Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,769 posts.
When you request a certificate from Let’s Encrypt, our servers validate that you control the hostnames in that certificate using ACME challenges. For subscribers who need wildcard certificates or who prefer not to expose infrastructure to the public Internet, the DNS-01 challenge type has long been the only choice…
Google Cloud offers our best practices to ensure you have a safe, scalable, usable account authentication system.
The BAIR Blog
How to keep secret credentials safe on the command line.
Update: Added clarification that only the Let’s Encrypt client software is changing its name and host. The Let’s Encrypt certificate authority and associated services are not changing names or relocating. Over the next few months the Let’s Encrypt client software will transition to a new name, soon to be announced…
This is the final installment of a three part series in which we dive into modern application authentication solutions - the hard way. Part One: The Hard Way Part Two: The Hard Way, Continued Part Three: The Hard Way: Return Of The Specification The Hard Way: Return Of The Specification We are continuing our quest to…
One of the most important tasks of the distribution packager is to ensure that the software shipped to our users is free of security vulnerabilities. While finding and fixing the vulnerable code is…
Another day, another high-profile website cloned to phish credentials. Tess Rinearson@_tessrIs this a phishing attempt? Goes to "githubverification.com" and asks for username and pw (if so, it nearly got me!) /cc @github pic.x.com/jgt4oNvjF2❤️ 2,243💬 111🔁 016:12 - Sat 16 January 2021 In the replies, you’ll see lots of…
Someone has been attempting to DDoS us for weeks now. They have flooded our server with hundreds of millions of requests and attempted to download our setup…
The activity we have observed has been attributed to a threat group that Microsoft tracks as DEV-0537, also known as LAPSUS$. DEV-0537 is known for using a pure extortion and destruction model without deploying ransomware payloads.
Let’s Encrypt is committed to a post-quantum-safe Web PKI. The path we’re planning to take is Merkle Tree Certificates (“MTCs”), a new approach that adds post-quantum authentication to the web without sacrificing the speed and reliability that have made TLS universal. This post is about these plans and why we believe…
Key findings Proofpoint has observed an increase in malware delivery via TryCloudflare Tunnel abuse. The activity is financially motivated and delivers exclusively remote
Scammers are using invoices sent through PayPal.com to trick recipients into calling a number to dispute a pending charge. The missives — which come from Paypal.com and include a link at Paypal.com that displays an invoice for the supposed transaction — state that the user’s account is about to be charged hundreds of…
The actual queries I run when I'm hunting fraud in transaction data. Velocity, impossible distances, suspicious amounts, merchant clusters, off-hours buys, and window functions.
Back in June, when the contents of Edward Snowden’s cache of NSA documents were just starting to be revealed and we learned about the NSA collecting phone metadata of every American, many people—including President Obama—discounted the seriousness of the NSA’s actions by saying that it’s just metadata. Lots and lots…
Today I'm disclosing a macOS privacy protections bypass. I discovered that an application can use the venerable Unix command-line tool "ls" (list directory contents) to bypass both TCC (Transparency, Consent, and Control) and the sandbox, enabling unauthorized access to file metadata in directories that are supposed…
After toiling with Cross-Site Request Forgery on the web for, well forever really, we finally have a proper solution, it's Same-Site Cookies.
Thursday, September 22nd 2016. An email popped up in my inbox. Subject: ares_create_query OOB write As one of the maintainers of the c-ares project I'm receiving mails for suspected security problems in c-ares and this was such a one. In this case, the email with said subject came from an individual who had reported a…
Xe Iaso's personal website.
The U.S. Department of Justice (DOJ) said today it seized the website and user database for RaidForums , an extremely popular English-language cybercrime forum that sold access to more than 10 billion consumer records stolen in some of the world’s largest data breaches since 2015. The DOJ also charged the alleged…
Update (Oct 22 13:15 UTC): Windows users that are affected by Tor Browser crashes might try to...
Personal Blog of Christian Haschek
