7501
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,772 posts.
7502
7503
Exploiting the Windows Cryptoapi Vulnerability
On Tuesday, the NSA announced they had found a critical vulnerability in the certificate validation functionality on Windows 10 and Windows Server 2016/2019. This bug allows attackers to break the validation of trust in a wide variety of contexts, such as HTTPS and code signing. Concerned? Get the important details…
7504
Converting untrusted PDFs into trusted ones: The Qubes Way (2013)
Arguably one of the biggest challenges for desktop security is how to handle those overly complex PDFs, DOCs, and similar files, that are so often exchange...
7505
7506
Exploit Information Leaks in Random Numbers from Python, Ruby and PHP
Space Cybersecurity has become a prominent topic in the news, particularly when it comes to protecting space-related assets and technologies.
7507
Deterministic Quoting: Making LLMs safer for healthcare
LLMs have the potential to revolutionise our field of healthcare, but the fear and reality of hallucinations prevent adoption in most applications.
7508
Government Rails Site Hit Hours After CVE Patch
Rietta patched a government client's Ruby on Rails site within hours of a 9.5 CVSS ActiveStorage CVE. Exploit attempts began before business hours resumed.
7509
Account hijacking on MtGox
If it wasn't MtGox I wouldn't even mention it — XSS/fixation/etc are web sec routines, and are not worth a blog post. But it *is* MtGox. W...
7510
7511
US government-funded phones come pre-installed with unremovable malware
A US-funded government assistance program is selling budget-friendly mobile phones that come pre-installed with unremovable malicious apps.
7512
Characterizing secret leakage in public GitHub repositories
How bad can it git? Characterizing secret leakage in public GitHub repositories Meli et al., NDSS’19 On the one hand you might say there’s no new news here. We know that developers shouldn’t …
7513
Indian Electronic Voting Researcher Arrested
Updates:8/28Alex Halderman: Indian E-Voting Researcher Freed After Seven Days in Police Custody 8/26Alex Halderman: Indian E-Voting Researcher Remains in Police Custody 8/24Ed Felten: It’s Time for India to Face its E-Voting Problem 8/22Rop Gonggrijp: Hari is in jail :-( About four months ago, Ed Felten blogged about…
7514
Our brief in support of Twitter's First Amendment suit against the US government
Yesterday, NYU Technology Law & Policy Clinic filed a legal brief on behalf of Freedom of the Press Foundation in Twitter's important lawsuit against the government for violating their First Amendment rights.Buoyed by the Snowden disclosures that began eighteen months ago, tech companies like Twitter have been…
7515
A Spectre proof-of-concept for a Spectre-proof web
Posted by Stephen Röttger and Artur Janc, Information Security Engineers Three years ago, Spectre changed the way we think about security b...
7516
7517
The Orphaned Internet – Taking Over 120K Domains via a DNS Vulnerability
A Hacker's Blog of Unintended Use and Insomnia.
7518
Setback in the outback
Like many others, we have been following the latest developments in Australia related to the “Assistance and Access” bill with a growing sense of frustration. The widespread adoption of strong cryptography and end-to-end encryption has given people around the world the ability to protect their pe...
7519
7520
Apple's secret "wispr" request
When an Apple iOS device (iPhone, iPad, iPod) connects to a WiFi network, the first thing it does is make a request to the URL http://www.ap...
7521
Why Constant-Time Crypto?
In 1996, Paul Kocher published a novel attack on RSA, specifically on RSA implementations , that extracted information on the private key by simply measuring the time taken by the private key operation on various inputs. It took a few years for people to accept the idea that such attacks were practical and could be…
7522
7523
7524
macOS 14 Sonoma firewall bug fixed
The firewall bug in macOS 14 Sonoma betas and release candidates that we blogged about last week has been fixed by Apple.
7525
Write your passwords down
Here's my advice on password security based on the collected opinions of others: 1. Write them down and keep them in your wallet because you...
7526
Security Risks of TSA PreCheck
Former TSA Administrator Kip Hawley wrote an op-ed pointing out the security vulnerabilities in the TSA’s PreCheck program: The first vulnerability in the system is its enrollment process, which seeks to verify an applicant’s identity. We know verification is a challenge: A 2011 Government Accountability Office report…
7527
How my brother's iCloud account was stolen
My brother got his iPhone stolen at gunpoint. This is the story of how he lost control of his iCloud account first (along with years of priceless memories, including my nephew's first steps) and how this couldn't have happened without Apple's incompetent support.
7528
Software Security Is a Programming Languages Issue (2018)
Software security must be addressed by all programmers, not just security experts. So we teach it in CS 330, a programming (languages) class.
7529
LastPass’ Authenticator app is not secure
An easy, root-free way to bypass fingerprint protection on LastPass’ authenticator app
7530
Preventing heartbleed bugs with safe programming languages
The Heartbleed bug in OpenSSL has resulted in a fair amount of damage across the internet. The bug itself was quite simple and is a textbook case for why programming in unsafe languages like C can be problematic. As an experiment to see if a safer systems programming language could have prevented the bug I tried…