121
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 213 posts.
122
123
Bug finding is slow in spite of many eyeballs
"given enough eyeballs, all bugs are shallow" The saying (also known as Linus' law) doesn't say that the bugs are found fast and neither does it say who finds them. My version of the law would be much more cynical, something like: "eventually, bugs are found", emphasizing the 'eventually' part. (Jim Zemlin apparently…
124
United Airlines Bug Bounty: An experience in reporting a serious vulnerability
About six months ago, United Airlines announced their Bug Bounty program and, almost immediately, it received a ton of press. Though I initially wasn’t interested in pursuing the program (mainly due to its popularity), I decided to take a look a week or two after its launch despite being late to the party. Shortly…
125
The sad state of SMTP encryption
This is a quick recap of why I’m sad about SMTP encryption. It explains how TLS certificate verification in SMTP is useless even if you force it.
126
Patronizing Passwords
Passwords suck. Let’s make them better.
127
128
Hacking Oklahoma State University's Student ID
READ THIS AFTER - a full follow up here: http://snelling.io/following-up-hacking-oklahoma-state-universitys-student-id
129
Why the US federal employee record breach is worse than others
During the week of June 8th, the Office of Personnel Management (OPM) announced that the records of all current and past US federal employees had been compromised. That includes standard employment information - address, social security numbers, etc - of over 4 million people ranging from a random forest ranger to US…
130
When Undercover Credit Card Buys Go Bad
I recently heard from a source in law enforcement who had a peculiar problem. The source investigates cybercrime, and he was reaching out for advice after trying but failing to conduct undercover buys of stolen credit cards from a well-known underground card market. Turns out, the cybercrime bazaar’s own security…
131
A riddle wrapped in a curve
If you’re looking for a nice dose of crypto conspiracy theorizing and want to read a paper by some very knowledgeable cryptographers, I have just the paper for you. Titled “A Riddle Wrapped in an E…
132
Being Sneaky in C
I entered the 2014 Underhanded C Contest last year. Didn't win, but hey-ho what can you do. Still, I thought I'd post my entry and a write-up of it, in case anyone found it interesting.
133
What happens when DNS in China is poisoned and pointed at your server
I’ve been using the Internet in one form or another since the mid-80’s. In that time, I’ve seen a lot of strange stuff happening on our global network. On Tuesday, I experienced something extraordinary. It all started with a text message from my partner Ged at 8:30 AM: Mail server down. Please take a look […]
134
135
Is Extended Random a Malicious NSA Plot?
Dual_EC was almost certainly an NSA backdoor. Extended Random is the TLS extension that would have made it practical to exploit. Did NSA plant that one too? A look at the evidence.
136
Users Rationally Rejecting Security Advice (2009)
This paper, by Cormac Herley at Microsoft Research, sounds like me: Abstract: It is often suggested that users are hopelessly lazy and unmotivated on security questions. They chose weak passwords, ignore security warnings, and are oblivious to certicates errors. We argue that users’ rejection of the security advice…
137
Security: OpenBSD vs. FreeBSD
Blog about network and security, showing example of Linux iptables and Snort configuration, and Windows security softwares.
138
Thunderstrike 2: Mac firmware worm details
Collection of my projects and hacks.
139
140
Safe from what?
What does it mean for a baby monitor to be safe? Some things are clearly essential: It should not explode; it should not release significant quantities of dangerous gasses; if it's designed to be placed within reach of a baby, it should not pose an electrocution or choking hazard. Less obviously, if it has data or…
141
Coreboot Blocked from Recent Thinkpads by Intel Boot Guard
So some innocent post on the coreboot mailing list managed to make some waves. The problem Intel tries to solve… Intel Boot Guard is the latest effort in a long series by Intel and others to allow computers to provide some reliable information about the state a computer is in. They’re working on it since at least…
142
What’s in a Boarding Pass Barcode?
The next time you’re thinking of throwing away a used boarding pass with a barcode on it, consider tossing the boarding pass into a document shredder instead. Two-dimensional barcodes and QR codes can hold a great deal of information, and the codes printed on airline boarding passes may allow someone to discover more…
143
The ICANN Public Comments on WHOIS Privacy
ICANN is currently considering a proposal that “domains used for online financial transactions for commercial purpose should be ineligible for [WHOIS] privacy and proxy registrations” [ PDF ]. Given the vagueness around what would count as “commercial purpose” (tip jars? advertising? promoting your Kickstarter?) and…
144
AT&T Hotspots: Now with Advertising Injection
While traveling through Dulles Airport last week, I noticed an Internet oddity. The nearby AT&T hotspot was fairly fast—that was a pleasant surprise.
145
Facebook and PGP
Facebook just announced support for PGP, an encrypted email standard, for email from them to you. It’s an interesting move on many levels, albeit one that raises some interesting questions. The answers, and Facebook’s possible follow-on moves, are even more interesting.
146
I Know This – Hack Jurassic Park’s Security System
“I Know This” is a game I made for the Global Game Jam 2015 along with Gavin McCarthy (art, design), Adam Axbey (sound effects) and Matthew Simmonds (4mat) (music); I did programming and design. The name we chose for the team was Two’s Complement .
147
Hacking Team: a zero-day market case study
This article documents Hacking Team’s third-party acquisition of zero-day (0day) vulnerabilities and exploits. The recent compromise of Hacking Team’s email archive offers one of the first public case studies of the market for 0days. Because of its secretive nature, this market has been the source of endless debates…
148
Breaches, traders, plain text passwords, ethical disclosure and 000webhost
It’s a bit hard to even know where to begin with this one, perhaps at the start and then I’ll try and piece all the bits together as best I can. As you may already know if you’re familiar with this blog, I run the service Have
149
150
The easiest bug bounties I have won
The bugs I will write about are the simplest ones I have ever found on Facebook. The point of this blog is to show that some bugs can be fo...