4831
Passkey Implementation: Misconceptions, pitfalls and unknown unknowns
Read about the challenges, pitfalls and misconceptions we faced while developing our passkey-first authentication solution and passkey intelligence.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,771 posts.
4832
What happens when your phone is spying on you
Smartphone spyware apps that allow people to spy on each other are not only hard to notice and detect, they also will easily leak the sensitive personal information they collect, says a team of computer scientists from New York and San Diego.
4833
Three ways formally verified code can go wrong in practice
"Correct" doesn't mean "correct" when correctly using "correct"
4834
Anonymous message to NATO
Greetings, members of NATO. We are Anonymous. In a recent publication, you have singled out Anonymous as a threat to “government and th...
4835
Certificate Transparency in Firefox
Certificate Transparency (CT) has been one of the biggest advancements in web security, keeping users safe from threats such as certificate fraud and…
4836
Bypassing Antivirus with Ten Lines of Code
I had originally set out to write a long winded blog post on different antivirus bypass techniques. I went through what was supposed to be s...
4837
4838
Gone (Almost) Phishin'
This is a little embarrassing to share, but I’d rather someone else be able to spot a dangerous scam before they fall for it. So, here goes. One evening last month, my Apple Watch, iPhone, and Mac …
4839
4840
8M GitHub profiles were leaked from GeekedIn's MongoDB
Let me make it crystal clear in the opening paragraph: this incident is not about any sort of security vulnerability on GitHub's behalf, rather it relates to a trove of data from their site which was inappropriately scraped and then inadvertently exposed due to a vulnerability in another service.
4841
4842
I exploited existing YouTube videos with a fake Patreon profile
I am watching a lot of investing videos on youtube recently. I like to watch them while I eat, or they play in the background while I do something else. I…
4843
Designing a COM Library for Rust
I interned with Microsoft as a Software Engineering Intern in the MSRC UK team in Cheltenham this past summer. I worked in the Safe Systems Programming Language (SSPL) group, which explores safe programming languages as a proactive measure against memory-safety related vulnerabilities.
4844
4845
4846
4847
How Not to Acknowledge a Data Breach
I’m not a huge fan of stories about stories, or those that explore the ins and outs of reporting a breach. But occasionally I feel obligated to publish such accounts when companies respond to a breach report in such a way that it’s crystal clear they wouldn’t know what to do with a data breach if it bit them in the…
4848
4849
Access Control for GitHub Pages
GitHub Pages now gives you the option to limit access, making the site visible only to users with access to the repository that published the Page. With access control, you…
4850
Tor Messenger Beta: Chat Over Tor, Easily
WARNING STARTS As of March 2018, Tor Messenger is no longer maintained and you should NOT use...
4851
How we reduced the impact of zombie clients
Every night, right around midnight (mainly UTC), a horde of zombies wakes up and clamors for … digital certificates! The zombies in question are abandoned or misconfigured Internet servers and ACME clients that have been set to request certificates from Let’s Encrypt. As our certificates last for at most 90 days…
4852
4853
CVEs affecting the Svelte ecosystem
Time to upgrade
4854
Hacking Google for Fun and Profit
At the end of last year, Google announced their Vulnerability Reward Program which rewards security researchers for reported security and privacy holes in Google properties. This sounded like an interesting challenge, and I set out to find security holes. I found three, got paid, and am now in the Google Security Hall…
4855
A Detailed Elliptic Curve Cryptography Tutorial
When adding two integers i and j of bitlength b, the result will be of bitlength b + 1 in the worst case. This means they can easily be naively added. If the result is larger or equal to F p one has only to subtract p from the result, i.e.:
4856
Google Cloud Platform Security Best Practices
A walkthrough of a couple of Google Cloud Platform (GCP) features with security recommendations and advice on how to configure your GCP environments.
4857
Removing XSLT for a more secure browser
Prepare for Chrome deprecating and removing XSLT from the browser.
4858
DDoS-Guard to forfeit internet space occupied by Parler
Parler , the beleaguered social network advertised as a “free speech” alternative to Facebook and Twitter, has had a tough month. Apple and Google removed the Parler app from their stores, and Amazon blocked the platform from using its hosting services. Parler has since found a home in DDoS-Guard , a Russian digital…
4859
#1 CSRF Is A Vulnerability In All Browsers
Navigation: #1 CSRF Is A Vulnerability In All Browsers - You MUST Deny It ASAP. #2 top secret(will be published on April 1) #3 Another Ra...
4860
Banks, Arbitrary Password Restrictions and Why They Don't Matter
Allow me to be controversial for a moment: arbitrary password restrictions on banks such as short max lengths and disallowed characters don't matter. Also, allow me to argue with myself for a moment: banks shouldn't have these restrictions in place anyway. I want to put forward cases for