4051
How SAML 2.0 Authentication Works
At its core, Security Assertion Markup Language (SAML) 2.0 is a means to exchange authorization and authentication information between services. Learn how saml works.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,768 posts.
4052
Jitsi privacy flaw enables one-click stealth audio and video capture
A Jitsi feature allows an attacker to transmit user's microphone and camera in the background without their consent.
4053
Planning Go 1.20 cryptography work
My plans for Go 1.20 include landing the crypto/ecdh package, making progress on moving math/big out of the security perimeter, and a batch of crypto/tls work.
4054
When DEF CON partners with the U.S. Army
DEF CON has alienated many hackers by officially aligning its geopolitics with those of the U.S. military and announcing partnerships with the authoritarian countries of Bahrain and Singapore.
4055
Why [Insert Thing Here] Is Not a Password Killer
These days, I get a lot of messages from people on security related things. Often it's related to data breaches or sloppy behaviour on behalf of some online service playing fast and loose with HTTPS or passwords or some other easily observable security posture. But on a fairly regular
4056
4057
We know 15k websites are infected. how do we tell them?
We've identified 15,579 websites that are currently infected with malicious JavaScript and between them, we conservatively estimate that they receive more than 135 million visits every month. We know they're infected, and we have the evidence to back that up, but there's a problem: how on
4058
Incapacitating Google Tag Manager (2022)
Drilling beneath the hype to expose the truth
4059
Officials Don't Get to Choose Who Gets to Receive, Comment, and Reply to Tweets
We’ve taken a stand for the First Amendment rights of individuals to receive and comment on social media posts from governmental officials and agencies. We’ve received a lot of good questions about why we believe that public servants—mayors, sheriffs, senators, even President Donald Trump—can’t...
4060
Adding a security key to Gmail
Your primary email (the one you give to banks, social media sites, etc.) is the most important online account you have. If an attacker can take over your primary email account, they can reset passwords on every other service that uses that email for account recovery.
4061
Delimiters won’t save you from prompt injection
Prompt injection remains an unsolved problem. The best we can do at the moment, disappointingly, is to raise awareness of the issue. As I pointed out last week, “if you …
4062
Kali Linux 2020.3
Its that time of year again, time for another Kali Linux release! Quarter #3 - Kali Linux 2020.3. This release has various impressive updates, all of which are ready for immediate download or updating. A quick overview of what’s new since the last release in May 2020: New Shell - Starting the process to switch from…
4063
Cryptographic coin flipping, now in Keybase
You're reading the Keybase blog. There are more posts . When you're done, you can install Keybase .
4064
4065
Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate
If you're using Chrome 53, which was released last week, you might find that some websites which worked under Chrome 52 now fail with "Your connection is not private" with an error code of NET::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED . For example, choosemyreward.chase.com shows the following error as of publication…
4066
A recent security incident involving Dropbox Sign
Information on a security incident involving Dropbox Sign.
4067
Abusing the Chromium Devtools Scope Pane
tl;dr — Abusing the Chromium Devtools Scope Pane to track debugging of specific javascript functions
4068
New Tools for Detecting HTTPS Interception
The practice of HTTPS interception continues to be commonplace on the Internet. This blog post discusses types of monster-in-the-middle devices and software, and how to detect them.
4069
Android NAT-T keepalive offload bypasses VPN lockdown
Technical report on Android VPN lockdown bypass via NAT-T keepalive offload.
4070
4071
Open-sourcing Riskquant, a library for quantifying risk
Netflix has a program in our Information Security department for quantifying the risk of deliberate (attacker-driven) and accidental…
4072
4073
Golang SSH Redux
I’ll cover the post/blog, and then I’d like to counter some misconceptions. While part of me thinks “I must’ve been very unclear to have so many people misunderstand”, I also saw how many people commented without bothering to read, so really there’s a limit to how much self-flagellation will happen.
4074
Shamir’s Secret Sharing Scheme
Consider a scenario in which you are tasked with managing the security of a bank's vault. The vault is considered impenetrable without a key, which you are g...
4075
Electronic Frontier Foundation Uncovers Widespread FBI Intelligence Violations
EFF has uncovered widespread violations stemming from FBI intelligence investigations from 2001 - 2008. In a report released today, EFF documents alarming trends in the Bureau’s intelligence investigation practices, suggesting that FBI intelligence investigations have compromised the civil...
4076
Starlink's User Terminal Firmware
This blog post presents an overview of Starlink's User Terminal runtime internals, focusing on the communications that happen within the device and with user applications and some tools that can help further research on the same topic.
4077
Binary SMS – The old backdoor to your new thing
A Accenture oferece oportunidades que surgem a partir da disrupção tecnológica em todas as indústrias, em todos os países, todos os dias. Saiba mais!
4078
GPU.zip: side channel attack that exposes visual data processed on the GPU
On the Side-Channel Implications of Hardware-Based Graphical Data Compression
4079
4080
YouTube ads in Safari: you see them now, will you see them in the future?
Content blocking in Safari is a thing in and of itself, and it's not good. One of the consequences is ads appearing in YouTube. Why does it happen and can it be prevented?