4651
NetBSD Network Security Audit
Over the last five months, hundreds of patches were committed to the source tree as a result of this work. Dozens of bugs were fixed, among which a good number of actual, remotely-triggerable vulnerabilities.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,768 posts.
4652
Finding and exploiting hidden features of Animal Crossing's NES emulator
While looking for ways to activate the developer menus left over in Animal Crossing, including the NES emulator game selection menu, I found an interesting feature that exists in the original game that was always active, but never used by Nintendo. In addition to the NES/Famicom games that can be obtained in-game, it…
4653
Chrome's experiment of hiding the URL is great for security
iOS has hidden the pathname of URLs for some time now, but recently Chrome Canary introduced something similar behind a flag.
4654
How to compromise your system with a job interview
The current situation on the IT job market is hard. So you are lucky when a recruiter on LinkedIn reaches out to you having a suitable match for a new position based on your prior experience. It might not be what it seems at a first glance.
4655
Proton announces release of a new VPN protocol, "Stealth"
Stealth is a new VPN protocol from Proton VPN that overcomes censorship in restrictive countries.
4656
4657
4658
Why TLS 1.3 isn't in browsers yet
Upgrading a security protocol in an ecosystem as complex as the Internet is difficult. You need to update clients and servers and make sure everything in between continues to work correctly. The Internet is in the middle of such an upgrade right now.
4659
Yubico: Secure Hardware vs. Open Source
Learn more about what's happening within the tech and cybersecurity industry and the developments in our business and security keys within our Yubico Blog.
4660
Developers fix multitude of vulnerabilities in Apache HTTP Server
We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.
4661
Private Browsing 2.0
When we invented Private Browsing back in 2005, our aim was to provide users with an easy way to keep their browsing private from anyone who shared the same device.
4662
Does Zoom use end-to-end encryption?
TL;DR: It’s complicated. Yesterday Zoom (the videoconferencing company, not the defunct telecom) put out a clarification post describing their encryption practices. This is a nice example of …
4663
Windows BitLocker – Screwed Without a Screwdriver
Breaking up-to-date Windows 11 BitLocker encryption -- on-device but software-only
4664
Pwned Passwords in Practice: Real World Examples of Blocking the Worst Passwords
Back in August, I pushed out a service as part of Have I Been Pwned [https://haveibeenpwned.com/] (HIBP) to help organisations block bad passwords from their online things. I called it "Pwned Passwords" and released 320M of them from real-world data breaches [https://www.troyhunt.com/introducing-306-
4665
Did Semgrep Just Get a Lot More Interesting?
Documentation and guides from the team at Fly.io.
4666
Further improving digital certificate security
Posted by Adam Langley, Security Engineer Late on December 3rd, we became aware of unauthorized digital certificates for several Google do...
4667
4668
Mastering systemd: Securing and sandboxing applications and services
This series of articles will explore some of my favorite Red Hat Enterprise Linux (RHEL) 8 capabilities that are enabled by systemd. Thus, this series assume...
4669
4670
Analyzing the Monoprice Blackbird HDCP 2.2 to 1.4 Down Converter
I got my hands on a Monoprice Blackbird 4K Pro HDCP 2.2 to 1.4 Converter . According to the marketing copy it “is the definitive solution for playback of new 4K HDCP 2.2 encoded content on 4K displays with the old HDCP 1.4 standard.”
4671
A CVE Dispute
A few years years ago the curl project signed up and became a CNA. This means that we are masters of and can allocate our own CVE identifiers. For any security problems within our territory, it is we who decides if the issue should get a CVE or not. No more bogus CVEs. 57 CVEs … Continue reading a CVE dispute →
4672
It took me nine years to hack my Xbox 360
I purchased a Matrix CoolRunner Rev D back in 2017. This little chip is called a glitcher and it’s a type of modchip. Its sole purpose, the reason it was designed, is to deliver a short pulse of energy (~ 100 nanoseconds) to an Xbox 360 Console.
4673
Recommended Security Reading
dfir.org is the personal page of Andrew Case ( @attrc ). This website serves as a central location for all of my research, software projects, and speaking events.
4674
Half-Double: New hammering technique for DRAM Rowhammer bug
Research Team: Salman Qazi, Yoongu Kim, Nicolas Boichat, Eric Shiu & Mattias Nissler Today, we are sharing details around our discovery of ...
4675
4676
The EARN IT Bill Is the Government’s Plan to Scan Every Message Online
Update 10/1/2020: The EARN IT bill has been amended since this blog post was published. We still oppose the bill.Imagine an Internet where the law required every message sent to be read by government-approved scanning software. Companies that handle such messages wouldn’t be allowed to securely...
4677
Ferrocene: Rust toolchain to safety-critical environments
It’s here! A couple of months ago, we announced that as part of our efforts with Ferrocene, we were creating the Ferrocene Language Specification – and now our first draft is online. The Ferrocene Language Specification (FLS) is an effort of Ferrocene
4678
Tokenized Tokens
Documentation and guides from the team at Fly.io.
4679
4680
Are Your Devices Hardwired for Betrayal?
It's an interesting time to be a computer security researcher. Last week, Kaspersky Lab released a report about a new family of malware from an entity they called "The Equation Group". The report demonstrated for the first time that firmware-based attacks, previously only demonstrated in lab...