Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,771 posts.
The new Snowden revelations are explosive. Basically, the NSA is able to decrypt most of the Internet. They’re doing it primarily by cheating, not by mathematics. It’s joint reporting between the Guardian, the New York Times, and ProPublica. I have been working with Glenn Greenwald on the Snowden documents, and I have…
Proofcraft’s Chief Engineer Rafal Kolanski has completed a major “architecture split” overhaul of the seL4 proofs, resulting in the removal of 250k lines of proof and strengthening the link between proofs on different architectures. These changes will significantly reduce future effort required to maintain and extend…
Some places say 255 bytes. They are wrong . Within a TXT record there are multiple character-strings (RFC 1035 section 3.3.14 ) and those are limited in length (because a single byte is used for their length), however there can be many of them.
You have heard of “zip bombs” (a tiny ZIP file that decompresses to multiple gigabytes) and “XML bombs” (small XML file abusing the entities to consume lots of memory), and …
A Accenture oferece oportunidades que surgem a partir da disrupção tecnológica em todas as indústrias, em todos os países, todos os dias. Saiba mais!
The time has come. I bought my second IoT device - in the form of a cheap IP camera. As it was the most affordable among all others, my exp...
What if a secure device had an attacker-viewable crashdump format? What if that same device allowed putting arbitrary memory into the crashdump? Amazingly, the ps4 tempted fate by supporting both of these features! Let’s see how that turned out…
Users of the Signal messaging app got hit by a hacker attack. We analyze what happened and why the attack demonstrates that Signal is reliable.
The U.S. government today imposed economic sanctions on Funnull Technology Inc. , a Philippines-based company that provides computer infrastructure for hundreds of thousands of websites involved in virtual currency investment scams known as “ pig butchering .” In January 2025, KrebsOnSecurity detailed how Funnull was…
Read the preliminary post incident report regarding the CrowdStrike Falcon content update affecting Windows hosts.
What the accidental Claude Code source code leak tells us about the real value of code, product market fit, and why integration is what actually makes software great.
DMARC has been public since 2012. We checked 67,336 domains: 68.4% still have no policy or one that does not enforce it.
This blog post describes how electronic passports work, the threats within their threat model, and how they protect against those threats using cryptography. It also discusses the implications of using electronic passports for novel applications, such as zero-knowledge identity proofs.
Why using cryptographic hashes doesn't make data anonymous.
Dave Winer ends an otherwise quite reasonable piece about his concern at Facebook's
This MacKeeper report will tell you about 6 major data breaches that happened in 2018.
Our goal is to ensure users understand who is advertising to them and why they are seeing specific ads.
We do penetration testing, source code auditing and vulnerability assessments
One of the oldest scams around — the fake job interview that seeks only to harvest your personal and financial data — is on the rise, the FBI warns. Here’s the story of a recent LinkedIn impersonation scam that led to more than 100 people getting duped, and one almost-victim who decided the job offer was…
Obama’s position on encryption is now public, as reported by the Washington Post. According to Ellen Nakashima and Andrea Peterson of the Post, Obama “will not —for now—call for legislation requiring companies to decode messages for law enforcement.” Instead, the Post reports, the “administration...
Indian information technology (IT) outsourcing and consulting giant Wipro Ltd. [ NYSE:WIT ] is investigating reports that its own IT systems have been hacked and are being used to launch attacks against some of the company’s customers, multiple sources tell KrebsOnSecurity. Wipro has refused to respond to questions…
Learn about SAML authentication and the mechanics behind some of the most common SAML use cases, all through the fictional BaaS (Beer-as-a-Service).
FairPlay comprises a set of algorithms created by Apple for digital rights management (also called DRM, digital rights management). FairPlay is currently used to manage the decryption of iOS applications during their installation on Apple devices. In fact, we know that Apple distributes all applications in the Apple…
Authorities in Germany this week seized Internet servers that powered FlyHosting , a dark web offering that catered to cybercriminals operating DDoS-for-hire services, KrebsOnSecurity has learned. FlyHosting first advertised on cybercrime forums in November 2022, saying it was a Germany-based hosting firm that was…
This blog is written by Hanno Böck. Unless noted otherwise, its content is licensed as CC0 .
We have compiled a list of some of the best practices to prevent API key leakage and keep secrets and credentials safe. Secrets management doesn’t have a one-size-fits-all approach, so this list considers multiple perspectives so you can be informed in deciding to or not to implement strategies.
A disclosure for an OpenSSH keystroke obfuscation bypass affecting current OpenSSH versions after 9.4.
A Stanford computer scientist says Internet voting would be "a complete disaster."
