4021
The No CAPTCHA problem
When I read about No CAPTCHA for the first time I was really excited. Did we finally find a better solution? Hashcash? Or what? Finally it...
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,770 posts.
4022
Keeping the Internet fast and secure: introducing Merkle Tree Certificates
Cloudflare is launching an experiment with Chrome to evaluate fast, scalable, and quantum-ready Merkle Tree Certificates, all without degrading performance or changing WebPKI trust relationships.
4023
Troubling Arguments from the Government in Smith v. Obama
We’ve filed our reply brief in the appeal of Smith v. Obama, our case challenging the NSA’s mass telephone records collection on behalf of Idaho nurse Anna Smith. The case will be argued before the Ninth Circuit Court of Appeal on December 8, 2014 in Seattle, and the public is welcome to attend....
4024
A little game to demonstrate timing attacks.
Lauren Ipsum is trying to get past Jane Hecate, a little old lady who holds the Book of Passwords. Jane is older and can't see well, so she has to spell out Lauren's guess letter by letter to check whether it's the right password. How can Lauren use this to her advantage? A story about computer science and other…
4025
Simple Encrypted Arithmetic Library goes open source
Today we are extremely excited to announce that our Microsoft Simple Encrypted Arithmetic Library (Microsoft SEAL), an easy-to-use homomorphic encryption library developed by researchers in the Cryptography Research group at Microsoft, is open source on GitHub under an MIT License for free use. The library has already…
4026
A bug related to handling of authenticated sessions
On the evening of March 8, we invalidated all authenticated sessions on GitHub.com created prior to 12:03 UTC on March 8 out of an abundance of caution.
4027
4028
Elliptic Curve Cryptography: A Basic Introduction
Elliptic Curve Cryptography (ECC) is a modern public-key encryption technique famous for being smaller, faster, and more efficient than incumbents. Bitcoin, for example, uses ECC as its asymmetric cryptosystem because it is so lightweight. The mathematical entity that makes all of this possible is the elliptic curve…
4029
4030
Undocumented Facebook API to identify friends in photos
So last week I was casually browsing through Facebook feed and looking at some random photo posted by a friend. So hovering over the pictur...
4031
New Pegasus spyware abuses identified in Mexico
Mexican digital rights organization R3D, with technical support from the Citizen Lab, has determined that Mexican journalists and a human rights defender were infected with Pegasus between 2019 and 2021. The infections occurred years after the first revelations of Pegasus abuses in Mexico, and after Mexico’s current…
4032
The Signal protocol for Node and browsers
Signal is a protocol for encrypted chat. Developed by Moxie Marlinspike and Trevor Perrin, the Signal protocol backs the excellent Signal Messenger , and has since been incorporated into WhatsApp, Facebook Messenger and Google Allo.
4033
Why Does My Remote Control Need to Know My Location?
Here's an interesting user-hostile pattern which could easily be avoided if programmers and business-people thought like regular humans. I have a Pioneer / Onkyo sound system. It's pretty nice and comes with a (not too crappy) Android app to let me remote control it. One day, the app updated itself. The changelog was…
4034
Ruby on Rails Audit Complete
The Open Source Technology Improvement Fund is proud to share the results of our security audit of Ruby on Rails . Ruby on Rails (or “Rails”) is an open source full stack web-application framework. Thanks to the help of X41 D-Sec , GitLab , and the Sovereign Tech Agency , Rails can provide more secure versions of the…
4035
Apple, Google, and Microsoft commit to expanded support for FIDO standard
Faster, easier, and more secure sign-ins will be available to consumers across leading devices and platforms.
4036
Running a private mail server for six years, easy peasy
Motivation The Right Reasons Tech Stack Implementation Mail rate and Spaminess Ongoing Maintenance Alternatives Conclusion
4037
4038
FBI agent accidentally reveals own 8chan posts
Updated August 4, 2019: Added link to “A.C.L.U. Says F.B.I. Funded ‘Army’ To Terrorize Young War Dissidents” The unsealing of an application for a search warrant by the federal governme…
4039
4040
4041
Google Deceptively Tracks Students’ Internet Browsing, EFF Says in FTC Complaint
San Francisco—The Electronic Frontier Foundation (EFF) filed a complaint today with the Federal Trade Commission (FTC) against Google for collecting and data mining school children’s personal information, including their Internet searches—a practice EFF uncovered while researching its “Spying on...
4042
Major sites running unauthenticated JavaScript on their payment pages
A few months ago, British Airways' customers had their credit card details stolen. How was this possible? The best guess goes something like this: BA had 3rd party JS on its payment page <script src="https://example.com/whatever.js"></script> The 3rd party's site was hacked, and the JS was changed. BA's customers ran…
4043
4044
Facebook Android app sends phone number to Facebook servers without consent
Broadcom Community - VMTN, Mainframe, Symantec, Carbon Black
4045
Government-Linked Certificate Authorities in OS X
I’ve been sitting on this information for some time, waiting to get more research done before I publish a post. But since word has come out about how Lenovo preloads what amounts to very bad spyware on their PCs, I thought I should also just go right ahead to spill the beans on the Mac.
4046
A Survival Guide for the Small Mail Server
Nowadays many companies and organizations (non-profits, units of governmental and educational institutions, etc) believe that running their own mail servers has become an impossible task, due both to the large amount of inbound spam and to the continuous attempts by spammers to send outbound spam through their mail…
4047
4048
Does Your Domain Have a Registry Lock?
If you’re running a business online, few things can be as disruptive or destructive to your brand as someone stealing your company’s domain name and doing whatever they wish with it. Even so, most major Web site owners aren’t taking full advantage of the security tools available to protect their domains from being…
4049
Towards a More Open Secure Element Chip
“ Secure Element ” (SE) chips have traditionally taken a very closed-source, NDA-heavy approach. Thus, it piqued my interest when an early-stage SE chip startup, Cramium (still in stealth mode), approached me to advise on open source strategy. This blog post explains my reasoning for agreeing to advise Cramium, and…
4050
Hijacking user sessions with the Heartbleed vulnerability
The Heartbleed issue is actually worse than it might immediately seem (and it seems pretty bad already).