511
BeyondCorp is dead, long live BeyondCorp
No organization has fully implemented zero trust architecture. Many advocates, including the US government, overlook devices as a key BeyondCorp component.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 642 posts.
512
Exploiting a heap overflow in the FreeBSD wi-fi stack
In April of this year, FreeBSD patched a 13-year-old heap overflow in the Wi-Fi stack that could allow network-adjacent attackers to execute arbitrary code on affected installations of FreeBSD Kernel. This bug was originally reported to the ZDI program by a researcher known as m00nbsd and patched in
513
Fixing the Unfixable: Story of a Google Cloud SSRF
David Schütz's bug bounty writeups
514
9M Australians affected by Optus data breach
Optus notifies customers of a cyberattack that has allowed unauthorised access to customers personal information.
515
Are Magic Links Outdated?
Are magic links are still viable as an authentication method or are you better off using newer passwordless alternatives?
516
Pulling MikroTik into the Limelight Demystifying and Jailbreaking RouterS
A comprehensive guide to MikroTik internals, including IPC, hand-rolled cryptography, and a novel post-authentication jailbreak
517
A persistent denial of service vulnerability affecting iOS
This domain is for use in documentation examples without needing permission. This is not a service; avoid relying on it for testing and monitoring purposes.
518
Minnesota Wants to Ban Under-18s from User-Generated Content Services
As part of an omnibus bill, the Minnesota House of Representatives passed a troubling bill restricting how under-18 users engage with user-generated content (UGC) services. [At the bottom of this post, I’ve included the text as passed by the Minnesota...
519
New SysJoker Backdoor Targets Windows, Linux, and macOS
In December 2021, we discovered a new multi-platform backdoor that targets Windows, Mac, and Linux that we have named SysJoker.
520
Manifest V3, webRequest, and ad blockers
Vivaldi comes with its own built-in Ad and Tracker Blocker, tons of customization options, a built-in Mail and Calendar, and more. Will it follow Google’s strict reliance on Manifest V3?
521
Ssss: Shamir's Secret Sharing Scheme (2006)
Shamir's Secret Sharing Scheme
522
Meta’s Adversarial Threat Report, Third Quarter 2022
We’re sharing details about three deceptive networks we took down during the last quarter.
523
The definitive guide to “modulo bias” and how to avoid it (2020)
The Latest News from Research at Kudelski Security
524
A lock with many keys: Spoofing DNSSEC-signed domains in 8.8.8.8
We discovered that, until recently, Google Public DNS was theoretically vulnerable to a DNS cache poisoning attack on DNSSEC-signed domain names. Google fixed the vulnerability as a result of our report
525
Tailscale’s human-scale networks are still controlled by Google and Microsoft
I’m not sure if they realize it yet, but Tailscale seems to work extremely well for polycules. Each user can have their own single-user Tailnet and explicitly share specific machines with other people. Both parties have to consent to sharing a device; either party can revoke this consent. The device owner can further…
526
Study: Effectiveness of Apple's app tracking transparency
Does it stop third-party tracking? Or is it just an illusion of privacy?
527
528
Supabase Vault is now in Beta
A Postgres extension to store encrypted secrets and encrypt data.
529
SendGrid appends a tracking pixel even when disabled
Commenting, venting, or ranting. Usually about entrepreneurship, tech, or self-reflection.
530
JWT vs. Opaque Tokens
In this article, you'll learn why you need JWT and opaque tokens, what the differences are between the two, and in which case you should select one or the other.
531
The State of AWS Security
We analyzed trends in the implementation of security best practices and took a closer look at various types of misconfigurations that contribute to the most common causes of security breaches.
532
533
Social engineering dos and don'ts
Another day, another success at sneaking into a building and pretending to be staff. I do so love drinking other people’s expensive office coffee. No fruit bowls though. Close, but no banana. It got me thinking, again, about what makes for good social engineering (SE), and what advice would I give my younger self…
534
Intel deprecates SGX on Core series processors
A newer version of this document is available. Customers should click here to go to the newest version.
535
Updated Proton, Unified Protection
ProtonMail is now Proton! We’re more than just encrypted email — we now offer an entire privacy-focused ecosystem of services.
536
The mechanics of a sophisticated phishing scam and how we stopped it
Yesterday, August 8, 2022, Twilio shared that they’d been compromised by a targeted phishing attack. Around the same time as Twilio was attacked, we saw an attack with very similar characteristics also targeting Cloudflare’s employees
537
Why Xen Wasn't Hit by RETBleed on Intel CPUs
An article explaining why Xen wasn't affected by the recent RETBleed security issue on Intel CPUs.
538
Getting started with nmap
Sysadmin doing syadmin stuff
539
Recovering a password-protected ThinkPad T60
An illustrated overview about the process of clearing the supervisor password from a ThinkPad T60, based on guides that some smart and persistent people have written.
540
Whois: Fragile, Unparseable, Obsolete
A rather unstructured look at one of the older and infuriatingly trivial internet protocols: WHOIS