5821
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,770 posts.
5822
Sequoia PGP 1.0 Released: The Seedling Is a Sapling
Sequoia is a modular OpenPGP implementation in Rust.
5823
Securing your API: a modern alternative to CSRF tokens
Cross-Site Request Forgery (CSRF) allows an attacker to make unauthorized requests on behalf of a user. We tackle CSRFs while allowing a subset of Cross-Origin requests.
5824
Self-Enforcing Protocols
There are several ways two people can divide a piece of cake in half. One way is to find someone impartial to do it for them. This works, but it requires another person. Another way is for one person to divide the piece, and the other person to complain (to the police, a judge, or his parents) if he doesn’t think it’s…
5825
When URL parsers disagree
Discovery and walkthrough of CVE-2023-38633 in librsvg, when two URL parser implementations (Rust and Glib) disagree on file scheme parsing leading to path traversal.
5826
Tor trip report to an FBI conference
In October I attended an FBI conference, as part of my work to try to keep Tor on good relations...
5827
Something is amiss with the Interwebs: BGP is a flapping
Something is amiss with the Interwebs! BGP is a flapping. , Author: Adrien de Beaupre
5828
Yubikey/Smartcard backed TLS servers
It has become clear that storing secrets in computers is hard. The best demo to the world that storing secrets on “online” computers is hard and sometimes devastating, is the large amounts of cryptocurrency theft due to critical keys being in memory of systems directly or indirectly connected to the internet.
5829
Flan Scan: Lightweight Network Vulnerability Scanner
Flan Scan is a thin wrapper around Nmap that converts this popular open source tool into a vulnerability scanner with an easy deployment.
5830
Smartphone can use its microphone to extract RSA decryption key from laptop
This is neat: Here, we describe a new acoustic cryptanalysis key extraction attack, applicable to GnuPG’s current implementation of RSA. The attack can extract full 4096-bit RSA decryption keys from laptop computers (of various models), within an hour, using the sound generated by the computer during the decryption of…
5831
Better Encrypted Group Chat
Broadly, an end-to-end encrypted messaging protocol is one that ensures that only the participants in a conversation, and no intermediate servers, routers, or relay systems, can read and write messages. An end-to-end encrypted group messaging protocol is one that ensures this for all participants in a conversation of…
5832
Cloudflare scrubs Aisuru botnet from top domains list
For the past week, domains associated with the massive Aisuru botnet have repeatedly usurped Amazon , Apple , Google and Microsoft in Cloudflare’s public ranking of the most frequently requested websites. Cloudflare responded by redacting Aisuru domain names from their top websites list. The chief executive at…
5833
5834
Hacking the call records of millions of Americans
Imagine if anyone could punch in a phone number from the largest U.S. cell carrier and instantly retrieve a list of its recent incoming calls—complete with timestamps—without compromising the device, guessing a password, or alerting the user. Now imagine that number belongs to a journalist, a police officer, a…
5835
How I Learned Symmetric-Key Cryptanalysis
personal web-log
5836
Carrier IQ Tries to Censor Research With Baseless Legal Threat
Last week, security researcher Trevor Eckhart posted an analysis of software produced by Carrier IQ, which describes itself as "the world's leading provider of Mobile Service Intelligence solutions." Eckhart concluded that the software, which comes by default on many mobile devices and runs quietly...
5837
Cross-Site Request Forgery
Cross-Site Request Forgery countermeasures can be greatly simplified using request metadata provided by modern browsers.
5838
Using LLMs to Generate Fuzzers
LLMs seem surprisingly good at many things. So much so that not a week goes by without someone coming up with yet another use-case for this technology, often to solve tasks quickly that traditionally took a non-trivial amount of human work to complete. Today’s example was Brendan Dolan-Gavitt’s remarkable experiment…
5839
Reverse Engineering Google Colab
Take a peek into the internals of Google Colab, and discover how we can bend the rules of Colab a little in order to adapt it to our MLOps workflow
5840
Reverse Engineering Protobuf Definitions from Compiled Binaries
How to extract raw source protobuf definitions from compiled binaries, regardless of the target architecture
5841
EU: Definition of "potential terrorists" opens door to broad information-sharing
EU member states can now collect and share information on “potential terrorists”. This category is based on a new informal definition that was agreed with no democratic scrutiny. While claiming to target those who may engage in political violence, there is potential for far broader application.
5842
Is your chip card secure? Much depends on where you bank
Chip-based credit and debit cards are designed to make it infeasible for skimming devices or malware to clone your card when you pay for something by dipping the chip instead of swiping the stripe. But a recent series of malware attacks on U.S.-based merchants suggest thieves are exploiting weaknesses in how certain…
5843
Windows 10 spies on your use of System Settings (2021)
Windows 10 spies on your use of System Settings
5844
5845
Userdir URLs like https://example.org/~username/ are dangerous
This blog is written by Hanno Böck. Unless noted otherwise, its content is licensed as CC0 .
5846
5847
5848
Amazon’s Disturbing Plan to Add Face Surveillance to Your Front Door
Recently, a patent application from Amazon became public that would pair face surveillance — like Rekognition, the product that the company is aggressively marketing to police and Immigration and Customs Enforcement — with Ring, a doorbell camera company that Amazon bought earlier this year.
5849
Hacking Airline Lounges for Free Meals
I think this is a great hack: A man bought a first-class ticket and used it to have free meals and drinks at the airport’s VIP lounge almost every day for nearly a year, Kwong Wah Yit Poh reported. The itinerary for the ticket was found to have been changed more than 300 times within a year, and the owner of the…
5850
Users Rationally Rejecting Security Advice (2009)
This paper, by Cormac Herley at Microsoft Research, sounds like me: Abstract: It is often suggested that users are hopelessly lazy and unmotivated on security questions. They chose weak passwords, ignore security warnings, and are oblivious to certicates errors. We argue that users’ rejection of the security advice…