3841
Unprivileged Docker Builds – A Proof of Concept
I work at a very ‘locked-down’ enterprise, where direct access to Docker is effectively verboten.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,337 posts.
3842
A grim outlook on the future of browser add-ons
Mozilla limiting users’ choice to 9 add-ons on mobile is only the latest development. Add-on support is degrading across all browsers and will continue to do so.
3843
I’m sorry, but were you actually trying to remember your comical passwords?
I love a good XKCD comic; Randall Munroe has a unique way of cutting right to the crux of technology issues and always doing it in a humorous fashion. Little Bobby Tables [http://xkcd.com/327/] remains an all-time classic and it’s amazing how many times you’ll
3844
Audi Cruise Control Bug
I noticed a "bug" in the way Audi handles its Cruise Control options. Cruise control is only meant to be used once you drive "30 kilometers per hour or more". …
3845
Thoughts on the Systemd Root Exploit
Sebastian Krahmer of the SUSE Security Team has discovered a local root exploit in systemd v228 . A local user on a system running systemd v228 can escalate to root privileges. That's bad.
3846
Daring Fireball: Cookies and Privacy
What I detect in Google’s behavior (and John Battelle’s more-or-less defense of it) is a sense of entitlement. That because in the past ad networks could track almost all users via cookies, they are entitled to continue tracking almost all users across the web via cookies, even when a large (and growing) number of…
3847
TSA Sued Over New Policy to Refuse Opt-Outs
Last Friday, the TSA snuck out a document updating the “privacy policy” for the nude body scanners. On Tuesday, reports started coming in on the change, including right here. Professi…
3848
3849
A Really Good Article on How Easy it Is to Crack Passwords
Ars Technica gave three experts a 16,000-entry encrypted password file, and asked them to break them. The winner got 90% of them, the loser 62%—in a few hours. The list of “plains,” as many crackers refer to deciphered hashes, contains the usual list of commonly used passcodes that are found in virtually every breach…
3850
What Transport for London can learn about us from our mobile data
Big Brother meets Big Data
3851
Who can I hire to hack me?
I use a password manager. I have 2FA set up on everything. When an organisation asks me to set a recovery question, I generate a 32 character passphrase. I don't use my mother's maiden name or my first pet's birthday on anything sensitive. I monitor my email addresses for breaches, and I regularly check my credit…
3852
Your Supabase is public if you turn off RLS
I was chatting with a close friend of mine and he sent me a link to his new SaaS that he's developing.
3853
My university uses prompt injection to catch cheaters
Web developer and cybersecurity researcher
3854
USPS ‘Informed Delivery’ Is Stalker’s Dream
A free new service from the U.S. Postal Service that provides scanned images of incoming mail before it is slated to arrive at its destination address is raising eyebrows among security experts who worry about the service’s potential for misuse by private investigators, identity thieves, stalkers or abusive…
3855
Teensy weensy crypto
As the UK's politicians continue to fail to understand what "strong cryptography" or "banning" even mean, I thought I would have a look at how simple strong cryptography can be.
3856
A gentle introduction to static analyzers for C
One of the great thing about C are the many fairly mature tools in the ecosystem. The bad news however is that most educational materials don't teach them and thus many beginners (and sometimes even experienced) developers have absolutely no awareness that these tools even exists.
3857
3858
Escaping privileged containers for fun
Despite the fact that it is not a 'real' vulnerability, escaping privileged Docker containers is nevertheless pretty funny. And because there will always be people who will come up with reasons or excuses to run a privileged container (even though you really shouldn't), this could really be handy at some point in the…
3859
Microsoft Update Quietly Installs Firefox Extension
Breaking news, live coverage, investigations, analysis, video, photos and opinions from The Washington Post. Subscribe for the latest on U.S. and international news, politics, business, technology, climate change, health and wellness, sports, science, weather, lifestyle and more.
3860
3861
How Not to Redact a Warhead
How the wrong settings on a photocopier has let us have a glimpse at a forbidden image of a modern thermonuclear warhead.
3862
SQL Injection Isn't Dead: Smuggling Queries at the Protocol Level
PDF slides from a presentation by Paul Gerste at DEF CON 32. It turns out some databases have vulnerabilities in their binary protocols that can be exploited by carefully crafted …
3863
Exploiting a Go Binary
Earlier this year, tylerni7 showed us a proof of concept for a 32 bit Go exploit using this issue . geohot and I had a wager over who could get the first remote code execution on play.golang.org : he won, but just barely ;-). Props also to ricky for helping to find the underlying cause/writing the patch. Here is a…
3864
3865
RSA: Theory and Implementation
RSA has been a staple of public key cryptography for over 40 years, and is still being used today for some tasks in the newest TLS 1.3 standard. This post describes the theory behind RSA - the math that makes it work, as well as some practical considerations; it also presents a complete implementation of RSA key…
3866
3867
3868
That 16B password story (a.k.a. "data troll")
Spoiler: I have data from the story in the title of this post, it's mostly what I expected it to be, I've just added it to HIBP where I've called it "Data Troll", and I'm going to give everyone a lot more context below. Here goes:
3869
3870
Let's Not Encrypt (2019)
Let's Discuss the organization providing a false sense of security at an unbeatable price.