computer Congress in Berlin, Dec. 2011.
2858
On the Perceived Value of EV Certs, Commercial CAs, Phishing and Let's Encrypt
Last week I wrote about how Life Is About to Get a Whole Lot Harder for Websites Without HTTPS [https://www.troyhunt.com/life-is-about-to-get-harder-for-websites-without-https/]. Somewhere in the comments there, the discussion went off on a tangent about commercial CAs, the threat
2859
The new .zip TLD is going to cause some problems
Many years ago, Google applied for the .zip Top Level Domain. ICANN, in its infinite wisdom, granted it. And now, I think, bad things are going to happen. You see computers try to be helpful. They see you wrote "visit example.com" and autolink the thing which looks like a domain name. That's handy - especially as most…
2860
I accidentally made law enforcement shut down their fake honeypot
How I stumbled across a fake booter site run by international police, and how they panicked when I started digging
2861
Mind the encryptionroot: How to save your data when ZFS loses its mind
While ZFS has a well-earned reputation for data integrity and reliability, OpenZFS native encryption has some incredibly sharp edges that will cut you if you don't know where to be careful. Unfortunately, I learned this the hard way, standing in a pool of my own blood and tears after thoroughly lacerating myself…
2862
2863
What happens when DNS in China is poisoned and pointed at your server
I’ve been using the Internet in one form or another since the mid-80’s. In that time, I’ve seen a lot of strange stuff happening on our global network. On Tuesday, I experienced something extraordinary. It all started with a text message from my partner Ged at 8:30 AM: Mail server down. Please take a look […]
2864
What is the randomart image for?
When you generate an SSH key (like I did when looking at signing commits with SSH keys ), you get a “randomart image” from ssh-keygen . These things:
2865
2866
2867
NPM Package Hijacking From the Hijacker's Perspective
In light of recent events in the javascript community, I would like to share the story of how I came into control of more than 200 heavily…
2868
2869
Some discouraging anecdotes on how services handle account deletions
I asked 124 services to delete my user account. The results were mixed. 21 never responded, and 16 responded by created even more accounts. Some outright lied.
2870
All you ever wanted to know about building a secure password reset (NSFW)
This content is now available in the Pluralsight course "Secure Account Management Fundamentals" [http://www.pluralsight.com/courses/secure-account-management-fundamentals] Recently I’ve had a couple of opportunities to think again about how a secure password reset function should operate, firstly whilst building this…
2871
2872
2873
2874
2875
RSA is deceptively simple and fun
While reading Real-World Cryptography , I came across the "million message attack" . This is an attack that Daniel Bleichenbacher demonstrated in 1998, which effectively broke RSA with a particular encoding function called PKCS #1 . It was only mentioned briefly, so I dug in and decided to try to understand the…
2876
2877
2878
Phishing attack against Lastpass
Updated 2016-02-04 : LastPass has removed the button from notifications and now requires email confirmation for all logins from new IPs . This substantially mitigates LostPass, but does not eliminate it.
2879
FBI, Dutch police disrupt 'Manipulaters' phishing gang
The FBI and authorities in The Netherlands this week seized dozens of servers and domains for a hugely popular spam and malware dissemination service operating out of Pakistan. The proprietors of the service, who use the collective nickname “ The Manipulaters ,” have been the subject of three stories published here…
2880
So You Want to Be a Security Expert
I regularly receive e-mail from people who want advice on how to learn more about computer security, either as a course of study in college or as an IT person considering it as a career choice. First, know that there are many subspecialties in computer security. You can be an expert in keeping systems from being…