2731
How you will not uncover Satoshi
Computer forensics is the science of finding evidence in computers and digital documents, and when a hacker perform forensics, better be prepared for the unknown. Satoshi did many things in order t…
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,335 posts.
2732
Node.js incorrectly parses HTTP methods
One who writes code
2733
Zero Trust Networks
I am leery of jargon. I am as guilty of using it as the next engineer, but there comes a point where there are just too many precise, narrowly-understood terms polluting your vocabulary. The circle of people you can talk to shrinks until going to the store to buy milk feels like an exercise in speaking a foreign…
2734
I know your name, where you work, and live (Safari v4 & v5)
Update 07.30.2010 : Apple patched Safari ( CVE-ID: CVE-2010-1796 ) Right at the moment a Safari user visits a website, even if they’ve never...
2735
Finding secrets by decompiling Python bytecode in public repositories
Cache rules everything around me. `pyc` files can contain secrets and should not be checked in to source control. Use the standard Python [.gitignore](https://github.com/github/gitignore/blob/master/Python.gitignore).
2736
1.4B records from “Have I been pwned” for analysis
I get a lot of requests from people for data from Have I been pwned [https://haveibeenpwned.com/] (HIBP) that they can analyse. Now obviously, there are a bunch of people up to no good requesting the data but equally, there are many others who just want to run statistics.
2737
Introducing the USB Stick of Death
Several months back we have been playing with different file systems on various system platforms, examining the security posture and robustness of numerous device drivers’ implementations. One of the configurations we spent some time on was the commonly used NTFS on Microsoft Windows – as the file system is rather…
2738
Repairing Corrupted ZIP Files by Brute Force Scanning in C
My brother is a wonderful photographer , and took 14 gigabytes of photos at my recent graduation from Columbia, some of which I hope to post on PhotoFloat -- my web 2.0 photo gallery done right via static JSON & dynamic javascript .
2739
Stealing everything you've ever typed on your Windows Recall PC is now possible
Recall is a new feature in Windows 11 which takes a screenshot every few seconds, runs local device OCR on it and stores the resulting text in a SQLite database. …
2740
Jailed Just-in-Time Compilation on iOS
Saagar Jha's website.
2741
Why the CrowdStrike bug hit banks hard
Regulation-induced monocultures meet unfortunate but explicable engineering decisions.
2742
2743
2744
'Impossible-to-hack' security turns out to be no security
Teammate App had a publicly exposed database and told me to stop harassing them after I emailed them about it.
2745
2746
Virtual Machine Detection in the Browser (2019)
Virtual Machine (VM) detection is nothing new. Malware has been doing it for over a decade now. Over time the techniques have advanced as defenders learned new ways of avoiding VM detection. A while back a friend and I were working on a project related to exploit delivery via a web application for redteaming purposes…
2747
NY Payroll Company Vanishes with $35M
MyPayrollHR , a now defunct cloud-based payroll processing firm based in upstate New York, abruptly ceased operations this past week after stiffing employees at thousands of companies. The ongoing debacle, which allegedly involves malfeasance on the part of the payroll company’s CEO, resulted in countless people…
2748
United Airlines Bug Bounty: An experience in reporting a serious vulnerability
About six months ago, United Airlines announced their Bug Bounty program and, almost immediately, it received a ton of press. Though I initially wasn’t interested in pursuing the program (mainly due to its popularity), I decided to take a look a week or two after its launch despite being late to the party. Shortly…
2749
The sad state of SMTP encryption
This is a quick recap of why I’m sad about SMTP encryption. It explains how TLS certificate verification in SMTP is useless even if you force it.
2750
Here come the encryption apps
It seems like these days I can’t eat breakfast without reading about some new encryption app that will (supposedly) revolutionize our communications — while making tyrannical regimes fa…
2751
E-Mail Leaves an Evidence Trail
If you’re going to commit an illegal act, it’s best not to discuss it in e-mail. It’s also best to Google tech instructions rather than asking someone else to do it: One new detail from the indictment, however, points to just how unsophisticated Manafort seems to have been. Here’s the relevant passage from the…
2752
Cofactor Explained: Clearing Elliptic Curves' dirty little secret
Efficient elliptic curves tend not to have a prime order. This discusses the problems this causes, and the solutions.
2753
2754
Quick notes about the bash bug, its impact, and the fixes so far
We spent a good chunk of the day investigating the now-famous bash bug (CVE-2014-6271), so I had no time to make too many jokes about it on...
2755
The Fallacy of Cracking Contests (1998)
In this issue: The Fallacy of Cracking Contests How to Recognize Plaintext News The Doghouse: Iomega Zip Disks Counterpane Systems News Final Report from the Commerce Department Technical Advisory Committee on Key Recovery Comments From Readers About "CRYPTO-GRAM"
2756
Guccifer 2.0 Hacked Clinton Foundation
Many of you have been waiting for this, some even asked me to do it. So, this is the moment. I hacked the Clinton Foundation server and downloaded hundreds of thousands of docs and donors’ da…
2757
You Know GDPR Is Good Based on Who Hates It
FDR has always been one of my favorite presidents, second maybe to Lincoln. Both were men the establishment assumed were one of them until, to their horror, they governed like they weren't. Both could trash the opposition in one breath and take the moral high ground in the next.
2758
GitHub Private Repos Considered Private-Ish
This week, we discovered that GitHub.com’s RSA SSH private key was briefly exposed in a public GitHub repository.
2759
Patronizing Passwords
Passwords suck. Let’s make them better.
2760
Is duckduckgo.com partially enforcing the “celebrity threesome injunction”?
The "celebrity threesome injuction" forbids publication in England and Wales of the identities of a famous married couple who reportedly had sex with someone else. In other words, nothing bad, or important.