7951
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,773 posts.
7952
Kenya Government mandates DNA-linked national ID, without data protection law
Last month, the Kenya Parliament passed a seriously concerning amendment to the country’s national ID law, making Kenya home to the most privacy-invasive national ID system in the world. The ...
7953
7954
Is Unicode Safe?
Unicode is just too complex to ever be secure.  — Bruce Schneier, 2000 Over the last 25 years Unicode has succeeded. It hasn't displaced all other character encodings, but it's clearly on its way there. It's supported widely enough that it's a compatible choice, new projects use it, and it's becoming the…
7955
What Location Tracking Looks Like
Your cell phone company knows everywhere you go, twenty-four hours a day, every day. How concrete is this fact for you? It's very concrete for Malte Spitz, a German politician and privacy advocate. He used German privacy law — which, like the law of many European countries, gives individuals a...
7956
7957
Bash 'shellshock' scan of the Internet
NOTE: malware is now using this as their User-agent. I haven't run a scan now for over two days. I'm running a scan right now of the I...
7958
Cell Phone OPSEC for Border Crossings
I have heard stories of more aggressive interrogation of electronic devices at US border crossings. I know a lot about securing computers, but very little about securing phones. Are there easy ways to delete data—files, photos, etc.—on phones so it can’t be recovered? Does resetting a phone to factory defaults erase…
7959
7960
7961
7962
Hypernetes: Bringing Security and Multi-Tenancy to Kubernetes
While many developers and security professionals are comfortable with Linux containers as an effective boundary, many users need a stronger degree of isolation, particularly for those running in a multi-tenant environment. Sadly, today, those users are forced to run their containers inside virtual machines, even one…
7963
7964
SLSA, an End-to-End Framework for Supply Chain Integrity
Posted Kim Lewandowski, Google Open Source Security Team & Mark Lodato, Binary Authorization for Borg Team Supply chain integrity attacks—u...
7965
Scanners Beware: Welcome to the network from hell
We’ve crafted a bold defense strategy that not only slows scans but actively disrupts and deceives attackers.
7966
HTTPS Everywhere Version 5: Sixteen New Languages and Thousands of New Rules
This week we released the latest version of HTTPS Everywhere to all of our users. Compared to the previous major release, this version introduces thousands of new rules, translations of the interface into sixteen new languages, and support for "Block All HTTP Requests" in Chrome. If you already use...
7967
Implementing a Tor relay from scratch in golang (2015)
Update from the author, over a decade later: Go has improved and so have my own skills. The conclusion of this article was that Go isn't the right language for the task I gave it, and that's no longer true today, but also wasn't true when I wrote the article. This article is user error, not a language issue.
7968
7969
Apparent use of Sandvine devices for malicious or dubious ends in two countries
This report describes our investigation into the apparent use of Sandvine/Procera Networks Deep Packet Inspection (DPI) devices to deliver nation-state malware in Turkey and indirectly into Syria, and to covertly raise money through affiliate ads and cryptocurrency mining in Egypt.
7970
Schneier: The Value of Privacy
Last week, revelation of yet another NSA surveillance effort against the American people has rekindled the privacy debate. Those in favor of these programs have trotted out the same rhetorical question we hear every time privacy advocates oppose ID checks, video cameras, massive databases, data mining, and other…
7971
Inline PGP signatures considered harmful
People often suggest that inline PGP signatures in e-mail are somehow more compatible or more acceptable than using PGP/MIME . This is a mistake. Inline PGP signatures are prone to several failure modes, up to and including undetectable message tampering.
7972
7973
Reverse Engineering Vercel's BotID
Vercel recently announced BotID, an anti-bot meant to protect against bots without requiring manual intervention. This post reverse-engineers the script and takes a peek inside.
7974
7975
DEFCON Capture the Flag Qualification Challenge #1
Today, we are excited to announce the introduction of Elastic Endpoint Security.
7976
Third-Party Audit of Rustls
In May and June 2020, Cure53 completed an audit of ring , webpki , and rustls . Their report ( PDF ) fully describes the audit, and makes for interesting reading.
7977
FBI chastened by court for lying about existence of surveillance records
An order from the U.S. District Court for the Central District of California has revealed the FBI lied to the court about the existence of records requested under the Freedom of Information Act (FOIA), taking the position that FOIA allows it to withhold information from the court whenever it thinks...
7978
Anomalous keys in Tor relays
Counting almost 7,000 relays , the Tor network is one of the largest volunteer-run anonymity networks operating today. Most of the volunteers who operate these relays choose to remain anonymous, and little is known about how they set up or operate their relays. As a result, it is not clear if all relays correctly…
7979
1971 Social Engineering Attack
From Betty Medsger’s book on the 1971 FBI burglary (page 22): As burglars, they used some unusual techniques, ones Davidon enjoyed recalling years later, such as what some of them did in 1970 at a draft board office in Delaware. During their casing, they had noticed that the interior door that opened to the draft…
7980
Fuzzing with AFL is an Art
Using one of the test cases from the previous post , I examine what affects AFL's ability to find a bug placed by LAVA in a program. Along ...