4051
Secure Access to 100 AWS Accounts
Explore technical topics, solutions, and resources for building with Twilio – and beyond.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,770 posts.
4052
Remote Prompt Injection in Gitlab Duo Leads to Source Code Theft
The Legit research team unearthed vulnerabilities in GitLab Duo.
4053
Linux Capabilities Revisited
Technical blog by Stephan Berger (@malmoeb)
4054
How SAML 2.0 Authentication Works
At its core, Security Assertion Markup Language (SAML) 2.0 is a means to exchange authorization and authentication information between services. Learn how saml works.
4055
Jitsi privacy flaw enables one-click stealth audio and video capture
A Jitsi feature allows an attacker to transmit user's microphone and camera in the background without their consent.
4056
Planning Go 1.20 cryptography work
My plans for Go 1.20 include landing the crypto/ecdh package, making progress on moving math/big out of the security perimeter, and a batch of crypto/tls work.
4057
When DEF CON partners with the U.S. Army
DEF CON has alienated many hackers by officially aligning its geopolitics with those of the U.S. military and announcing partnerships with the authoritarian countries of Bahrain and Singapore.
4058
Why [Insert Thing Here] Is Not a Password Killer
These days, I get a lot of messages from people on security related things. Often it's related to data breaches or sloppy behaviour on behalf of some online service playing fast and loose with HTTPS or passwords or some other easily observable security posture. But on a fairly regular
4059
4060
Incapacitating Google Tag Manager (2022)
Drilling beneath the hype to expose the truth
4061
Officials Don't Get to Choose Who Gets to Receive, Comment, and Reply to Tweets
We’ve taken a stand for the First Amendment rights of individuals to receive and comment on social media posts from governmental officials and agencies. We’ve received a lot of good questions about why we believe that public servants—mayors, sheriffs, senators, even President Donald Trump—can’t...
4062
Adding a security key to Gmail
Your primary email (the one you give to banks, social media sites, etc.) is the most important online account you have. If an attacker can take over your primary email account, they can reset passwords on every other service that uses that email for account recovery.
4063
Delimiters won’t save you from prompt injection
Prompt injection remains an unsolved problem. The best we can do at the moment, disappointingly, is to raise awareness of the issue. As I pointed out last week, “if you …
4064
Kali Linux 2020.3
Its that time of year again, time for another Kali Linux release! Quarter #3 - Kali Linux 2020.3. This release has various impressive updates, all of which are ready for immediate download or updating. A quick overview of what’s new since the last release in May 2020: New Shell - Starting the process to switch from…
4065
Cryptographic coin flipping, now in Keybase
You're reading the Keybase blog. There are more posts . When you're done, you can install Keybase .
4066
4067
Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate
If you're using Chrome 53, which was released last week, you might find that some websites which worked under Chrome 52 now fail with "Your connection is not private" with an error code of NET::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED . For example, choosemyreward.chase.com shows the following error as of publication…
4068
A recent security incident involving Dropbox Sign
Information on a security incident involving Dropbox Sign.
4069
Abusing the Chromium Devtools Scope Pane
tl;dr — Abusing the Chromium Devtools Scope Pane to track debugging of specific javascript functions
4070
New Tools for Detecting HTTPS Interception
The practice of HTTPS interception continues to be commonplace on the Internet. This blog post discusses types of monster-in-the-middle devices and software, and how to detect them.
4071
Android NAT-T keepalive offload bypasses VPN lockdown
Technical report on Android VPN lockdown bypass via NAT-T keepalive offload.
4072
4073
Open-sourcing Riskquant, a library for quantifying risk
Netflix has a program in our Information Security department for quantifying the risk of deliberate (attacker-driven) and accidental…
4074
4075
Golang SSH Redux
I’ll cover the post/blog, and then I’d like to counter some misconceptions. While part of me thinks “I must’ve been very unclear to have so many people misunderstand”, I also saw how many people commented without bothering to read, so really there’s a limit to how much self-flagellation will happen.
4076
Shamir’s Secret Sharing Scheme
Consider a scenario in which you are tasked with managing the security of a bank's vault. The vault is considered impenetrable without a key, which you are g...
4077
Electronic Frontier Foundation Uncovers Widespread FBI Intelligence Violations
EFF has uncovered widespread violations stemming from FBI intelligence investigations from 2001 - 2008. In a report released today, EFF documents alarming trends in the Bureau’s intelligence investigation practices, suggesting that FBI intelligence investigations have compromised the civil...
4078
Starlink's User Terminal Firmware
This blog post presents an overview of Starlink's User Terminal runtime internals, focusing on the communications that happen within the device and with user applications and some tools that can help further research on the same topic.
4079
Binary SMS – The old backdoor to your new thing
A Accenture oferece oportunidades que surgem a partir da disrupção tecnológica em todas as indústrias, em todos os países, todos os dias. Saiba mais!
4080
GPU.zip: side channel attack that exposes visual data processed on the GPU
On the Side-Channel Implications of Hardware-Based Graphical Data Compression