Topics /
The most popular blog posts about security & privacy on Hacker News. 8,773 posts.
On the completely impossible situation of blocking the Tor .onion TLD to avoid leaks, but at the same time not block it to make users able to do what they want. dot-onion leaks The onion TLD is a Tor specific domain that does not mean much to the world outside of Tor. If you try … Continue reading Leeks and leaks →
Over the weekend, a Have I Been Pwned [https://haveibeenpwned.com/] (HIBP) subscriber contacted me after they found their Spotify credentials online. It turns out that this particular woman went searching for her specific password after finding "some guy listening to Mexican music from a foreign device on my acct"
Inspiration of how we can use PDF as an attack vector and perform multiple attacks with huge subsequences to the victim.
As the New York Times posts yet another breathless story about Stuxnet, I’m surprised that no one has pointed out its obvious deficiencies. Everyone seems to be hyperventilating about its pur…
Delve into Yubico's comprehensive guide about passkeys, a term encapsulating FIDO/WebAuthn credentials that offer a secure, passwordless experience.
It's my strong opinion that your company should avoid the Grsecurity product sold at grsecurity.net because it presents a contributory infringement and breach of contract risk.
So, when I read that Assassin's Creed 2 for the PC would fight piracy by requiring a live internet connection all the time when you were pla...
ACKNOWLEDGMENTS I thank Kent Gladstone, Science Applications International Corporation (SAIC), for a critical reading of both manuscripts. Many critical comments and corrections from Brad Howard have made the Mini-Tutorial a better adventure for anyone who follows his path.
Miguel de Icaza's Blog
A guy from Russia just earned $100,000. Crowdsourcing a More Secure Future
Authorization terminology often conflates ideas and presents complementary technologies as rivals. This post proposes a new taxonomy.
Encrypting data: Use AES in CTR (Counter) mode, and append an HMAC . AES is about as standard as you can get, and has done a good job of resisting cryptologic attacks over the past decade. Using CTR mode avoids the weakness of ECB mode, the complex (and bug-prone) process of padding and unpadding of partial blocks (or…
This event is when censorship overstepped a very serious mark.
New discovery underscores security implications of AI-powered development and the rise of Vibe Coding Platforms.
Bashing the European Union’s General Data Protection Regulation (GDPR) seems to have become one of American activists’ favourite hobbies in the tech field. Some criticism is entirely justified. But many claims that the GDPR is “counterproductive” or “misses the point” are based on misconceptions, rather than an…
This month, Let’s Encrypt is turning on new infrastructure to support revoking certificates via Certificate Revocation Lists. Despite having been largely supplanted by the Online Certificate Status Protocol for over a decade now, CRLs are gaining new life with recent browser updates. By collecting and summarizing CRLs…
In the midst of an epic troll on a country-wide railway system, we discovered a new threat actor and their reusable wiper called Meteor.
In 2008, we launched Chrome with the goal of building a speedy, simple, secure and stable web for everyone, everywhere. Ten years later, use...
TunnelBear works with Cure53 to complete consumer VPN industry's first public security audit.
Microsoft is shipping a patch to eliminate SHA-1 hashes from its update process. There’s nothing wrong with eliminating SHA-1—but their reasoning may be very interesting.
At Heroku, we want to make it easy for everyone to be able to learn and explore our service, and the related ecosystem of technologies, for free - be it...
Domain separation bugs have bitten Bitcoin, Ethereum, TLS, and AWS. Snowpack solves this by embedding random domain separators directly in the IDL.
There is a war happening. We are immersed in an evolving, ongoing conflict: an Information World War in which state actors, terrorists, and ideological…
TLDR : My robot cat litter box bricks itself after a set number of washes with each soap cartridge so I reverse engineered and suppressed the verfication process to enable refilling.
Kraken Security Labs has devised a way to extract seeds from both cryptocurrency hardware wallets offered from industry leader Trezor, the Trezor One and Trezor Model T. The attack requires just 15 minutes of physical access to the device. This is the first time that the detailed steps for a current attack against…
Wireless attacks on aircraft instrument landing systems Sathaye et al., USENIX Security Symposium 2019 It’s been a while since we last looked at security attacks against connected real-world entiti…
All our apps (Proton Mail, Proton Drive, etc) are open source and independently audited. Anyone can inspect our software and confirm our encryption works.
