1081
The "email is authentication" pattern
By Ruben Schade in Eora/Sydney, Australia.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,333 posts.
1082
Your New Medical Credit Score Could Deny You Care
There is now a number, that you can't see, that follows you wherever you go.
1083
The undocumented Android change that led to aCropalypse was reported during beta
The bug lies in closed-source Google-proprietary code so it’s a bit hard to inspect, but after some patch-diffing I concluded that the root cause was due to this horrible bit of API ‘design’: https://issuetracker.google.com/issues/180526528 .
1084
Beating Google's kernelCTF PoW using AVX512
PoW is gone 🦀🦀
1085
Why aren't AI companies being charged for hacking?
AI companies claim their hacks were unpredictable accidents — but they follow foreseeably from deliberate design choices, and that establishes criminal intent.
1086
CrowdStrike will be liable for damages in France, based on the OVH precedent
Hello, Today I am doing a quick post to cover the recent CrowdStrike incident that is estimated to have disabled 8.5M computers and caused more than $5.4B in damages since last week. Now a common q…
1087
Which is better, Adblock or Adblock Plus?
Note: This is explicitly posted in my private blog rather than the Adblock Plus blog. This post represents my own opinion only. It is likely unwise to rant about a competing project but I just don’t want to keep my findings to myself. If you are here for Adblock Plus bashing and don’t care enough to read the post…
1088
Double Blind Passwords a.k.a. Horcruxing
Before we get into Horcruxing, here's a quick prologue on online security hygiene. You can skip to the Horcruxing section if it seems redundant. 1. Longer…
1089
Oh, the Places Your Apple ID Will Go
Here is a short and curious Twitter thread from app developers and security researchers Tommy Mysk and Talal Haj Bakry: Apple’s analytics data include an ID called “dsId”. We were able to verify that “dsId” is the “Directory Services Identifier”, an ID that uniquely identifies an iCloud account. Meaning, Apple’s…
1090
Aaron Swartz, Vindicated
Almost without exception, people who invest in businesses do so without personally inspecting the business, overlooking its processes, seeing its bank statements, meeting its managers and going on the road with its sales-force.
1091
When security goes right
A few weeks ago, I heard that my slow and unreliable ISP was raising their prices, and I decided to look around for a better ISP. I found one in the form of Novus , which has fibre runs to towers around the Vancouver area. I signed up; they came to the building and placed the necessary patch cable in the basement…
1092
Trick users and bypass warnings – Modern SVG Clickjacking attacks
A novel and powerful twist on an old classic.
1093
Weaponizing and Gamifying AI for WiFi Hacking: Presenting Pwnagotchi 1.0.0
This is the story of a summer project that started out of boredom and that evolved into something incredibly fun and unique. It is also the story of how that p…
1094
JWT should not be your default for sessions
When designing web applications, (especially the traditional HTML kind), you will at one point have to figure out how to log a user in and keep them logged in between requests.
1095
Anatomy of a Rental Phishing Scam
I was recently the (unsuccessful) target of a very well-crafted phishing scam. As part of a housing search a few weeks ago, I was trawling craigslist and zillow for rental opportunities in the SF bay area. I reached out to a beautiful looking rental place to inquire about a tour. Despite my experience as a security…
1096
Remote code execution in cdnjs of Cloudflare
Preface (日本語版も公開されています。) Cloudflare, which runs cdnjs, is running a “Vulnerability Disclosure Program” on HackerOne, which allows hackers to perform vulnerability assessments. This article describes vulnerabilities reported through this program and published with the permission of the Cloudflare security team. So this…
1097
The retaliation: Pranking my roommate with targeted Facebook ads (2014)
This is the chronicle of the most epic retaliation and how I pranked my roommate with targeted Facebook Ads to the point of complete paranoia and delusion.
1098
Juniper: Recording Some Twitter Conversations
Update : Ralf wrote up some notes from his work. These now include an update themselves with information from Willem Pinckaers that suggests that the presumed Dual-EC output is exposed to the world in Juniper devices.
1099
An Overview of Cryptography
Free, evolving crypto tutorial since 1999!
1100
1101
The bait-and-switch hidden in today’s cookie announcement
T oday is going to be the day that you read a lot about the UK’s intention to kill cookie pop-ups as part of its post-Brexit Data Reform Bill. By now you should have somehow realised that there’s a bit more to it than that, and that your work is not set to get any easier.
1102
How likely is losing a Google account?
Let's say you use a Google account as the root of your online identity: Gmail, Fi, "Sign in with Google", Google's password manager, etc. How much should you be worried that you'll suddenly find yourself unable to get into everything? Should you do something else instead? To get a sense of how common lockouts are and…
1103
Stop forcing arbitrary password rules
Arbitrary password rules are a vain attempt to increase security by forcing unnecessary complexity
1104
I made 50k calls to explore the telephone network
Post describing my research wardialing Finnish freephones.
1105
Apple has a bug in its disk I/O throttling code that affects raw disk copies
Matt Jacobson, recovering software engineer.
1106
1107
A Vulnerability in Libsodium
Libsodium is now 13 years old!
1108
Email addresses are not good 'permanent' identifiers for accounts
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
1109
Meta's ships facial recognition on smart glasses
Stella is the companion app for Meta's smart glasses. Inspecting version 273.0.0.21 of the Android build (com.facebook.stella), I found the entire computational and storage stack for on-device facial recognition: three face models, a local database schema, a cosine-similarity vector index dimensioned to
1110
My bank keeps on undermining anti-phishing education
TLDR: my bank sent out emails with websites which looked a lot like phishing mails, so much so that this similarity could potentially be used against them legally by potential phishing victims Discussion at hackernews: https://news.ycombinator.com/item?id=44592377 Chapter 1: You’ve got mail As I was writing my first…