8341
The Apple goto fail vulnerability: lessons learned (2014)
Description of what we have learned
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,773 posts.
8342
Adobe credentials and the serious insecurity of password hints
Adobe had a little issue the other day with the small matter of 150 million accounts being breached and released to the public. Whoops. So what are we talking about? A shed load of records containing an internal ID, username, email, encrypted password and a password hint. Naked Security did
8343
8344
8345
Dismantling a Crappy Malware Operation
Dismantling a Shoddy Malware Operation The Discovery I had been made aware of a malware spreading site called obspremium.com. This site is claiming to offer a so-called “premium” version of the popular open source recording and streaming program Open Broadcaster Software at obsproject.com. “OBS Premium” hosts a direct…
8346
8347
Insecure by design: protocols for encrypted phone calls
The MIKEY-SAKKE protocol is being promoted by the UK government as a better way to secure phone calls. The reality is that MIKEY-SAKKE is designed to offer minimal security while allowing undetectable mass surveillance, through the introduction a backdoor based around mandatory key-escrow. This weakness has…
8348
Entropy Attacks
The conventional wisdom is that hashing more entropy sources can't hurt: if H is any modern cryptographic hash function then H(x,y,z) is at least as good a random number as H(x,y), no matter how awful z is. So we pile one source on top of another, hashing them all together and hoping that at least one of them is good.
8349
Cameras built to police Iranians became the regime's Achilles' heel
On the irony of cameras built to police Iranians becoming the regime’s Achilles’ heel
8350
The Snowden Principle
At the heart of Edward Snowden's decision to expose the NSA's massive phone and Internet spying programs was a fundamental belief in the people's right-to-know. "My sole motive is to inform the public as to that which is done in their name and that which is done against them," he …
8351
Huawei HKSP Introduces Trivially Exploitable Vulnerability in the Linux Kernel
Huawei has seemingly stepped its foot into the kernel self-protection game with the release of HKSP. Absent any threat model and riddled with weaknesses, it also introduces a trivially exploitable local root vulnerability due to a complete lack of defensive programming.
8352
Homoglyph attacks: How to create an internet hoax
For decades, social psychologists have understood that the link between attitudes and conduct is convoluted, if not weak. Both online and offline, this is
8353
Temporarily rolling back SameSite Cookie Changes
UPDATE 5/28: We are going to resume the rollout with the stable release of Chrome M84. More details . With the stable release of Chrome 8...
8354
How to add Two-Factor Authentication to your website with Google Authenticator
Add Two-Factor Authentication To Your Website with Google Authenticator and Twilio SMS
8355
PingFS
shysecurity blog
8356
A call to arms: Helping Internet services accept anonymous users
Looking for a way to help the Internet stay open and free? This topic needs some dedicated...
8357
8358
Obfuscated JavaScript, scam emails, and American Express
Reverse-engineering an obfuscated American Express phishing campaign from email to exfiltration endpoint.
8359
8360
How Safe Browsing Works in Firefox
Firefox has had support for Google's Safe Browsing since 2005 when it started as a stand-alone Firefox extension . At first it was only available in the USA, but it was opened up to the rest of the world in 2006 and moved to the Google Toolbar . It then got integrated directly into Firefox 2.0 before the public launch…
8361
The Inside Story Behind MS08-067
Access to this page requires authorization. You can try signing in or changing directories .
8362
Privilege escalation with polkit: How to get root on Linux with a seven-year-ol
polkit is a system service installed by default on many Linux distributions. It’s used by systemd, so any Linux distribution that uses systemd also uses polkit.
8363
EFF Sues for Court Orders Requiring Tech Cos to Decrypt Users’ Communications
San Francisco—The Electronic Frontier Foundation (EFF) filed a Freedom of Information (FOIA) lawsuit today against the Justice Department to shed light on whether the government has ever used secret court orders to force technology companies to decrypt their customers’ private communications, a...
8364
Security and Privacy Implications of Zoom
Over the past few weeks, Zoom’s use has exploded since it became the video conferencing platform of choice in today’s COVID-19 world. (My own university, Harvard, uses it for all of its classes. Boris Johnson had a cabinet meeting over Zoom.) Over that same period, the company has been exposed for having both lousy…
8365
Belgium Is Unsafe for CVD
This post is about the reason I will probably never try to warn any organisation in Belgium about any vulnerability again. Recently I have been dealing with an attempt at coordinated vulnerability disclosure (CVD) with an organisation in Belgium. This post is not about that, because I’m not allowed to write about it…
8366
8367
We built a resource hub to fight back against age verification
Age verification laws are proliferating fast across the United States and around the world, creating a dangerous and confusing tangle of rules about what we’re all allowed to see and do online. That's why today, we're launching EFF.org/Age, a one-stop shop for users seeking to understand what these laws actually do…
8368
8369
Implementing Open Source Container Security, Part 1: Runtime Security
Expert insight, best practices, and advice on Secure DevOps, security for containers, Kubernetes, and cloud services. Review Sysdig blog posts today!
8370
GPG and Me (2015)
I receive a fair amount of email from strangers. My email address is public, which doesn’t seemto be a popular choice these days, but I’ve received enough inspiring correspondence over the yearsto leave it be.When I receive a GPG encrypted email from a stranger, though, I immediately get the fee...