Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,772 posts.
Hello everyone, It has been quite a long time since my last blog, the last couple of months had been very busy and packed with a lot of work so I barely had much time to write blogs. Time runs so fast that the last time when I wrote a blog I was still a DevOps Engineer and now I am a Product Developer lol.
In this post we describe and demonstrate a neat trick to exfiltrate sensitive information from your browser using a surprising tool: your smartphone or laptop’s ambient light sensor. In short: 1. We provide background about the light sensor API and current discussions to expose it more broadly to websites.
Password cracking rigs, red/blue team guides, and operator field notes from netmux.
Signal Protocol is a modern, open source, strong encryption protocol for asynchronous messaging systems. We use Signal Protocol as the foundation for our own private messaging app, Signal, but also make Signal Protocol libraries available for other applications to use. Our Signal Protocol librar...
Sequoia is a modular OpenPGP implementation in Rust.
Musings on SBOMs and licensing woes.
UPDATE: Two updates can be found at the bottom of this article revealing the findings from Fidus InfoSec and FSLabs’ response to the…
In this blog, we share a new finding in the XZ Utils saga: several Docker images built around the time of the compromise contain the backdoor. At first…
Did you know that Gmail can use your emails and attachments for its smart features? Here's how to check your settings.
YubiKey iOS support is here. For developers, we now offer Yubico Mobile SDK for iOS, and LastPass supports the YubiKey NEO over NFC on iOS.
The tech news recently has seen quite a lot of chatter about an alleged haul of Apple credentials [http://www.zdnet.com/article/apple-icloud-ransom-what-you-need-to-know/], apparently about 250 million of them in all. Allegedly. Maybe. Or was it 300 million? [https://www.macrumors.com/
If the Supreme Court doesn’t reverse a lower court’s ruling, internet service providers (ISPs) could be forced to terminate people’s internet access based on nothing more than mere accusations of copyright infringement. This would threaten innocent users who rely on broadband for essential aspects...
Posted by James Forshaw, path’ological reverse engineer.How the Win32 APIs process file pat...
Technical article explains JSON Web Tokens (JWT), their component parts, and how they are used for authentication.
KrebsOnSecurity recently reviewed a copy of the private chat messages between members of the LAPSUS$ cybercrime group in the week leading up to the arrest of its most active members last month. The logs show LAPSUS$ breached T-Mobile multiple times in March, stealing source code for a range of company projects…
Every day, corporations track our movements through license plate scanners, building detailed profiles of where we go, when we go there, and who we visit. When they do this to us in violation of data privacy laws, we’ve suffered a real harm—period. We shouldn’t need to prove we’ve suffered...
Official transparency report on the November 2014 BrowserStack security breach involving a legacy prototype server (Shellshock). Incident fully resolved. BrowserStack is now SOC 2 Type II, ISO 27001:2022, and GDPR compliant. Trusted by 50,000+ companies.
This is a short addition to the previous rants on OAuth problems. We've got Nir Goldshlager working on our side (he simply loves bounties...
Right now, there are thousands of repositories on GitHub distributing malware. Any of you can find these repositories, and you don’t need any special knowledge to do so. All you have to do is use the standard search function on the GitHub website. These repositories have been around for
In the past year some Mayflower colleagues have started using and contributing to NixOS, a purely functional GNU/Linux distribution that combines package and configuration management. We decided that we would give it a try in production but stumbled upon some issues that had to be resolved first. We have added new…
In recent months, U.S. Customs and Border Protection agents have sought access to private data on the cell phones of two journalists. Such incidents are offensive because they threaten the independence of the press and pose specific risks to confidential sources. This government overreach also...
