211
Brave New Trusted Boot World
Posts and writings by Lennart Poettering
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 292 posts.
212
Outlook.com is silently discarding email messages (2015)
Outlook.com and hotmail.com is silently discarding email messages from our SMTP server.
213
Pwned, the book
The first time I ever wrote publicly about a company's security vulnerabilities, my boss came to have a word with me after seeing my name in the news headlines. One of the worst days I've ever had was right in the middle of the Have I Been Pwned
214
Bring Your Own Password Manager: Portable BitWarden on a Pi Zero
BYOPM is a self hosted portable Password Manager implementation based on BitWarden and Raspberry PI Zero.
215
An unexpected Redis sandbox escape affecting Debian-based distros
This post describes how I broke the Redis sandbox, but only for Debian and Debian-derived Linux distributions. Upstream Redis is not affected. That makes it a Debian vulnerability, not a Redis one. The culprit, if you will, is dynamic linking, but there will be more on that later.
216
Hashing is not encryption
Encryption, encoding, and hashing are three related but distinct concepts. It’s important for you to understand all three.
217
'Zero trust’ security is a poor choice of words
Consider the user's perspective when naming a security initiative
218
A large collection of fraudulent web stores
It started simply enough...
219
“Privacy”.com–Yeah Right
At the behest of a friend of mine, I decided to get myself a Privacy.com account. I filled it out with my personal information, activated the account, and...
220
Explained from scratch: private information retrieval and homomorphic encryption
This is a from-scratch explanation of private information retrieval built using homomorphic encryption. I try to assume only a general math / computer science background. To simplify things, my explanations may not always match academic definitions. You can check out this paper or code for more.
221
Gmail will call the cops on you based on the content of your emails
Correction: An earlier draft of this story misstated a technical detail; Mark didn’t email his photo to his doctor; rather, he took the photo with his phone and the image was automatically synched to his Google Photos account, triggering a scan .
222
Exploiting the Wii U's USB Descriptor parsing
In this write-up we're going to take a look at exploiting the Wii U's USB Host Stack. Over the past few months I spent a lot of time reverse...
223
224
Fuzzing ping(8) and finding a 24 year old bug
FreeBSD had a security fluctuation in their implementation of ping(8) the other day. As someone who has done a lot of work on ping(8) in OpenBSD this tickled my interests.
225
Extracting TLS keys from an unwilling application (2020)
I want to be able to inspect the traffic of programs running on my computer. I don’t really trust those programs and ideally I’d like to put nearly all of them into a high security jail. One of those programs is Oculus software. There are a few reasons why I want to be cautious about Oculus software.
226
Some notes on the Stable Diffusion safety filter
How deep learning models are moderated
227
Violence-as-a-Service: Brickings, Firebombings and Shootings for Hire
A 21-year-old New Jersey man has been arrested and charged with stalking in connection with a federal investigation into groups of cybercriminals who are settling scores by hiring people to carry out physical attacks on their rivals. Prosecutors say the defendant recently participated in several of these schemes …
228
229
230
Big Time Public License
a FRAND-ly license for software
231
Home Made TPM2.0 Module
Introduction With the recent launch of Windows 11 Microsoft also made having a hardware TPM module mandatory. Although this technology is not new (it was introduced in Windows 10 and Windows Server…
232
Edge Case Poisoning (2020)
TLA+ Workshop Last Call The TLA+ workshop is next week! Oct 20-22, register here, use the code COMPUTRONSTUFF for $500 off. Learn how a few hours of...
233
Convincing ChatGPT to Eradicate Humanity with Python Code
Full stack software engineer / entrepreneur specialized in AI agents, cybersecurity and graphics. In my free time I enjoy surfing, free diving, and contributing to open source software.
234
So I lost my OpenBSD FDE password (2016)
The other day I set up a new OpenBSD instance with a nice RAID array, encrypted with Full Disk Encryption. And promptly proceeded to forget part of the passphrase.
235
I Hacked My Car Guides: Creating Custom Firmware
Notice Note: As of 2022/10/25 the information in this series is slightly outdated. See Part 5 for more up to date information. I take no responsibility for any damages due to the information or steps provided on this site. The content is for educational purposes only. You modify your own car’s firmware at your…
236
237
238
High-Security Mechanical Locks (2020)
Outside of a very few specialized fields high-security locks are almost totally unknown. Even in the field of locksmithing where high-security locks are known, they are often misunderstood. Today I am going to offer you a primer on the fascinating world of high-security mechanical locks, the securit
239
Large scale Internet SSH brute force attacks seem to have stopped here
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
240
Mac App Store Ransomware
This App Store app [My Metronome - Tempo Keeper] immediately asks you for money and then disables the “Quit” option so that you can never close it!