8671
CrowdStrike’s work with the Democratic National Committee: Setting the record straight
Get the key facts about CrowdStrike's work with the Democratic Natiional Committee in 2016 and debunk the false claims that have been made about our work.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,774 posts.
8672
Changes to Trusted Certificate Authorities in Android Nougat
News and insights on the Android platform, developer tools, and events.
8673
NIST is No Longer Recommending Two-Factor Authentication Using SMS
NIST is no longer recommending two-factor authentication systems that use SMS, because of their many insecurities. In the latest draft of its Digital Authentication Guideline, there’s the line: [Out of band verification] using SMS is deprecated, and will no longer be allowed in future releases of this guidance.
8674
SSL added and removed here ;-)
This post is part of our ongoing series about networks, privacy, governments and (of course) online security tools like Cloak. Last week, the Washington Post unleashed yet another bombshell revelation from the Snowden documents.
8675
Google: Security Keys Neutralized Employee Phishing
Google has not had any of its 85,000+ employees successfully phished on their work-related accounts since early 2017, when it began requiring all employees to use physical Security Keys in place of passwords and one-time codes, the company told KrebsOnSecurity.
8676
PHP2Shell by Calif Research
A tale of two PHP remote vulnerabilities
8677
Errata: Steve Gibson
a summary of Steven Gibson events and quotes demonstrating charlatan status
8678
How Plex is doing HTTPS for all its users
This week Plex , a self-hosted media server, announced that they now offer TLS to secure all connections, including those to the user’s servers. This is actually pretty interesting.
8679
A new layer of security for certified Android devices
Starting in 2026 and in select countries first, Android apps must be registered to a verified developer in order to be installed.
8680
Cloudflare supports Privacy Pass
Cloudflare supports Privacy Pass, a recently-announced privacy-preserving protocol developed in collaboration with researchers from Royal Holloway and the University of Waterloo.
8681
sean cassidy : Don't Pipe to your Shell
It's everywhere . Sometimes they tell you to ignore certificates as well (looking at you, Salt). That's dumb.
8682
LavaRand in Production: The Nitty-Gritty Technical Details
As some of you may know, there's a wall of lava lamps in the lobby of our San Francisco office that we use for cryptography. In this post, we’re going to explore how that works in technical detail.
8683
The Linux Kernel, CDDL and Related Issues
The Software Freedom Law Center provides legal representation and other law related services to protect and advance Free and Open Source Software.
8684
Banking Applications Compatibility with GrapheneOS
Maintained Compatibility List for International Banking Apps This list includes banking apps that have been tested, submitted, reviewed, and verified as compatible. LIST | SUBMIT | UPDATE | POSSIBLE WORKAROUND SOLUTIONS Introduction Welcome to the crowd-sourced dataset for GrapheneOS users on currently supported…
8685
Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers
Team82 researched the attack surface of the Danfoss AK-SM 800A refrigeration controller platform and identified multiple vulnerabilities affecting the embedded web management interface. Team82 disclosed the vulnerabilities to Danfoss, which addressed them in a new firmware version. Successful exploits of the…
8686
SHA-1 Broken
SHA-1 has been broken. Not a reduced-round version. Not a simplified version. The real thing. The research team of Xiaoyun Wang, Yiqun Lisa Yin, and Hongbo Yu (mostly from Shandong University in China) have been quietly circulating a paper describing their results: collisions in the the full SHA-1 in 2**69 hash…
8687
What’s the matter with PGP?
Last Thursday, Yahoo announced their plans to support end-to-end encryption using a fork of Google’s end-to-end email extension. This is a Big Deal. With providers like Google and Yahoo onboa…
8688
Randomness 101: LavaRand in Production
As some of you may know, there's a wall of lava lamps in the lobby of our San Francisco office that we use for cryptography. In this post, we’re going to explore how that works.
8689
Is curl|bash insecure?
Take control of your web by running your own personal cloud server with Sandstorm.
8690
iCloud Private Relay: What Cloudflare Customers Need to Know
iCloud Private Relay is an Apple service for browsing more privately and securely. Learn how to ensure the best user experience using iCloud Private Relay.
8691
Android | Madaidan's Insecurities
By default, Android has a strong security model and incorporates full system SELinux policies , strong app sandboxing , full verified boot , modern exploit mitigations like fine-grained, forward-edge Control Flow Integrity and ShadowCallStack , widespread use of memory-safe languages (Java / Kotlin) and more. As such…
8692
Warrant Canary Frequently Asked Questions
What is a warrant canary? A warrant canary is a colloquial term for a regularly published statement that a service provider has not received legal process that it would be prohibited from saying it had received. Once a service provider does receive legal process, the speech prohibition goes into...
8693
Comcast caught hijacking web traffic
On November 20th, 2012 Comcast hijacked my HTTP traffic and re-routed it through their own servers, injecting a “notice” on the page before completing the request. What this means is instead of my web request being routed to the website I wanted to visit, Comcast took it upon themselves to hijack my web…
8694
Qwest CEO: NSA Punished Qwest for Refusing to Participate in Illegal Surveillance--Pre-9/11!
When Qwest refused the NSA’s illegal request that it hand over its customers’ data without a warrant, the NSA wasn’t happy. According to former Qwest CEO Joseph Nacchio, the government hit back for the telecom’s refusal by denying them lucrative contracts (log-in required) worth hundreds of...
8695
Yubico proposes WebAuthn protocol extension to simplify backup security keys
Yubico proposes a new WebAuthn extension to the World Wide Web Consortium (W3C) to add a user-friendly solution for backup security keys, and receives cryptographic proof from researchers at the Surrey Center for Cyber Security.
8696
WhatsApp's Signal Protocol integration is now complete
At Open Whisper Systems, our goal is to make private communication simple. A year ago, we announced a partnership with WhatsApp and committed to integrating the Signal Protocol into their product, moving towards full end-to-end encryption for all of their users by default. Over the past year, we...
8697
Private Access Tokens: eliminating CAPTCHAs on iPhones and Macs with open standards
Today we’re announcing Private Access Tokens, a completely invisible, private way to validate that real users are visiting your site
8698
Redirect to sslh
My homepage for projects, jokes and bunnies.
8699
How To Safely Generate A Random Number
Use urandom. That is the whole answer. Why the entropy-depletion story is a myth, and why userspace CSPRNGs are behind most of the last decade's randomness disasters.
8700
A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution
Posted by Ian Beer & Samuel Groß of Google Project Zero We want to thank Citizen Lab ...