8071
The Plausibly Deniable DataBase (PDDB)
The problem with building a device that is good at keeping secrets is that it turns users into the weakest link.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,773 posts.
8072
ProtonMail now the maintainer of OpenPGPjs email encryption library
OpenPGPjs is the world's most popular JavaScript PGP email encryption library and is used by millions of end users and hundreds of developers.
8073
We Were Wrong About the GPLs
an unsurprising admission in Conservancy v. Vizio
8074
Sandstorm gets a security review
Take control of your web by running your own personal cloud server with Sandstorm.
8075
8076
Doge to Fired CISA Staff: Email Us Your Personal Data
A message posted on Monday to the homepage of the U.S. Cybersecurity & Infrastructure Security Agency (CISA) is the latest exhibit in the Trump administration’s continued disregard for basic cybersecurity protections. The message instructed recently-fired CISA employees to get in touch so they can be rehired and then…
8077
Lesser known mobile adtech domains where data is sent
AppGoblin has now run over 40k apps in an emulator, tracking millions of API calls thousands of advertising domains. Unfortunately, some of them are dark, meaning they have no landing page of any kind, and I’m unclear who controls these domains.
8078
Going Beyond Vulnerability Rewards
Posted by Michal Zalewski, Google Security Team We all benefit from the amazing volunteer work done by the open source community. That’s w...
8079
8080
SIDH in Go for quantum-resistant TLS 1.3
Most of today's cryptography is designed to be secure against an adversary with enormous amounts of computational power. This means estimating how much work certain computations require, and choosing cryptographic parameters based on our best estimates.
8081
Spoofing Google Search Results
By adding two parameters to any Google Search URL, you can replace search results with a Knowledge Graph card of your choice. A malicious user can use this to generate false information or ‘fake news’.
8082
Signal: Safety number updates
The latest Signal release includes some changes to the way safety numbers work. Safety numbers allow Signal users to verify the privacy of their communication with a contact, either by comparing a number or by scanning a single QR code. We recently introduced this new design as an update to Sign...
8083
8084
Zero-knowledge attestation
U2F/FIDO tokens (a.k.a. “Security Keys”) are a solid contender for doing something about the effectiveness of phishing and so I believe they're pretty important. I've written a fairly lengthy introduction to them previously and, as mentioned there, one concerning aspect of their design is that they permit attestation…
8085
A tale of a DNS exploit: CVE-2015-7547
A buffer overflow error in GNU libc DNS stub resolver code was announced last week as CVE-2015-7547. While it doesn't have any nickname yet (last year's Ghost was more catchy), it is potentially disastrous.
8086
Stealing Downloads from Slack Users
Stealing Downloads from Slack Users I’m going to go over an interesting feature abuse that could have been used to steal and even manipulate downloads from Slack users using the Slack desktop app …
8087
Nice Security Mindset Example
A real-world one-way function: Alice and Bob procure the same edition of the white pages book for a particular town, say Cambridge. For each letter Alice wants to encrypt, she finds a person in the book whose last name starts with this letter and uses his/her phone number as the encryption of that letter. To decrypt…
8088
8089
Practical Reverse Engineering Part 4 - Dumping the Flash
Fourth post in the series, detailing how to dump the router's flash chip directly with an SPI programmer, then split and decompress the resulting image into ...
8090
8091
Let's Clarify Some Misunderstandings Around Sign in with Apple
tl;dr This is a good move for users in the iOS ecosystem, and is primarily designed as an alternative for apps that currently use "Sign in with [Facebook/Twitter/Google]" to avoid leaking sensitive user info. Yes, Apple is entering the ...
8092
EU Digital Identity framework (eIDAS) another kind of chat control?
The proposed EU Digital Identity framework (eIDAS) aims to meddle with the process around internet certificates and will undermine the independence and security assurances of the basis for website security:
8093
8094
When does an old iPhone become unsafe to use?
When Apple stops issuing security updates for older iPhones, they become unsafe to use. But exactly how long can you safely keep using an old iPhone, and when should you upgrade?
8095
Hex-rays is moving to a subscription model
Hex-Rays is moving to a subscription model In 2022, we will update the catalogue of products available under our subscription model. Our new bundles are
8096
Maybe we shouldn't skip SHA-3
David Wong writes about cryptography, security, and programming.
8097
8098
Reassessing Airport Security
News that the Transportation Security Administration missed a whopping 95% of guns and bombs in recent airport security “red team” tests was justifiably shocking. It’s clear that we’re not getting value for the $7 billion we’re paying the TSA annually. But there’s another conclusion, inescapable and disturbing to…
8099
Secure Boot in the Era of the T2
Explore the Duo Blog for expert tips, security insights, and resources to stay updated on the latest in security and access management trends.
8100
You don't need to burn off your fingertips (and other biometric myths)
111 years ago almost to the day, a murder was committed which ultimately led to the first criminal trial to use fingerprints as evidence [https://www.smithsonianmag.com/history/first-case-where-fingerprints-were-used-evidence-180970883/] . We've all since watched enough crime shows to understand that fingerprints are