2881
Is Extended Random a Malicious NSA Plot?
Dual_EC was almost certainly an NSA backdoor. Extended Random is the TLS extension that would have made it practical to exploit. Did NSA plant that one too? A look at the evidence.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,335 posts.
2882
Undeletable Cookies
A couple of weeks ago Wired reported the discovery of a new, undeletable, web cookie: Researchers at U.C. Berkeley have discovered that some of the net’s most popular sites are using a tracking service that can’t be evaded—even when users block cookies, turn off storage in Flash, or use browsers’ “incognito”…
2883
SeL4 on RISC-V Verified to Binary Code
… and seL4 and RISC-V Foundations form an alliance In June 2020 we announced that the seL4 microkernel, the world’s first operating system (OS) kernel with a machine-checked proof of implemen…
2884
Liberating out-of-copyright photos from SmartFrame's DRM
During the middle of the 20th Century, the UK's Royal Air Force took thousands of photographs of the country from above. Think of it like a primitive Google Earth. Those photographs are "Crown Copyright". For photographs created before 1st June 1957, the copyright expires after 50 years. Recently, the organisation…
2885
Knock Knock Who's There? – An NSA VM
Back in 2017 (feels like ages ago) I decided to take a peek into the ShadowBrokers leaks and reverse some of the tools. I started on dewdrop simply because it had a macOS version. I made local presentations at 0xOpoSec and BSidesLisbon but those slides were never published for obvious reasons (aka live implants all…
2886
Passkeys are just passwords that require a password manager
You reset your passkey the same way you reset your password. But you’ll find that passkeys make it harder to switch between password…
2887
Brave New Trusted Boot World
Posts and writings by Lennart Poettering
2888
2889
The Naz.API Credential Stuffing List
It feels like not a week goes by without someone sending me yet another credential stuffing list. It's usually something to the effect of "hey, have you seen the Spotify breach", to which I politely reply with a link to my old No, Spotify Wasn't Hacked blog post
2890
Daily Driving GrapheneOS
I've been running GrapheneOS on my Pixel Fold for over half a year now and can finally provide some experience on what it's like. Also, the official hardware partnership was announced!
2891
How you can get banned from Facebook permanently
Contact Facebook customer service for your customer service needs. Reach out via phone, email, or social media.
2892
Apple has just released the first Rapid Security Response for Ventura
Apple has just released the first of its new Rapid Security Responses (RSRs) for macOS 13.3.1 Ventura. This is indicated as macOS Rapid Security Response 13.3.1 (a), and is just just over 300 MB to…
2893
Virgin Mobile leaves six million subscriber accounts wide open
Update: Virgin fixed the issue Tuesday night after taking their login page down for four hours. Please see my update at the bottom of this post.
2894
Crates.io phishing attempt
Earlier this week, an npm supply chain attack. It’s turn for crates.io, the main public repository for Rust crates (packages). The phishing e-mail looks like this: And it leads to a GitHub login pa...
2895
2896
2897
Malicious Use of the HTML5 Vibrate API
There is a new API in town! HTML5 will (soon) let you make the user's device vibrate. What fun! Obviously, it's useful for triggering alerts, improved immersivness during gameplay, and all sorts of other fun things like sending Morse Code messages via vibration. At the moment, Chrome (and other Android browsers) ask…
2898
Fake ad blockers in Chrome Web Store
People searching for a Google Chrome ad blocking extension have to choose from dozens of similarly named extensions. Only few of these are legitimate, most are forks of open source ad blockers trying to attract users with misleading extension names and descriptions. What are these up to? Thanks to Andrey Meshkov we…
2899
The Trouble with Politicians Sharing Passwords
Yesterday I had a bunch of people point me at a tweet from a politician in the UK named Nadine Dorries [https://twitter.com/NadineDorries]. As it turns out, some folks were rather alarmed about her position on sharing what we would normally consider to be a secret. In this
2900
2901
Self-Enforcing Protocols
There are several ways two people can divide a piece of cake in half. One way is to find someone impartial to do it for them. This works, but it requires another person. Another way is for one person to divide the piece, and the other person to complain (to the police, a judge, or his parents) if he doesn’t think it’s…
2902
Yubikey/Smartcard backed TLS servers
It has become clear that storing secrets in computers is hard. The best demo to the world that storing secrets on “online” computers is hard and sometimes devastating, is the large amounts of cryptocurrency theft due to critical keys being in memory of systems directly or indirectly connected to the internet.
2903
Smartphone can use its microphone to extract RSA decryption key from laptop
This is neat: Here, we describe a new acoustic cryptanalysis key extraction attack, applicable to GnuPG’s current implementation of RSA. The attack can extract full 4096-bit RSA decryption keys from laptop computers (of various models), within an hour, using the sound generated by the computer during the decryption of…
2904
Cloudflare scrubs Aisuru botnet from top domains list
For the past week, domains associated with the massive Aisuru botnet have repeatedly usurped Amazon , Apple , Google and Microsoft in Cloudflare’s public ranking of the most frequently requested websites. Cloudflare responded by redacting Aisuru domain names from their top websites list. The chief executive at…
2905
Hacking the call records of millions of Americans
Imagine if anyone could punch in a phone number from the largest U.S. cell carrier and instantly retrieve a list of its recent incoming calls—complete with timestamps—without compromising the device, guessing a password, or alerting the user. Now imagine that number belongs to a journalist, a police officer, a…
2906
How I Learned Symmetric-Key Cryptanalysis
personal web-log
2907
Cross-Site Request Forgery
Cross-Site Request Forgery countermeasures can be greatly simplified using request metadata provided by modern browsers.
2908
Reverse Engineering Protobuf Definitions from Compiled Binaries
How to extract raw source protobuf definitions from compiled binaries, regardless of the target architecture
2909
Is your chip card secure? Much depends on where you bank
Chip-based credit and debit cards are designed to make it infeasible for skimming devices or malware to clone your card when you pay for something by dipping the chip instead of swiping the stripe. But a recent series of malware attacks on U.S.-based merchants suggest thieves are exploiting weaknesses in how certain…
2910
Windows 10 spies on your use of System Settings (2021)
Windows 10 spies on your use of System Settings