7741
TSA Sued Over New Policy to Refuse Opt-Outs
Last Friday, the TSA snuck out a document updating the “privacy policy” for the nude body scanners. On Tuesday, reports started coming in on the change, including right here. Professi…
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,773 posts.
7742
7743
Bringing HSTS to www.google.com
Posted by Jay Brown, Sr. Technical Program Manager, Security For many years, we’ve worked to increase the use of encryption between our us...
7744
PyPI Requires 2FA for New User Registrations
PyPI requires new users to enable 2FA before performing management actions.
7745
A Really Good Article on How Easy it Is to Crack Passwords
Ars Technica gave three experts a 16,000-entry encrypted password file, and asked them to break them. The winner got 90% of them, the loser 62%—in a few hours. The list of “plains,” as many crackers refer to deciphered hashes, contains the usual list of commonly used passcodes that are found in virtually every breach…
7746
What Transport for London can learn about us from our mobile data
Big Brother meets Big Data
7747
Who can I hire to hack me?
I use a password manager. I have 2FA set up on everything. When an organisation asks me to set a recovery question, I generate a 32 character passphrase. I don't use my mother's maiden name or my first pet's birthday on anything sensitive. I monitor my email addresses for breaches, and I regularly check my credit…
7748
Your Supabase is public if you turn off RLS
I was chatting with a close friend of mine and he sent me a link to his new SaaS that he's developing.
7749
Mozilla patches two use-after-free vulnerabilities (ab)used in the wild
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw.
7750
Github: Token authentication requirements for Git operations
Beginning August 13th, 2021, we will no longer accept account passwords when authenticating Git operations on GitHub.com.
7751
My university uses prompt injection to catch cheaters
Web developer and cybersecurity researcher
7752
7753
Dear Mr. Vice President, Please Take Off Your Apple Watch
An Open Letter To JD Vance From A Former CIA Officer On The Counterintelligence Risks Of Smartwatches Mr. Vice President, Congratulations on your ascendancy to the Vice President of the United States of America. While we are an apolitical platform, we wish you nothing but success, the country depends on you. In a rec
7754
7755
USPS ‘Informed Delivery’ Is Stalker’s Dream
A free new service from the U.S. Postal Service that provides scanned images of incoming mail before it is slated to arrive at its destination address is raising eyebrows among security experts who worry about the service’s potential for misuse by private investigators, identity thieves, stalkers or abusive…
7756
Teensy weensy crypto
As the UK's politicians continue to fail to understand what "strong cryptography" or "banning" even mean, I thought I would have a look at how simple strong cryptography can be.
7757
Command execution on Ansible controller from host
Onafhankelijk cybersecuritybedrijf in Nederland en Spanje. Pentest, MDR, NIS2-advies, incident response en CISO as a Service. Meer dan 20 jaar ervaring, 100+ security experts.
7758
A Quick Look at QUIC Censorship
An introduction to QUIC and its potential for censorship resistance, as well as a survey of current QUIC blocking in China, India, Russia and Uganda.
7759
A gentle introduction to static analyzers for C
One of the great thing about C are the many fairly mature tools in the ecosystem. The bad news however is that most educational materials don't teach them and thus many beginners (and sometimes even experienced) developers have absolutely no awareness that these tools even exists.
7760
A 32-year-old bug walks into a Telnet server
A long, long time ago, in a land free of binary exploit mitigations, when Unix still roamed the Earth, there lived a pre-authentication Telnetd vulnerability. In fact, this vulnerability was born so long ago (way back in 1994) that it may even be older than you. To put the
7761
Google Chrome U2F API decommission: What the change means
Understand Chrome's deprecation of U2F API and its effects, while exploring how to migrate to the WebAuthn API for continued YubiKey support.
7762
7763
About KeePassXC's Code Quality Control
KeePassXC Password Manager
7764
Extracting Bitlocker Keys from a TPM
Extracting BitLocker keys sealed with a TPM by sniffing the LPC bus
7765
How to talk to your parents about hardware memory safety
Some conversations are difficult to have with members of older generations who grew up with different social norms. In particular, when you’re talking to people who grew up with PDP-11s with their completely flat memory, or Lisp machines or Burroughs Large Systems with their deeply opinionated and language-integrated…
7766
Escaping privileged containers for fun
Despite the fact that it is not a 'real' vulnerability, escaping privileged Docker containers is nevertheless pretty funny. And because there will always be people who will come up with reasons or excuses to run a privileged container (even though you really shouldn't), this could really be handy at some point in the…
7767
Microsoft Update Quietly Installs Firefox Extension
Breaking news, live coverage, investigations, analysis, video, photos and opinions from The Washington Post. Subscribe for the latest on U.S. and international news, politics, business, technology, climate change, health and wellness, sports, science, weather, lifestyle and more.
7768
U.S. Government Threatens Free Speech With Calls for Twitter Censorship
“[T]he ultimate good desired is better reached by free trade in ideas....That at any rate is the theory of our Constitution.” — Justice Oliver Wendell Holmes, dissent in Abrams v. United States, 1919EFF has witnessed a growing number of calls in recent weeks for Twitter to ban certain...
7769
Exploiting zero days in abandoned hardware
We successfully exploited two discontinued network devices at DistrictCon’s inaugural Junkyard competition in February, winning runner-up for Most Innovative Exploitation Technique. Our exploit chains demonstrate why end-of-life hardware poses persistent security risks.
7770