4831
Three ways formally verified code can go wrong in practice
"Correct" doesn't mean "correct" when correctly using "correct"
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,768 posts.
4832
Anonymous message to NATO
Greetings, members of NATO. We are Anonymous. In a recent publication, you have singled out Anonymous as a threat to “government and th...
4833
Certificate Transparency in Firefox
Certificate Transparency (CT) has been one of the biggest advancements in web security, keeping users safe from threats such as certificate fraud and…
4834
Bypassing Antivirus with Ten Lines of Code
I had originally set out to write a long winded blog post on different antivirus bypass techniques. I went through what was supposed to be s...
4835
4836
Gone (Almost) Phishin'
This is a little embarrassing to share, but I’d rather someone else be able to spot a dangerous scam before they fall for it. So, here goes. One evening last month, my Apple Watch, iPhone, and Mac …
4837
4838
8M GitHub profiles were leaked from GeekedIn's MongoDB
Let me make it crystal clear in the opening paragraph: this incident is not about any sort of security vulnerability on GitHub's behalf, rather it relates to a trove of data from their site which was inappropriately scraped and then inadvertently exposed due to a vulnerability in another service.
4839
4840
I exploited existing YouTube videos with a fake Patreon profile
I am watching a lot of investing videos on youtube recently. I like to watch them while I eat, or they play in the background while I do something else. I…
4841
Designing a COM Library for Rust
I interned with Microsoft as a Software Engineering Intern in the MSRC UK team in Cheltenham this past summer. I worked in the Safe Systems Programming Language (SSPL) group, which explores safe programming languages as a proactive measure against memory-safety related vulnerabilities.
4842
4843
4844
4845
How Not to Acknowledge a Data Breach
I’m not a huge fan of stories about stories, or those that explore the ins and outs of reporting a breach. But occasionally I feel obligated to publish such accounts when companies respond to a breach report in such a way that it’s crystal clear they wouldn’t know what to do with a data breach if it bit them in the…
4846
4847
Access Control for GitHub Pages
GitHub Pages now gives you the option to limit access, making the site visible only to users with access to the repository that published the Page. With access control, you…
4848
Tor Messenger Beta: Chat Over Tor, Easily
WARNING STARTS As of March 2018, Tor Messenger is no longer maintained and you should NOT use...
4849
How we reduced the impact of zombie clients
Every night, right around midnight (mainly UTC), a horde of zombies wakes up and clamors for … digital certificates! The zombies in question are abandoned or misconfigured Internet servers and ACME clients that have been set to request certificates from Let’s Encrypt. As our certificates last for at most 90 days…
4850
4851
4852
Hacking Google for Fun and Profit
At the end of last year, Google announced their Vulnerability Reward Program which rewards security researchers for reported security and privacy holes in Google properties. This sounded like an interesting challenge, and I set out to find security holes. I found three, got paid, and am now in the Google Security Hall…
4853
A Detailed Elliptic Curve Cryptography Tutorial
When adding two integers i and j of bitlength b, the result will be of bitlength b + 1 in the worst case. This means they can easily be naively added. If the result is larger or equal to F p one has only to subtract p from the result, i.e.:
4854
Google Cloud Platform Security Best Practices
A walkthrough of a couple of Google Cloud Platform (GCP) features with security recommendations and advice on how to configure your GCP environments.
4855
Removing XSLT for a more secure browser
Prepare for Chrome deprecating and removing XSLT from the browser.
4856
DDoS-Guard to forfeit internet space occupied by Parler
Parler , the beleaguered social network advertised as a “free speech” alternative to Facebook and Twitter, has had a tough month. Apple and Google removed the Parler app from their stores, and Amazon blocked the platform from using its hosting services. Parler has since found a home in DDoS-Guard , a Russian digital…
4857
#1 CSRF Is A Vulnerability In All Browsers
Navigation: #1 CSRF Is A Vulnerability In All Browsers - You MUST Deny It ASAP. #2 top secret(will be published on April 1) #3 Another Ra...
4858
Banks, Arbitrary Password Restrictions and Why They Don't Matter
Allow me to be controversial for a moment: arbitrary password restrictions on banks such as short max lengths and disallowed characters don't matter. Also, allow me to argue with myself for a moment: banks shouldn't have these restrictions in place anyway. I want to put forward cases for
4859
Are popular toxicity models simply profanity detectors?
Are popular toxicity models simply profanity detectors? We show how toxicity models overweight profanity, and make mistakes when profanity is used in a positive way.
4860
GCC's new fortification level: The gains and costs (2022)
Discover the gains and costs of GCC’s enhanced runtime buffer overflow protection. Level 3 _FORTIFY_SOURCE preprocessor macro may detect more buffer overflows, but there’s a cost.