421
Data-Free Disneyland
(Note: This is the companion post to my article at Public Books about evading data detection at Disneyland. For the…
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 617 posts.
422
I quit infosec and I couldn't be happier
This article aims at providing you some insights about the experience I had in the “infosec world” for the past few years. I had an amazing journey and grateful for everything that happened. Don’t get me wrong with the title, even if the road was sometimes “bumpy” (aka ‘bad’ experiences), I got some good lessons…
423
Please Sell My Personal Information
I accidentally clicked the "do not sell my personal information" link at the bottom of your website.
424
Ronin 2.0 – open-source Ruby toolkit for security research and development
After nearly a full year of non-stop development since the initial announcement of The Big Refactor , 4153 commits made, 700 issues closed , and a month of beta testing, Ronin 2.0.0 has finally been released!
425
426
UK sets up fake booter sites to muddy DDoS market
The United Kingdom’s National Crime Agency (NCA) has been busy setting up phony DDoS-for-hire websites that seek to collect information on users, remind them that launching DDoS attacks is illegal, and generally increase the level of paranoia for people looking to hire such services.
427
UK version of “Online Harms Bill” wants to prefilter content without due process
Experts warn that ISPs would use black-box AI to comply Like our piece on Canada's Cyber-Security Bill earlier this year, this item was flagged in my work for the Internet Society, Canada Chapter, but this post does not necessarily reflect the opinion of the ISCC. It concerns a legal opinion…
428
Looking into the Stadia Controller Bluetooth Mode Website
With the end of Google's Stadia platform on January 18, 2023, Google published a website allowing people to "Switch the Stadia Controller ...
429
OpenSSL 1.1.1 End of Life
OpenSSL 1.1.1 series has reached its End of Life (EOL). As such it will no longer receive publicly available security fixes.
430
WormGPT – The Generative AI Tool Cybercriminals Are Using
Protect sensitive data from phishing and social engineering with Varonis Interceptor, AI-native email security with 99.9% detection and real-time response.
431
How to weaponize the Yubikey (2019)
Michael Allen // A couple of years ago, I had a YubiKey that was affected by a security vulnerability, and to fix the issue, Yubico sent me a brand new […]
432
Experts fear crooks are cracking keys stolen in LastPass breach
In November 2022, the password manager service LastPass disclosed a breach in which hackers stole password vaults containing both encrypted and plaintext data for more than 25 million users. Since then, a steady trickle of six-figure cryptocurrency heists targeting security-conscious people throughout the tech…
433
WTF is a KDF?
Earlier this week a letter from an activist imprisoned in France was posted to the internet. Contained within Ivan Alococo’s dispatch from the Villepinte prison
434
HAProxy is not affected by the HTTP/2 Rapid Reset Attack
HAProxy products are unaffected by CVE-2023-44487, which could allow a DoS attack against web servers, reverse proxies, and more. Stay tuned for updates.
435
What the QWAC? An EV Certificate all over again
Almost 2 years on from the last time I wrote about QWACs, I'm sadly not here to tell you that things have gone well since then. In fact, I'm actually here to tell you that things are not going well at all... QWAC Back in Jan 2022, I
436
It’s Official: Cars Are the Worst Category We Have Ever Reviewed for Privacy
Privacy Not Included was launched in 2017 to help you understand the privacy risks of tech products that connect to the internet. We are continuing that work in the form of Product Reviews at our magazine Nothing Personal, where our privacy experts do hours of hands-on testing and research on the most popular consumer…
437
Belgium launches nationwide safe harbor for ethical hackers
We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.
438
GitHub Private Repos Considered Private-Ish
This week, we discovered that GitHub.com’s RSA SSH private key was briefly exposed in a public GitHub repository.
439
Teach a man to phish and he’s set for life
One frustrating aspect of email phishing is the frequency with which scammers fall back on tried-and-true methods that really have no business working these days. Like attaching a phishing email to a traditional, clean email message, or leveraging link redirects on LinkedIn , or abusing an encoding method that makes…
440
Bcrypt at 25
As one of the creators of bcrypt back in 1997, I find it somewhat surprising that, 25 years later, we still rely heavily on passwords. My initial encounter with password security took place in 1993 at the University of Hamburg. Having just discovered Unix, I was fascinated by a service called Yellow Pages that allowed…
441
Why are websites requesting access to motion sensors on my desktop? (2019)
I was checking the status of a FedEx order when Brave warned me that “this site has been blocked from accessing your motion sensors”. I’m struggling to understand why a website would need that access. Do I get a different experience if I drop my device? Tip my monitor over? Spin the mouse around?
442
443
The Death of Infosec Twitter
"Infosec Twitter," a vibrant community of security practitioners, known for its insight, inspiration, and entertainment, is coming to an end.
444
OpenSSH Pre-Auth Double Free – Writeup and Proof-of-Concept
Understanding the OpenSSH CVE-2023-25136 high vulnerability. Read our analysis with Proof-of-Concept, learn what's vulnerable, and discover remediations.
445
Unprivileged process injection techniques in Linux
I'm joev, a security engineer 👋 You may know me from my work at Apple or on Metasploit, or from my CVEs.
446
Reverse Engineering the Facebook Messenger API
Note: The focus of this article is to explain the process of reverse engineering, and it is not continually updated to reflect ongoing changes in Facebook APIs. If you are looking for updated details, consider basing your work on open-source projects like mautrix/meta , which is developed by my employer Beeper .
447
The time I accidentally spent a year combatting fraud
Lately, I’ve been spending a lot of time enjoying the Darknet Diaries podcast and it’s compelled me to finally share the story of the most intense year of my
448
The Git source code audit, viewed as a Rust programmer
On January 17th 2023, X41 and Gitlab published a report of the source code audit they performed on Git (funded by the OSTIF foundation).
449
Top Mental Health and Prayer Apps Fail at Privacy, Security (2022)
Despite dealing with issues like depression, suicide, domestic violence, and PTSD, these apps share data freely and raise many security concerns
450
Curl audit: How a joke led to significant findings
In fall 2022, Trail of Bits audited cURL, a widely-used command-line utility that transfers data between a server and supports various protocols. The project coincided with a Trail of Bits maker week, which meant that we had more manpower than we usually do, allowing us to take a nonstandard approach to the […]