7771
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,773 posts.
7772
Smashing the state machine: the true potential of web race conditions
For too long, web race condition attacks have focused on a tiny handful of scenarios. Their true potential has been masked thanks to tricky workflows, missing tooling, and simple network jitter hiding
7773
How Not to Redact a Warhead
How the wrong settings on a photocopier has let us have a glimpse at a forbidden image of a modern thermonuclear warhead.
7774
SQL Injection Isn't Dead: Smuggling Queries at the Protocol Level
PDF slides from a presentation by Paul Gerste at DEF CON 32. It turns out some databases have vulnerabilities in their binary protocols that can be exploited by carefully crafted …
7775
Exploiting a Go Binary
Earlier this year, tylerni7 showed us a proof of concept for a 32 bit Go exploit using this issue . geohot and I had a wager over who could get the first remote code execution on play.golang.org : he won, but just barely ;-). Props also to ricky for helping to find the underlying cause/writing the patch. Here is a…
7776
Reversing the AMD Secure Processor (PSP) – Part 2: Cryptographic Co-Processor
Part one: https://dayzerosec.com/blog/2023/04/17/reversing-the-amd-secure-processor-psp.html This is a follow-up part 2 to my previous post on the AMD Secure Processor (formerly known as the Platform Security Processor or "PSP"). In that post, I mentioned that the Cryptographic Co-Processor (CCP) is an essential…
7777
Teleport 1.3 adds support for SSH authentication with U2F keys
We are excited to announce that Teleport now supports Universal 2nd Factor out of the box.
7778
7779
Bypass PayPal's Two-Factor Authentication
Explore the Duo Blog for expert tips, security insights, and resources to stay updated on the latest in security and access management trends.
7780
7781
RSA: Theory and Implementation
RSA has been a staple of public key cryptography for over 40 years, and is still being used today for some tasks in the newest TLS 1.3 standard. This post describes the theory behind RSA - the math that makes it work, as well as some practical considerations; it also presents a complete implementation of RSA key…
7782
Reverse Shell from an OpenVPN Configuration File
While doing background research on OpenVPN I stumbled upon an interesting question on Stack Exchange.
7783
7784
7785
Millions of Binaries Later: A Look into Linux Hardening in the Wild
With Sophos Cloud Native Security, you can easily integrate protection across multiple environments while minimizing detection time and response.
7786
Enigma Crypto Transmission from KPH at 426 KHz and Shortwave
DA was a part of our KPH project from the beginning. She learned her trade at US Coast Guard master station NMC, adjacent to KPH. At NMC she earned the coveted gold lightning bolt radnoman’s insignia (there was no such thing as a radiowoman in the Coast Guard). She also acquired the salty vocabulary she needed to hold…
7787
7788
The rise of multivector DDoS attacks
It's been a while since we last wrote about Layer 3/4 DDoS attacks on this blog. This is a good news - we've been quietly handling the daily onslaught of DDoS attacks. Since our last write-up, a handful of interesting L3/4 attacks have happened. Let's review them.
7789
Supporters of Mexico’s Soda Tax Targeted with NSO Exploit Links (2017)
An investigation revealing that Mexican soda tax supporters were targeted with NSO Group's government-exclusive spyware and exploit framework.
7790
Pegasus vs. Predator
Two Egyptians—exiled politician Ayman Nour and the host of a popular news program (who wishes to remain anonymous)—were hacked with Predator spyware, built and sold by the previously little-known mercenary spyware developer Cytrox. The phone of Ayman Nour was simultaneously infected with both Cytrox’s Predator and NSO…
7791
Sq, Sequoia PGP's CLI, Released
Sequoia is a modular OpenPGP implementation in Rust.
7792
7793
AI Meets Cryptography 1: What AI Found in Cloudflare's Circl
We pointed our AI audit pipeline at Cloudflare's CIRCL experimental cryptography library and confirmed seven real bugs, from a critical float64 precision loss in threshold RSA to a complete access-control break in attribute-based encryption. All seven are now fixed upstream. This is the first post in a series on bugs…
7794
That 16B password story (a.k.a. "data troll")
Spoiler: I have data from the story in the title of this post, it's mostly what I expected it to be, I've just added it to HIBP where I've called it "Data Troll", and I'm going to give everyone a lot more context below. Here goes:
7795
7796
Mental health websites don't have to sell user data but most still do
The changes discussed in this article are based on a second analysis performed in late November, 3 months after the original study Your Mental Health is for Sale and following the exact same methodology.
7797
Let's Not Encrypt (2019)
Let's Discuss the organization providing a false sense of security at an unbeatable price.
7798
1Password X: A look at the future of 1Password in the browser
1Password X is our brand new, full-featured experience that runs entirely in your browser. Find out what it can do.
7799
The quest for a family-friendly password manager
Personal blog of Julien (jvoisin) Voisin
7800
More people are searching for an inbox that protects their privacy
Google searches for privacy-focused Gmail alternatives have steadily increased since 2019. We examine the numbers and potential reasons why.