511
Identity Is Dead
First published April 2018.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 579 posts.
512
Who can I hire to hack me?
I use a password manager. I have 2FA set up on everything. When an organisation asks me to set a recovery question, I generate a 32 character passphrase. I don't use my mother's maiden name or my first pet's birthday on anything sensitive. I monitor my email addresses for breaches, and I regularly check my credit…
513
Extracting Bitlocker Keys from a TPM
Extracting BitLocker keys sealed with a TPM by sniffing the LPC bus
514
RSA: Theory and Implementation
RSA has been a staple of public key cryptography for over 40 years, and is still being used today for some tasks in the newest TLS 1.3 standard. This post describes the theory behind RSA - the math that makes it work, as well as some practical considerations; it also presents a complete implementation of RSA key…
515
Millions of Binaries Later: A Look into Linux Hardening in the Wild
With Sophos Cloud Native Security, you can easily integrate protection across multiple environments while minimizing detection time and response.
516
Supporters of Mexico’s Soda Tax Targeted with NSO Exploit Links (2017)
An investigation revealing that Mexican soda tax supporters were targeted with NSO Group's government-exclusive spyware and exploit framework.
517
518
How Cybercriminals Profit by Tapping Your Email
A few days ago I came across the CBC story on how a Canadian man had been defrauded out of $800,000 when cybercriminals inserted themselves into a real estate deal and had the funds diverted to themselves: Here is the "Whois" record for the fake domain used to send the…
519
520
Understanding STIR/SHAKEN – New Anti-Robocalling Protocol
This whitepaper explains the basic technical details of STIR/SHAKEN call authentication and how it prevents caller ID spoofing.
521
Ransomware, Data Breaches at Hospitals Tied to Uptick in Fatal Heart Attacks
Hospitals that have been hit by a data breach or ransomware attack can expect to see an increase in the death rate among heart patients in the following months or years because of cybersecurity remediation efforts, a new study posits. Health industry experts say the findings should prompt a larger review of how…
522
Face recognition in European police forces
The majority of the police forces that answered questions by AlgorithmWatch said they use or plan to introduce face recognition. Use cases vary greatly across countries, but almost all have in common their lack of transparency.
523
Flight stats, entertainment, and trying to crack Widevine
Investigating onboard flight entertainment APIs, flight telemetry, and Widevine-protected media.
524
Kenya Government mandates DNA-linked national ID, without data protection law
Last month, the Kenya Parliament passed a seriously concerning amendment to the country’s national ID law, making Kenya home to the most privacy-invasive national ID system in the world. The ...
525
526
Security for Elasticsearch is now free
We are thrilled to announce that the core security features of the Elastic Stack -- like TLS encryption, RBAC, and both file and native authentication -- are now free.
527
528
One Year After ‘The Big Hack’
Today marks the one-year anniversary of Bloomberg’s publication of a story about Chinese intelligence intercepting the supply chain of Supermicro, a company which has built and sold servers to Amazon, Apple, the U.S. Department of Defense, and dozens of other companies. Apparently, they developed a chip that looked…
529
530
The Big DNS Privacy Debate at FOSDEM
This weekend at the excellent FOSDEM gathering there were no less than three presentations on DNS over HTTPs.
531
532
Privacy-friendly alternatives to Google
Google has become synonymous with the internet, offering services from search engines to email, cloud storage, and more.
533
WordPress 5.2: Mitigating Supply-Chain Attacks
We wrote a cryptography library entirely in PHP to make your WordPress site secure against supply-chain attacks.
534
Spoofing Google Search Results
By adding two parameters to any Google Search URL, you can replace search results with a Knowledge Graph card of your choice. A malicious user can use this to generate false information or ‘fake news’.
535
Zero-knowledge attestation
U2F/FIDO tokens (a.k.a. “Security Keys”) are a solid contender for doing something about the effectiveness of phishing and so I believe they're pretty important. I've written a fairly lengthy introduction to them previously and, as mentioned there, one concerning aspect of their design is that they permit attestation…
536
Stealing Downloads from Slack Users
Stealing Downloads from Slack Users I’m going to go over an interesting feature abuse that could have been used to steal and even manipulate downloads from Slack users using the Slack desktop app …
537
Let's Clarify Some Misunderstandings Around Sign in with Apple
tl;dr This is a good move for users in the iOS ecosystem, and is primarily designed as an alternative for apps that currently use "Sign in with [Facebook/Twitter/Google]" to avoid leaking sensitive user info. Yes, Apple is entering the ...
538
The investigation into ToTok
triaging a massively popular iOS application, with a dark side
539
540
Ways to leak your data: apps’ circumvention of the Android permissions system
50 ways to leak your data: an exploration of apps’ circumvention of the Android permissions system Reardon et al., USENIX Security Symposium 2019 The problem is all inside your app, she said to me …