4291
New iPhone app piracy over week one.
If you know your way around a professional writers' room, you know how to use WritersRoom Pro ®
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,337 posts.
4292
4293
4294
Three vulnerabilities every web application developer should know about
Here's another great lecture from Google Tech Talks. This lecture is given by Neil Daswani, who has a Ph.D. from Stanford and currently works at Google as a security engineer. He is also an author of a book titled "Foundations of Security: What Every Programmer Needs to Know", which teaches you state-of-the-art...
4295
Virtual Mafia in Online Worlds
If you allow players in an online world to penalize each other, you open the door to extortion: One of the features that supported user socialization in the game was the ability to declare that another user was a trusted friend. The feature involved a graphical display that showed the faces of users who had declared…
4296
Schneier reviews: Here Comes Everybody
In 1937, Ronald Coase answered one of the most perplexing questions in economics: if markets are so great, why do organizations exist? Why don’t people just buy and sell their own services in a market instead? Coase, who won the 1991 Nobel Prize in Economics, answered the question by noting a market’s transaction…
4297
4298
Border Security: We can take your laptop anywhere we want for as long as we want
Amazing. The U.S. government has published its policy: they can take your laptop anywhere they want, for as long as they want, and share the information with anyone they want: Federal agents may take a traveler’s laptop or other electronic device to an off-site location for an unspecified period of time without any…
4299
Tarsnap public beta
Tarsnap's paranoia also extends to the client-server protocol. With most online backup services, you're lucky if they use SSL; I avoided using SSL because I wasn't satisfied with its security. Obtaining a fraudulent SSL certificate is too easy (read: possible) for an attacker, and relying on external certification…
4300
H(m || k) also insecure, you really should use HMAC
The HMAC construction turns a cryptographic hash algorithm into a keyed hash. It is commonly used for integrity protection when the sender and recipient share a secret key. It was developed to addr…
4301
4302
4303
Final post on Javascript crypto
The talk I gave last year on common crypto flaws still seems to generate comments. The majority of the discussion is by defenders of Javascript crypto. I made JS crypto a very minor part of the tal…
4304
Countering "Trusting Trust"
Way back in 1974, Paul Karger and Roger Schell discovered a devastating attack against computer systems. Ken Thompson described it in his classic 1984 speech, “Reflections on Trusting Trust.” Basically, an attacker changes a compiler binary to produce malicious versions of some programs, INCLUDING ITSELF. Once this is…
4305
NIST is No Longer Recommending Two-Factor Authentication Using SMS
NIST is no longer recommending two-factor authentication systems that use SMS, because of their many insecurities. In the latest draft of its Digital Authentication Guideline, there’s the line: [Out of band verification] using SMS is deprecated, and will no longer be allowed in future releases of this guidance.
4306
Google: Security Keys Neutralized Employee Phishing
Google has not had any of its 85,000+ employees successfully phished on their work-related accounts since early 2017, when it began requiring all employees to use physical Security Keys in place of passwords and one-time codes, the company told KrebsOnSecurity.
4307
How Plex is doing HTTPS for all its users
This week Plex , a self-hosted media server, announced that they now offer TLS to secure all connections, including those to the user’s servers. This is actually pretty interesting.
4308
sean cassidy : Don't Pipe to your Shell
It's everywhere . Sometimes they tell you to ignore certificates as well (looking at you, Salt). That's dumb.
4309
Banking Applications Compatibility with GrapheneOS
Maintained Compatibility List for International Banking Apps This list includes banking apps that have been tested, submitted, reviewed, and verified as compatible. LIST | SUBMIT | UPDATE | POSSIBLE WORKAROUND SOLUTIONS Introduction Welcome to the crowd-sourced dataset for GrapheneOS users on currently supported…
4310
SHA-1 Broken
SHA-1 has been broken. Not a reduced-round version. Not a simplified version. The real thing. The research team of Xiaoyun Wang, Yiqun Lisa Yin, and Hongbo Yu (mostly from Shandong University in China) have been quietly circulating a paper describing their results: collisions in the the full SHA-1 in 2**69 hash…
4311
What’s the matter with PGP?
Last Thursday, Yahoo announced their plans to support end-to-end encryption using a fork of Google’s end-to-end email extension. This is a Big Deal. With providers like Google and Yahoo onboa…
4312
Android | Madaidan's Insecurities
By default, Android has a strong security model and incorporates full system SELinux policies , strong app sandboxing , full verified boot , modern exploit mitigations like fine-grained, forward-edge Control Flow Integrity and ShadowCallStack , widespread use of memory-safe languages (Java / Kotlin) and more. As such…
4313
Comcast caught hijacking web traffic
On November 20th, 2012 Comcast hijacked my HTTP traffic and re-routed it through their own servers, injecting a “notice” on the page before completing the request. What this means is instead of my web request being routed to the website I wanted to visit, Comcast took it upon themselves to hijack my web…
4314
4315
How To Safely Generate A Random Number
Use urandom. That is the whole answer. Why the entropy-depletion story is a myth, and why userspace CSPRNGs are behind most of the last decade's randomness disasters.
4316
lloyd.io - How BrowserID Works
lloyd.io is the personal website of Lloyd Hilaiel, a software engineer who lives in Denver, Colorado.
4317
My Experience With the Great Firewall of China
When I recently visited China for the first time,as an InfoSec professional I was very curious to finally be able to poke at theGreatFirewall of China with m...
4318
ImperialViolet
When a browser connects to an HTTPS site it receives signed certificates which allow it to verify that it's really connecting to the domain that it should be connecting to. In those certificates are pointers to services, run by the Certificate Authorities (CAs) that issued the certificate, that allow the browser to…
4319
The Doghouse: Crypteto
Crypteto has a 49,152-bit symmetric key: The most important issue of any encryption product is the ‘bit key strength’. To date the strongest known algorithm has a 448-bit key. Crypteto now offers a 49,152-bit key. This means that for every extra 1 bit increase that Crypteto has over its competition makes it 100%…
4320
Diceware Passphrase Home
This page offers a better way to create a strong, yet easy to remember, passphrase for use with encryption and security programs. Weak passwords and passphrases are one of the most common flaws in computer security. Take a few minutes and learn how to do it right. The information presented here can be used by anyone…