3211
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,770 posts.
3212
Many of the root certificates on Windows are not needed
As of today, Windows trusts 322 root certificates issued by 122 different organizations from 47 countries. This number is quite high, and has been steadily growing over the last few years. And it turns out many of those certificates are not needed at all by the vast majority of Windows users, can be distrusted with no…
3213
‘Re-education’, forced labour and surveillance beyond Xinjiang
Australian Strategic Policy Institute2020255 points106 commentscited by 11Society, Policy & Culture details
‘Re-education’, forced labour and surveillance beyond Xinjiang. What’s the problem? The Chinese government has facilitated the mass transfer of Uyghur and other ethnic minority1 citizens from the far west region of Xinjiang to factories across the country. Under conditions that strongly suggest forced labour, Uyghurs…
3214
3215
AWS IAM Roles, a tale of unnecessary complexity
This is going to be a highly opinionated blog post. I think AWS is great and use it daily, but their implementation of IAM is unnecessarily complicated.
3216
3217
Google's threat model for post-quantum cryptography
Read on to understand how Google currently evaluates the threat landscape related to post-quantum cryptography, and what implications this has for migrating from classical cryptographic algorithms to PQC.
3218
Adtech surveillance and government surveillance are often the same
In the absence of comprehensive federal privacy legislation in the United States, the targeted advertising industry, fueled by personal information harvested from our cell phone applications, has run roughshod over our privacy. Worse, the boundaries between corporate surveillance and government...
3219
New NSA Documents Shine More Light into Black Box of Executive Order 12333
What is arguably the most powerful of the U.S. government’s surveillance authorities is also the most secretive, and it operates with the least amount of oversight.
3220
What is Traitorware?
Your digital camera may embed metadata into photographs with the camera's serial number or your location. Your printer may be incorporating a secret code on every page it prints which could be used to identify the printer and potentially the person who used it. If Apple puts a particularly creepy...
3221
3222
Austrian DSB: EU-US Data Transfers to Google Analytics Illegal
In a groundbreaking decision, the Austrian Data Protection Authority has decided on a model case by noyb that the continuous use of Google Analytics violates the GDPR.
3223
Here’s what Ashley Madison members have told me
I found myself in somewhat of a unique position last week: I’d made the Ashley Madison data searchable for verified subscribers of Have I been pwned? [https://haveibeenpwned.com/] (HIBP) and now – perhaps unsurprisingly in retrospect – I was being inundated with email. I mean hundreds of emails every day
3224
How can you be fooled by the U+202E trick? (2013)
Ethical Hacking, Malware Analysis, Disinfection…2022254 points140 commentsSecurity & Privacy details
Ethical Hacking, Malware Analysis, Disinfection Techniques, Information Security, Pentesting Techniques and all related with Computer Security.
3225
QuickBooks Cloud Hosting Firm iNSYNQ Hit in Ransomware Attack
Cloud hosting provider iNSYNQ says it is trying to recover from a ransomware attack that shut down its network and has left customers unable to access their accounting data for the past three days. Unfortunately for iNSYNQ, the company appears to be turning a deaf ear to the increasingly anxious cries from its users…
3226
Microsoft confirms UEFI fears, locks down ARM devices
The Software Freedom Law Center provides legal representation and other law related services to protect and advance Free and Open Source Software.
3227
The order of files in /etc/ssh/sshd_config.d/ matters
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
3228
Iran forged the wrong SSL certificate
If you want to be really evil, however, *.google.com is the wrong SSL certificate to forge. The right one? ssl.google-analytics.com .
3229
'; CREATE TABLE `Capture the Flag`;' -- Stripe's Web Security CTF is Live
Today we're launching Capture the Flag: Web Edition, a security contest where you can try your hand at discovering and exploiting vulnerabilities in mock web applications.
3230
SAPwned: SAP AI vulnerabilities expose customers' cloud environments and privat
Wiz Research uncovers vulnerabilities in SAP AI Core, allowing malicious actors to take over the service and access customer data.
3231
The FBI Is Breaking into Encrypted Devices – We’re Suing
We can't let the FBI keep the public in the dark about its ability to gain access to information stored on our personal mobile devices.
3232
EFF Challenges New Jersey Subpoena Issued to MIT Student Bitcoin Developers
As the popularity of Bitcoins has increased, government officials are concerned about criminal activity associated with the virtual currency. But a recent subpoena issued by the New Jersey Division of Consumer Affairs to 19-year-old Bitcoin developer and MIT student Jeremy Rubin goes too far, and...
3233
3234
Always Review Your Dependencies, AGPL Edition
Before adding a dependency to one of my software projects, I do some basic vetting of the dependency. Among the things I check are:
3235
Remote code execution vulnerability in Google they are not willing to fix
This is a story about a security vulnerability in Google that allowed me to run arbitrary code on the computers of 50+ Google employees. Although Google initially considered my finding a serious security incident, later on, it changed its mind and stated that my finding is not, in fact, a vulnerability, but the…
3236
3237
Analyzing the compromised DLL file that started the Solorigate attack
We, along with the security industry and our partners, continue to investigate the extent of the Solorigate attack. While investigations are underway, we want to provide the defender community with intel to understand the scope and impact, remediation guidance, and detections and protections we have built as a result.
3238
3239
Article 45 of eIDAS 2.0 will roll back web security by 12 years
The EU is poised to pass a sweeping new regulation, eIDAS 2.0. Buried deep in the text is Article 45, which returns us to the dark ages of 2011, when certificate authorities (CAs) could collaborate with governments to spy on encrypted traffic—and get away with it. Article 45 forbids browsers from...
3240
Using Let's Encrypt for Internal Servers (2018)
Let’s Encrypt is a revolutionary new certificate authority that provides free certificates in a completely automated process. These certificates are …