3901
PyPI Requires 2FA for New User Registrations
PyPI requires new users to enable 2FA before performing management actions.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,441 posts.
3902
Mozilla patches two use-after-free vulnerabilities (ab)used in the wild
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw.
3903
Github: Token authentication requirements for Git operations
Beginning August 13th, 2021, we will no longer accept account passwords when authenticating Git operations on GitHub.com.
3904
3905
Dear Mr. Vice President, Please Take Off Your Apple Watch
An Open Letter To JD Vance From A Former CIA Officer On The Counterintelligence Risks Of Smartwatches Mr. Vice President, Congratulations on your ascendancy to the Vice President of the United States of America. While we are an apolitical platform, we wish you nothing but success, the country depends on you. In a rec
3906
3907
Command execution on Ansible controller from host
Onafhankelijk cybersecuritybedrijf in Nederland en Spanje. Pentest, MDR, NIS2-advies, incident response en CISO as a Service. Meer dan 20 jaar ervaring, 100+ security experts.
3908
A Quick Look at QUIC Censorship
An introduction to QUIC and its potential for censorship resistance, as well as a survey of current QUIC blocking in China, India, Russia and Uganda.
3909
A 32-year-old bug walks into a Telnet server
A long, long time ago, in a land free of binary exploit mitigations, when Unix still roamed the Earth, there lived a pre-authentication Telnetd vulnerability. In fact, this vulnerability was born so long ago (way back in 1994) that it may even be older than you. To put the
3910
Google Chrome U2F API decommission: What the change means
Understand Chrome's deprecation of U2F API and its effects, while exploring how to migrate to the WebAuthn API for continued YubiKey support.
3911
About KeePassXC's Code Quality Control
KeePassXC Password Manager
3912
Extracting Bitlocker Keys from a TPM
Extracting BitLocker keys sealed with a TPM by sniffing the LPC bus
3913
How to talk to your parents about hardware memory safety
Some conversations are difficult to have with members of older generations who grew up with different social norms. In particular, when you’re talking to people who grew up with PDP-11s with their completely flat memory, or Lisp machines or Burroughs Large Systems with their deeply opinionated and language-integrated…
3914
U.S. Government Threatens Free Speech With Calls for Twitter Censorship
“[T]he ultimate good desired is better reached by free trade in ideas....That at any rate is the theory of our Constitution.” — Justice Oliver Wendell Holmes, dissent in Abrams v. United States, 1919EFF has witnessed a growing number of calls in recent weeks for Twitter to ban certain...
3915
Exploiting zero days in abandoned hardware
We successfully exploited two discontinued network devices at DistrictCon’s inaugural Junkyard competition in February, winning runner-up for Most Innovative Exploitation Technique. Our exploit chains demonstrate why end-of-life hardware poses persistent security risks.
3916
Smashing the state machine: the true potential of web race conditions
For too long, web race condition attacks have focused on a tiny handful of scenarios. Their true potential has been masked thanks to tricky workflows, missing tooling, and simple network jitter hiding
3917
Reversing the AMD Secure Processor (PSP) – Part 2: Cryptographic Co-Processor
Part one: https://dayzerosec.com/blog/2023/04/17/reversing-the-amd-secure-processor-psp.html This is a follow-up part 2 to my previous post on the AMD Secure Processor (formerly known as the Platform Security Processor or "PSP"). In that post, I mentioned that the Cryptographic Co-Processor (CCP) is an essential…
3918
Teleport 1.3 adds support for SSH authentication with U2F keys
We are excited to announce that Teleport now supports Universal 2nd Factor out of the box.
3919
Bypass PayPal's Two-Factor Authentication
Explore the Duo Blog for expert tips, security insights, and resources to stay updated on the latest in security and access management trends.
3920
3921
Reverse Shell from an OpenVPN Configuration File
While doing background research on OpenVPN I stumbled upon an interesting question on Stack Exchange.
3922
3923
Millions of Binaries Later: A Look into Linux Hardening in the Wild
With Sophos Cloud Native Security, you can easily integrate protection across multiple environments while minimizing detection time and response.
3924
Enigma Crypto Transmission from KPH at 426 KHz and Shortwave
DA was a part of our KPH project from the beginning. She learned her trade at US Coast Guard master station NMC, adjacent to KPH. At NMC she earned the coveted gold lightning bolt radnoman’s insignia (there was no such thing as a radiowoman in the Coast Guard). She also acquired the salty vocabulary she needed to hold…
3925
3926
The rise of multivector DDoS attacks
It's been a while since we last wrote about Layer 3/4 DDoS attacks on this blog. This is a good news - we've been quietly handling the daily onslaught of DDoS attacks. Since our last write-up, a handful of interesting L3/4 attacks have happened. Let's review them.
3927
Supporters of Mexico’s Soda Tax Targeted with NSO Exploit Links (2017)
An investigation revealing that Mexican soda tax supporters were targeted with NSO Group's government-exclusive spyware and exploit framework.
3928
Pegasus vs. Predator
Two Egyptians—exiled politician Ayman Nour and the host of a popular news program (who wishes to remain anonymous)—were hacked with Predator spyware, built and sold by the previously little-known mercenary spyware developer Cytrox. The phone of Ayman Nour was simultaneously infected with both Cytrox’s Predator and NSO…
3929
Sq, Sequoia PGP's CLI, Released
Sequoia is a modular OpenPGP implementation in Rust.
3930
AI Meets Cryptography 1: What AI Found in Cloudflare's Circl
We pointed our AI audit pipeline at Cloudflare's CIRCL experimental cryptography library and confirmed seven real bugs, from a critical float64 precision loss in threshold RSA to a complete access-control break in attribute-based encryption. All seven are now fixed upstream. This is the first post in a series on bugs…