331
Tor Browser 8.5
Tor Browser 8.5 includes our first stable release for Android plus many new features.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 579 posts.
332
Git ransom campaign incident report
This is a coordinated effort to help educate and inform users on secure best practices relating to the recent Git ransomware incident.
333
BoringTun, a Userspace WireGuard Implementation in Rust
Today we are happy to release the source code of a project we’ve been working on for the past few months. It is called BoringTun, and is a userspace implementation of the WireGuard® protocol written in Rust.
334
Destroying x86_64 instruction decoders with differential fuzzing
TL;DR: x86_64 decoding is hard, and the number and variety of implementations available for it makes it uniquely suited to differential fuzzing. We’re open sourcing mishegos, a differential fuzzer for instruction decoders. You can use it to discover discrepancies in your own decoders and analysis tools! In the…
335
336
Github became the web's largest font piracy site (2017)
Front-end antics and typographic mischievousness
337
338
339
2FA on the command line
OTP: One-Time Password TOTP: Time-based One-time Password algorithm 2FA: Two-factor authentication There is no shortage of OTP 2FA apps availiable for your phone, such as Google Authenticator or Duo Mobile. These apps take an initial secret code, and create a TOTP anytime you need a 2FA code for login.… …
340
Reverse Engineering a Xinjiang Police Mass Surveillance App
This report presents new evidence about the surveillance state in Xinjiang, where the government has subjected 13 million Turkic Muslims to heightened repression as part of its “Strike Hard Campaign against Violent Terrorism.” Between January 2018 and February 2019, Human Rights Watch was able to reverse engineer the…
341
342
On Linux's Random Number Generation
Cutting-edge cyber security research from NCC Group. Find public reports, technical advisories, analyses, & other novel insights from our global experts.
343
Firefox Personal Data Promise
Tech companies are using the word “privacy” a lot these days. What do they mean when they say it? To one company, privacy means keeping your informatio
344
267M Facebook users IDs and phone numbers exposed online
Databases exposed by a criminal group leaked more than 300 million Facebook user IDs, names, and phone numbers on the web.
345
‘eyeDisk’ USB drive secured with iris recognition reveals password in plain text
Last year, about the time we were messing around with a virtually unheard-of hardware wallet we got a bit excited about the word “unhackable”. Long story short, I ended up supporting a selection of kickstarters that had the word “unhackable” or similar in their title. Of these, at least one got funded and got…
346
347
348
So You Want to Be a Penetration Tester?
This is an old and outdated version of the blog. If you haven’t read this post yet, then please see the new one for the most up-to-date content: “So You Want To Work in Cyber Security?”. This version is kept here for archival purposes only.
349
Making email more secure with MTA-STS standard
Posted by Nicolas Lidzborski, Senior Staff Software Engineer, Google Cloud and Nicolas Kardas, Senior Product Manager, Google Cloud We’re...
350
Teardown of a Failed Linux LTS Spectre Fix
An in-depth analysis of the journey of a Spectre fix into the upstream LTS kernels that left its users with nothing more than a false sense of security.
351
PureBoot, the High Security Boot Process
Purism makes premium phones, laptops, mini PCs and servers running free software on PureOS. Purism products respect people's privacy and freedom while protecting their security.
352
Adding Client-Side Scanning Breaks End-to-End Encryption
Recent attacks on encryption have diverged. On the one hand, we’ve seen Attorney General William Barr call for “lawful access” to encrypted communications, using arguments that have barely changed since the 1990’s. But we’ve also seen suggestions from a different set of actors for more purportedly...
353
Metasploit 5.0 Released
We are happy to announce the release of Metasploit 5.0, the culmination of work by the Metasploit team over the past year. Learn more.
354
Protecting democratic elections through secure, verifiable voting
Today, at the Microsoft Build developer conference, CEO Satya Nadella announced ElectionGuard, a free open-source software development kit (SDK) from our Defending Democracy Program. ElectionGuard will make voting secure, more accessible, and more efficient anywhere it’s used in the United States or in democratic…
355
Basic Electron Framework Exploitation
A Accenture oferece oportunidades que surgem a partir da disrupção tecnológica em todas as indústrias, em todos os países, todos os dias. Saiba mais!
356
Use GitHub actions at your own risk
Malicious code can be inserted into any GitHub action, even those which are tagged.
357
Adventures in reverse engineering Broadcom NIC firmware
For some time now, I've been reverse engineering the firmware of the Broadcom BCM5719 Ethernet NIC chip, so that open source firmware can be produced for it. The BCM5719 is a PCIe chip which provides up to four Gigabit Ethernet ports, and is mainly intended for use in server applications. It can be used with the Linux…
358
Time protection: the missing OS abstraction
Time protection: the missing OS abstraction Ge et al., EuroSys’19 Ever since the prominent emergence of timing-based microarchitectural attacks (e.g. Spectre, Meltdown, and friends) I’ve been…
359
Attempts to Censor AntiPolygraph.org
AntiPolygraph.org has received a rather unpleasant letter from James D’Loughy, a lawyer representing NITV Federal Services, LLC (NITV), which markets a scientifically baseless voice-based lie detector called the “Computer Voice Stress Analyzer,” and its president, self-described “Renaissance Man” “Dr.” Charles Humble…
360
Writing Exploit-Resistant Code with OpenBSD
On April 27, 2019, I gave a talk on how to use OpenBSD to write better software at CarolinaCon 15 in Charlotte.