631
The search for a perfect access control system
Making sense of authorization, policy and access management systems.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 678 posts.
632
When did “privacy issues” start to mean “too much privacy”?
Clubhouse draws the ire of journalists
633
SLSA, an End-to-End Framework for Supply Chain Integrity
Posted Kim Lewandowski, Google Open Source Security Team & Mark Lodato, Binary Authorization for Borg Team Supply chain integrity attacks—u...
634
635
636
AuthZ: Scalable permissions system
How we built an authorization system based on Google Zanzibar
637
Encrypting Postgres Data at Rest in Kubernetes
An example of how you can encrypt Postgres data at rest using PGO, the open source Postgres Operator from Crunchy Data using AWS EBS gp2 volumes.
638
Cloudflare's Handling of an RCE Vulnerability in Cdnjs
Recently, a RCE vulnerability in the way cdnjs’ backend is automatically keeping web resources up to date has been disclosed. Read about how Cloudflare handled the security incident and what will prevent similar exploits in the future.
639
Arti, a pure-Rust Tor implementation
Greetings! Today I'm happy to announce a new era in Tor implementation. Over the past year or so, we've been working on "Arti", a project to rewrite Tor in Rust. Thanks to funding from Zcash Open Major Grants (ZOMG), we can finally put the Arti project up in our priorities list, and devote more time to it. Below I'll…
640
641
Defeating Cookie Banners
How Transcend solved the core technical problem of user tracking consent and built an alternative to pop-up cookie banners.
642
Kraken Security Labs Identifies Vulnerabilities in Commonly Used Bitcoin ATM
Bitcoin ATMs offer a convenient and friendly way for consumers to purchase cryptocurrencies. That ease of use can sometimes come at the expense of security. Kraken Security Labs has uncovered multiple hardware and software vulnerabilities in a commonly used cryptocurrency ATM: The General Bytes BATMtwo (GBBATM2)…
643
Hex-rays is moving to a subscription model
Hex-Rays is moving to a subscription model In 2022, we will update the catalogue of products available under our subscription model. Our new bundles are
644
645
You don't need to burn off your fingertips (and other biometric myths)
111 years ago almost to the day, a murder was committed which ultimately led to the first criminal trial to use fingerprints as evidence [https://www.smithsonianmag.com/history/first-case-where-fingerprints-were-used-evidence-180970883/] . We've all since watched enough crime shows to understand that fingerprints are
646
OAuth Attack Vectors
Intro The OAuth2 authorization protocol has been under fire for the past ten years. You've probably already heard about plenty of "return_uri" tricks, token leakages, CSRF-style attacks on clients, an
647
A future without passwords
On World Password Day, we’re providing a sneak peek at a future in which, one day, you won’t need a password at all.
648
Man Robbed of 16 Bitcoin Sues Young Thieves’ Parents
In 2018, Andrew Schober was digitally mugged for approximately $1 million worth of bitcoin. After several years of working with investigators, Schober says he’s confident he has located two young men in the United Kingdom responsible for using a clever piece of digital clipboard-stealing malware to siphon his crypto…
649
Database containing personal info of 106M visitors to Thailand exposed online
Just how safe is your personal information? With more than thousand reported data breaches since 2004, the odds are not in your favor.
650
When Myanmar needs ProtonVPN the most, Apple stands in the way of human rights
Myanmar citizens have used Proton tools to communicate securely and access the truth. But Apple has blocked us from sending out important app updates.
651
Cryptanalysis of Meow Hash
The creators of Meow hash made security claims; we break them all.
652
Is Apple Banning Free Analytics SDKs?
This story has moved a lot since it was published – our update from March 3 tells the latest. Apple...
653
The security scanner that cried wolf
If you’ve ever been alarmed by how many security vulnerabilities your Docker image has, even after you’ve installed security updates, here’s what’s going on.
654
TPM Sniffing
TL;DR : we reproduced Denis Andzakovic’s proof-of-concept showing that it is possible to read and write data from a BitLocker-protected device (for instance, a stolen laptop) by sniffing the TPM key from the LCP bus.
655
656
Apple’s New ‘Child Safety’ Initiatives, and the Slippery Slope
The stakes are incredibly high, and Apple knows it. Whatever you think of Apple’s decision to implement these features, they’re not doing so lightly.
657
The Apple goto fail vulnerability: lessons learned (2014)
Description of what we have learned
658
Privilege escalation with polkit: How to get root on Linux with a seven-year-ol
polkit is a system service installed by default on many Linux distributions. It’s used by systemd, so any Linux distribution that uses systemd also uses polkit.
659
Google banned almost 120k spam developer accounts in 2020 for the play store
Posted by Krish Vitaldevara, Director of Product Management Trust & Safety, Google Play Providing safe experiences to billions of users a...
660
Passwordless Logins with Yubikey
Yubikey is currently the de facto device for U2F authentication. It enables adding an extra layer of security on top of SSH, system login, signing GPG keys,...