1
Why I’m done with Chrome
This blog is mainly reserved for cryptography, and I try to avoid filling it with random “someone is wrong on the Internet” posts. After all, that’s what Twitter is for! But from …
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 556 posts.
2
Reading privileged memory with a side-channel
Posted by Jann Horn, Project ZeroWe have discovered that CPU data cache timing can be abused to e...
3
1.1.1.1: Fast, privacy-first consumer DNS service
Cloudflare's mission is to help build a better Internet. We're excited today to take another step toward that mission with the launch of 1.1.1.1 — the Internet's fastest, privacy-first consumer DNS service. This post will talk a little about what that is and a lot about why we decided to do it.
4
Why Raspberry Pi Isn't Vulnerable to Spectre or Meltdown
Eben gives you a crash course in how modern processors work to explain why Raspberry Pi is unaffected by the Spectre and Meltdown security vulnerabilities.
5
Let's Encrypt Root Trusted by All Major Root Programs
As of the end of July 2018, the Let’s Encrypt root, ISRG Root X1, is directly trusted by Microsoft products. Our root is now trusted by all major root programs, including Microsoft, Google, Apple, Mozilla, Oracle, and Blackberry. Today’s announcement that we’re trusted by all major root programs represents a major…
6
Intel Publishes Microcode Patches, No Benchmarking or Comparison Allowed
UPDATE: Intel has resolved their microcode licensing issue which I complained about in this blog post. The new license text is here .
7
8
9
Amazon threatens to suspend Signal's AWS account over censorship circumvention
Last week, we received the following email from Amazon: From: [redacted], [redacted] <[redacted]@amazon.com> Subject: Notification of potential account suspension regarding AWS Service Terms Moxie, Yesterday AWS became aware of your GitHub and Hacker News/ycombinator posts des...
10
LocationSmart Leaked Location Data for All Major U.S. Carriers in Real Time
On May 16th, I found a vulnerability in the LocationSmart website which allowed anyone, with no prior authentication or consent, to obtain the realtime location of any cellphone in the US to within…
11
Hijack of Amazon’s domain service used to reroute web traffic for two hours
Between 11am until 1pm UTC today, DNS traffic — the phone book of the internet, routing you to your favourite websites — was hijacked by an…
12
The dots do matter: how to scam a Gmail user
Gmail's "dots don't matter" feature lets scammers create an account on, say, Netflix, with your email address but different dots. Results in convincing phishing emails.
13
14
Why Do Keynote Speakers Keep Suggesting That Improving Security Is Possible?
Some people enter the technology industry to build newer, more exciting kinds of technology as quickly as possible. My keynote will savage these people and will burn important professional bridges, likely forcing me to join a monastery or another penance-focused organization. In my keynote, I will explain why the…
15
Facial recognition: It’s time for action
In July, we shared our views about the need for government regulation and responsible industry measures to address advancing facial recognition technology. As we discussed, this technology brings important and even exciting societal benefits but also the potential for abuse. We noted the need for broader study and…
16
Remote Code Execution on a Facebook server
I regularly search for vulnerabilities on big services that allow it and have a Bug Bounty program. Here is my first paper which covers a vulnerability I discovered on one of Facebook’s servers.
17
GDPR: Don't Panic
In another week the GDPR , or the General Data Protection Regulation will become enforceable and it appears that unlike any other law to date this particular one has the interesting side effect of causing mass hysteria in the otherwise rational tech sector.
18
Changing Our Approach to Anti-Tracking
In the near future, Firefox will -- by default -- protect users by blocking tracking while also offering a clear set of controls to give our users more choice over what information they share with sites.
19
Facebook Container Extension: Take control of how you’re being tracked
Our Multi-Account Containers extension has been a game changer for many users, letting them manage various parts of their online life without intermingling
20
"Pwned Passwords" V2 With Half a Billion Passwords
Last August, I launched a little feature within Have I Been Pwned [https://haveibeenpwned.com/] (HIBP) I called Pwned Passwords [https://www.troyhunt.com/introducing-306-million-freely-downloadable-pwned-passwords/]. This was a list of 320 million passwords from a range of different data breaches which organisations…
21
Chrome 68 will mark all HTTP sites as “not secure”
Posted by Emily Schechter, Chrome Security Product Manager For the past several years, we’ve moved toward a more secure web by strongly adv...
22
Signal partners with Microsoft to bring end-to-end encryption to Skype
In collaboration with Signal, Microsoft is introducing a Private Conversations feature in Skype, powered by Signal Protocol.
23
Firefox 59 to strip path information from referrer values for 3rd parties
Starting in version 59, Firefox Private Browsing will remove path data from Referrers sent to third parties. This will help prevent accidentally leaking data to third parties.
24
Google: Security Keys Neutralized Employee Phishing
Google has not had any of its 85,000+ employees successfully phished on their work-related accounts since early 2017, when it began requiring all employees to use physical Security Keys in place of passwords and one-time codes, the company told KrebsOnSecurity.
25
How I recorded user behaviour on my competitor’s websites
A test that hijacked the Chrome back button to send visitors to a fake Google results page, then to mirrored competitor pages where heatmaps, sessions and typing were recorded. Google de-indexed the whole domain.
26
GDPR for lazy people: Block all European users with Cloudflare Workers
Xoilac TV là website chuyên phát sóng trực tiếp các trận bóng đá nổi tiếng với đội ngũ bình luận viên tiếng Việt hoàn toàn miễn phí. Tại đây, người xem có thể
27
28
DuckDuckGo moves beyond search to also protect you while browsing
We're excited to launch a new browser extension and mobile app, extending DuckDuckGo's protection beyond the search box to wherever the Internet takes you.
29
30