3421
Siri, Privacy, and Trust
We should expect Apple to lead the industry on this front, but in fact, they’re far behind.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,335 posts.
3422
Inverting PhotoDNA
Ribosome inverts Microsoft PhotoDNA hashes using machine learning.
3423
Constructing the Word's First JPEG XL MD5 Hash Quine
A walk through of building an image that displays its own MD5 Hash
3424
3425
Chat Control 2.0: EU set to approve end of private messaging, secure encryption
By making a minor concession EU governments hope to find a majority next week to approve the controversial „chat control“ bill. According to the proposed child sexual abuse regulation (CSAR), providers of messengers, e-mail and chat services would be forced to automatically search all private messag
3426
Mastercard Internet Gateway Service: Hashing Design Flaw
Last year I found a design error in the MD5 version of the hashing method used by Mastercard Internet Gateway Service. The flaw allows modification of transaction amount. They have awarded me with a bounty for reporting it. This year, they have switched to HMAC-SHA256, but this one also has a flaw
3427
Cryptic Crossword: Amateur Crypto and Reverse Engineering
Reverse engineering is a special subgenre of computer programming. It's about the closest that I as a programmer get to being a scientist. Gather data, formulate a hypothesis, test, refine, repeat: reverse engineering is basically applying the scientific method to a very, very small knowledge domain. If you've never…
3428
The target=“_blank” vulnerability by example
Instagram leaves its users open to a simple phishing attack
3429
Who Is Planting Backdoors in Ledger Crypto Wallets?
The theft last week of an estimated $100 million in crypto using a hardware backdoor planted in Ledger wallets points to a sophisticated and systematic attack aimed at subverting crypto wallets sold by legitimate resellers in Asia and Europe
3430
86% of CrashCrate subscribers used passwords already leaked in other breaches
A couple of months ago, I launched version 2 of Pwned Passwords [https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/]. This is a collection of over half a billion passwords which have previously appeared in data breaches and the intention is that they're used as a
3431
The browsers are probably running the TLS show now
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
3432
A 96 Bitcoin ransom payment ends up on Bitfinex
"Hello, to get your data back you have to pay for the decryption tool, the price is $1,200,000... You have to make the payment in Bitcoin...
3433
3434
Every C99.php shell is backdoored
A Hacker's Blog of Unintended Use and Insomnia.
3435
3436
Parse, Don’t Validate – Some C Safety Tips
“A good programmer is someone who looks both ways before crossing a one-way street.” – Doug Linder
3437
Apple’s New Ad Conversion Tracking Will Benefit User Privacy
Apple has released new developer APIs that will allow mobile advertising conversion tracking while protecting individual user privacy. The new APIs are part of the StoreKit framework and include a …
3438
UUIDs generally do not meet security requirements
Some time ago, I was doing a web application penetration test, and noticed that the authentication tokens were UUIDs. This I knew was risky, and in fact if you read the UUID rfc, section 6 of it wa…
3439
Frequent Password Changes Is a Bad Security Idea
I’ve been saying for years that it’s bad security advice, that it encourages poor passwords. Lorrie Cranor, now the FTC’s chief technologist, agrees: By studying the data, the researchers identified common techniques account holders used when they were required to change passwords. A password like “tarheels#1”, for…
3440
Protecting a Laptop from Simple and Sophisticated Attacks
How I secured a ThinkPad: a Windows honeypot with Prey for thieves, TRESOR against cold boot, a USB boot stick for evil maids, and a separate Firefox user.
3441
Understanding the “GPL is a Contract” court case
There's been a lot of confusion about the recent Artifex v. Hancom case, in which the court found that the GPL was an enforceable contract. I'm going to try to explain the whole thing in clear terms for the legal layman.
3442
What I've Been Thinking About
I’m starting to think about my next book, which will be about power and the Internet—from the perspective of security. My objective will be to describe current trends, explain where those trends are leading us, and discuss alternatives for avoiding that outcome. Many of my recent essays have touched on various facets…
3443
3444
3445
3446
Playing with Kernel TLS in Linux 4.13 and Go
The 1600 LoC patch allows userspace to pass the kernel the encryption keys for an established connection, making encryption happen transparently inside the kernel.
3447
3448
3449
Passwords Are Fine
How we can be better at authentication security
3450
Nearly All U.S. Home Depot Stores Hit By Credit Card Theft
New data gathered from the cybercrime underground suggests that the apparent credit and debit card breach at Home Depot involves nearly all of the company’s stores across the nation.