3181
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,335 posts.
3182
Can I Be Trusted?
Slashdot asks the question: I’m a big fan of Bruce Schneier, but just to play devil’s advocate, let’s say, hypothetically, that Schneier is actually in cahoots with the NSA. Who better to reinstate public trust in weakened cryptosystems? As an exercise in security that Schneier himself may find interesting, what…
3183
HTTP cookies, or how not to design protocols
For as long as I remember, HTTP cookies have been vilified as a grave threat to the privacy of online browsing. I don't quite agree, but I f...
3184
Edge Case Poisoning (2020)
TLA+ Workshop Last Call The TLA+ workshop is next week! Oct 20-22, register here, use the code COMPUTRONSTUFF for $500 off. Learn how a few hours of...
3185
Fully Homomorphic Encryption: Secret Key Homomorphic Encryption Over Integers
In the previous post we discussed homomorphic encryption in it’s most abstract terms we presented Paillier as a partially homomorphic encryption . Thank you @mortendahlcs for making a clarification about the terms described :
3186
3187
OpenBSD's Pledge and Unveil from Python
Years ago, OpenBSD gained two new security system calls, pledge(2) (originally tame(2) ) and unveil . In both, an application surrenders capabilities at run-time. The idea is to perform initialization like usual, then drop capabilities before handling untrusted input, limiting unwanted side effects. This feature is…
3188
Setting up a trusted, self-signed SSL/TLS certificate authority in Linux
With OpenSSL, it’s pretty easy to generate a simple self-signed TLS certificate . Just run the following command:
3189
Widespread XSS Vulnerabilities in Ad Network Code
For most of us, the title of this post may not be very surprising. Any time we allow 3rd party scripts to run on our sites, we effectively relinquish control of the code that executes on the client. This is particularly important when integrating ad network scripts since they are inherently more dynamic than most…
3190
ELF files on Linux
An step-by-step introduction into ELF files. Learn the structure and format, to understand how binaries and libraries on Linux systems work.
3191
Lorem Ipsum: Of Good and Evil, Google and China
Imagine discovering a secret language spoken only online by a knowledgeable and learned few. Over a period of weeks, as you begin to tease out the meaning of this curious tongue and ponder its purpose, the language appears to shift in subtle but fantastic ways, remaking itself daily before your eyes. And just when you…
3192
Trinity: PSP Emulator Escape
Trinity is a fully chained exploit for the PS Vita™ consisting of six unique vulnerabilities. It is based on a decade of knowledge and research. The source code of Trinity can be found here.
3193
An interactive intro to Elliptic Curve Cryptography
A hands-on introduction to elliptic curve cryptography. Start with curve geometry, build point addition and scalar multiplication, see why ECDLP is hard, and then use that math in ECDH, ECDSA, and ECIES.
3194
How I accidentally took down GitHub Actions (2019)
Last December, I was invited to a private bug bounty program to test a beta version of GitHub Actions. GitHub Actions is a workflow automation tool integrated with GitHub. One common use case of GitHub Actions is for CI builds – a project can fairly easily start up a Docker container every time they push a commit…
3195
How memory safety CVEs differ between Rust and C/C++
CVE is a database used for categorizing and reporting security vulnerabilities in software. There are various kinds of vulnerabilities that can be reported. Some of them are caused simply by bugs in the program logic (like a recent CVE reported in Cargo), but some of the most nasty ones are caused by memory unsafety…
3196
Convincing ChatGPT to Eradicate Humanity with Python Code
Full stack software engineer / entrepreneur specialized in AI agents, cybersecurity and graphics. In my free time I enjoy surfing, free diving, and contributing to open source software.
3197
3198
The mysterious case of missing URLs and Google's AMP
When I saw a speculative article about Google wanting to “kill” URLs appear in my news feed, I didn’t think too much about it. Trying to hide “ugly” URLs… well, that feels like a natural thing for an app to try and do. Designers of apps often (erroneously) assume that users cannot cope with “technical” things like…
3199
CloudFlare, SSL and unhealthy security absolutism
Let's start with a quick quiz: Take a look at haveibeenpwned.com [https://haveibeenpwned.com/] (HIBP) and tell me where the traffic is encrypted between: You see HTTPS which is good so you know it's doing crypto things in your browser, but where's the other end of
3200
3201
Obscurity Is a Valid Security Layer
Good Obscurity vs. Bad Obscurity Camouflage OPSEC An SSH Example Reducing Impact or Probability Summary Many of us are familiar with a concept know as Security
3202
Anonymous Tor Phone
I was always curious about all that bad guys (criminals, drug dealers, hitman’s, thief’s etc.) using not very good and secure communication channels. Forgetting about whole OPSEC stuff. There is a lo
3203
3204
Advanced Denanonymization through Strava
Strava is getting some bad press, because its heatmap can be used to infer the existence and floorplan of various US/UK military and govt...
3205
Safe Native Code
Joe Duffy's Blog | Adventures in the high-tech underbelly
3206
3207
AES-GCM and breaking it on nonce reuse
In this post, we will look at how the security of the AES-GCM mode of operation can be completely compromised when a nonce is reused.
3208
Abusing url handling in iTerm2 and Hyper for code execution
What are escape sequences
3209
The State of Linux Security
This is the state of Linux security. With the most important updates around Linux and open source security. From conferences to self-protection.
3210
Tarsnap email confirmation bypass
One consequence of these unsolicited security scans is that — since they feed a variety of inputs to forms, including the account creation form — I see a lot of obviously fake signup attempts (alas, none yet from the world's most obviously fake domain name ). These are harmless, since the signup code sends out a…