2551
Bash 'shellshock' bug is wormable
Early results from my scan: there's about 3000 systems vulnerable just on port 80, just on the root "/" URL, without Host field. That doesn'...
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,769 posts.
2552
TSA Master Keys
Someone recently noticed a Washington Post story on the TSA that originally contained a detailed photograph of all the TSA master keys. It’s now blurred out of the Washington Post story, but the image is still floating around the Internet. The whole thing neatly illustrates one of the main problems with backdoors…
2553
A new bill takes aim at government pressure to silence lawful online speech
The bipartisan legislation creates a federal cause of action against government officials who coerce or attempt to coerce broadcasters, interactive computer services, or AI providers into taking actions against lawful, First-Amendment-protected speech, and establishes a transparency system for government…
2554
Kids Online Safety Act is still a danger to our rights online
Are you a young person fighting back against bad bills like KOSA? Become an EFF member at a new, discounted Neon membership level specifically for you--stickers included! Congress has resurrected the Kids Online Safety Act (KOSA), a bill that would increase surveillance and restrict access to...
2555
Zeroing buffers is insufficient
With a bit of care and a cooperative compiler, we can zero a buffer — but that's not what we need. What we need to do is zero every location where sensitive data might be stored. Remember, the whole reason we had sensitive information in memory in the first place was so that we could use it; and that usage almost…
2556
Against privacy defeatism: why browsers can still stop fingerprinting
In this post I’ll discuss how a landmark piece of privacy research was widely misinterpreted, how this misinterpretation deterred the development of privacy technologies rather than spurring it, how a recent paper set the record straight, and what we can learn from all this. The research in question is about browser…
2557
Making an SSH client the hard way
Explore Tailscale SSH Console, a web-based SSH client that simplifies connecting to your devices. Learn how Tailscale integrates WebAssembly, WireGuard, and SSH for secure, password-free access right from your browser."
2558
How the TPP Will Affect You and Your Digital Rights (2015)
The Internet is a diverse ecosystem of private and public stakeholders. By excluding a large sector of communities—like security researchers, artists, libraries, and user rights groups—trade negotiators skewed the priorities of the Trans-Pacific Partnership (TPP) towards major tech companies and...
2559
How we hacked Facebook with OAuth2 and Chrome bugs
TL;DR We (me and @isciurus ) chained several different bugs in Facebook, OAuth2 and Google Chrome to craft an interesting exploit. Mallory...
2560
Meta prohibited from using personal data for advertisement
After almost five years, the Irish DPC decided on a noyb complaint and required Facebook, Instagram and WhatsApp to stop using the personal data of users for advertisement in the EU.
2561
Why don’t we do email verification in reverse?
Just about everybody who has ever used a service on the web has experienced the following account creation follow:
2562
The Linux Backdoor Attempt of 2003 (2013)
Josh wrote recently about a serious security bug that appeared in Debian Linux back in 2006, and whether it was really a backdoor inserted by the NSA. (He concluded that it probably was not.) Today I want to write about another incident, in 2003, in which someone tried to backdoor the Linux kernel. This one […]
2563
2564
How to Store an SSH Key on a Yubikey
Xe Iaso's personal website.
2565
2566
Switching from 1Password to Bitwarden
I've been using an OpenBSD laptop as my workstation a lot more lately, probably because most of my hardware just works now and I don't have to think too much about it. The touchpad works when I touch it, I can be confident that when I close the lid, the laptop will fully suspend and then fully resume again when I open…
2567
A day in the life of a prolific voice phishing crew
Besieged by scammers seeking to phish user accounts over the telephone, Apple and Google frequently caution that they will never reach out unbidden to users this way. However, new details about the internal operations of a prolific voice phishing gang show the group routinely abuses legitimate services at Apple and…
2568
Code scanning for security vulnerabilities now available
Now available, code scanning is a developer-first, GitHub-native approach to easily find security vulnerabilities before they reach production.
2569
Victory at the High Court against the government’s use of 'general warrants’
Today, the UK High Court has quashed a decision by the Investigatory Powers Tribunal (IPT), and ruled that section 5 of the Intelligence Services Act (ISA) 1994 does not permit the issuing of general warrants to authorise property interference and certain forms of computer hacking.
2570
The government uses targeted advertising to track your location
The online advertising industry has built a massive surveillance machine, and the government can co-opt it to spy on us.
2571
How cops can get your private online data
Can the cops get your online data? In short, yes. There are a variety of US federal and state laws which give law enforcement powers to obtain information that you provided to online services. But, there are steps you as a user and/or as a service provider can take to improve online privacy.Law...
2572
2573
Don’t try to sanitize input – escape output
Why you should escape output correctly, but generally not sanitize user input.
2574
Omarchy development practices lead to predictable security issues
First, a PSA: Do NOT use Omarchy if you care about security of your machine even a little bit. You can't polish a turd Omarchy 4.0 shipped with a collec...
2575
Your online identity is owned by your email provider (2019)
Your email provider owns your online identity by controlling your email address. You can’t port your email address to another provider as with phone numbers.
2576
OAuth Has Ruined Everything
Save time building sleek web, mobile and desktop apps with professional .NET UI Components, JavaScript UI Libraries, Reporting and Automated Testing solutions.
2577
LG Smart TVs log USB filenames and viewing info to LG servers
Earlier this month I discovered that my new LG Smart TV was displaying ads on the Smart landing screen. After some investigation, I f...
2578
Fastmail accounts blocked in Russia, here's what we know
Fastmail is the latest email provider to be blocked by Russia.
2579
2580
SystemD Service Hardening
Discover additional security options for systemd units, to include quadlets. These options are everything from system permissions, time manage, BPF, syscall & seccomp filters, etc., all to make your system more secure.