Topics /
The most popular blog posts about security & privacy on Hacker News. 293 posts.
Cache rules everything around me. `pyc` files can contain secrets and should not be checked in to source control. Use the standard Python [.gitignore](https://github.com/github/gitignore/blob/master/Python.gitignore).
Saagar Jha's website.
Virtual Machine (VM) detection is nothing new. Malware has been doing it for over a decade now. Over time the techniques have advanced as defenders learned new ways of avoiding VM detection. A while back a friend and I were working on a project related to exploit delivery via a web application for redteaming purposes…
Efficient elliptic curves tend not to have a prime order. This discusses the problems this causes, and the solutions.
Plus general overview
On November 12, 2020 Apple released macOS Big Sur. In the hours after the release went live, somewhere in Apple's infrastructure an OCSP esponder cried out in pain…
Most of the civilized world years ago shifted to requiring computer chips in payment cards that make it far more expensive and difficult for thieves to clone and use them for fraud. One notable exception is the United States, which is still lurching toward this goal. Here’s a look at the havoc that lag has wrought, as…
Well the news is out, I won’t explain the method for reasons, but our code warriors have a new fight. After requesting the SU password, they were told flat out it doesn’t exist and refe…
Watching you watch: the tracking ecosystem of over-the-top TV streaming devices, Moghaddam et al., CCS’19 The results from this paper are all too predictable: channels on Over-The-Top (OTT) s…
The rise of tooling for vulnerability detection combined with pressure driven by Vendor Due Diligence is causing a massive enterprise freezeout for non-mainstream technologies across the board. Of particular concern is the impact this will have on the adoption of functional programming in enterprise and small business…
The people are the best thing about a life in science fiction – eclectic, bright, opinionated, talented – people like Elise Mathson: writer, jeweller, and all-round brilliant person (she's up for a Hugo this year).
Chip-based credit and debit cards are designed to make it infeasible for skimming devices or malware to clone your card when you pay for something by dipping the chip instead of swiping the stripe. But a recent series of malware attacks on U.S.-based merchants suggest thieves are exploiting weaknesses in how certain…
This blog is written by Hanno Böck. Unless noted otherwise, its content is licensed as CC0 .
Fuzz testing is a bit like the infinite monkey theorem, but instead of Shakespeare you get crashes.
Yesterday, January 2nd, my wife received a billing alert from her phone provider. Luckily, she's not with EE - because it's a pretty convincing text. That domain name is specifically designed to include the day's date. If you're stood up on a crowded train, with your phone screen cracked, would you notice that a . is…
Penetration testing is complex. For it to be successful, the tester needs to possess a variety of different abilities and skills. Some testers rely only on automated tools, while others focus more on manual analysis. While a creative and unconventional way of thinking is necessary, it is also important for the tester…
When law enforcement agencies tout their latest cybercriminal arrest, the defendant is often cast as a bravado outlaw engaged in sophisticated, lucrative, even exciting activity. But new research suggests that as cybercrime has become dominated by pay-for-service offerings, the vast majority of day-to-day activity…
Dmitry.GR: Complete device takeover by blinking at it!
I recently installed Ubuntu Wacky Whatever, the latest version, and I’m very excited about it shipping with SSH 8.2, which means that I can finally use hardware USB keys for secure, easy to use authentication. If securing your devices has been something you’ve wanted to easily do yourself, read on, because it’s…
Crypto is often treated like a black art only anointed experts can hope to wield safely. It's not. There are laws, and we can learn them.
seL4 has been our team’s greatest achievement, but it didn’t fall out of the sky: it was the result of 15 years of research, and has evolved further for the past 10 years. From the begi…
When you run the Ubuntu installer, there’s an option to dual-boot Ubuntu with an existing Windows installation. There’s also an option to encrypt your Ubuntu...
EAs of the 5th July 2020, there are 1357 Tor bridges available for users in countries who censor the Tor network to use. Having just over 1,000 IP addresses is not a lot for such a big privacy network as Tor is, especially considering that the number of Tor Bridges peaked at 4,227 on the 4th January 2015. That means…
