8041
Defeating Cookie Banners
How Transcend solved the core technical problem of user tracking consent and built an alternative to pop-up cookie banners.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,773 posts.
8042
8043
Kraken Security Labs Identifies Vulnerabilities in Commonly Used Bitcoin ATM
Bitcoin ATMs offer a convenient and friendly way for consumers to purchase cryptocurrencies. That ease of use can sometimes come at the expense of security. Kraken Security Labs has uncovered multiple hardware and software vulnerabilities in a commonly used cryptocurrency ATM: The General Bytes BATMtwo (GBBATM2)…
8044
Windows 11: TPMs and Digital Sovereignty
The problem with enforcing TPMs on consumers
8045
The Big DNS Privacy Debate at FOSDEM
This weekend at the excellent FOSDEM gathering there were no less than three presentations on DNS over HTTPs.
8046
SSH Do’s and Don’ts
Do Use SSH Keys When ever you can use a key for SSH. Once you create it, you can distribute the public side widely to enable access where ever you need it. Generating one is easy: ssh-keygen -t dsa Don't Use a Blank Passphrase on Your Key This key is now your identity. Protect it.
8047
Why I Hacked Apple’s TouchID and Still Think it is Awesome
True cyber security combines advanced technology and best practice. Get tips and read articles on how to take your online security even further.
8048
Certified Malice
One unfortunate (albeit entirely predictable) consequence of making HTTPS certificates “fast, open, automated, and free” is that both good guys and bad guys alike will take advantage of the offer a…
8049
Creating a rogue CA certificate with MD5 hash collisions
We have identified a vulnerability in the Internet Public Key Infrastructure (PKI) used to issue digital certificates for secure websites. As a proof of concept we executed a practical attack scenario and successfully created a rogue Certification Authority (CA) certificate trusted by all common web browsers. This…
8050
8051
Why CISA Is Warning CISOs About a Breach at Sisense
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) said today it is investigating a breach at business intelligence company Sisense , whose products are designed to allow companies to view the status of multiple third-party online services in a single dashboard. CISA urged all Sisense customers to reset…
8052
8053
Android Full Disk Encryption Cold Boot Attack (2012)
At the end of 2011, Google released version 4.0 of its Android operating system for smartphones. For the first time, Android smartphone owners were supplied with a disk encryption feature that…
8054
Privacy-friendly alternatives to Google
Google has become synonymous with the internet, offering services from search engines to email, cloud storage, and more.
8055
How Jason Bourne Stores His Bitcoin
If you want to invest in bitcoin for the long-haul, you should address the thorny issue of how best to store them. Since people love stealing bitcoins from others more than just about anything else in this world, all storage systems must first and foremost:
8056
They told you not to reply (2008)
Breaking news, live coverage, investigations, analysis, video, photos and opinions from The Washington Post. Subscribe for the latest on U.S. and international news, politics, business, technology, climate change, health and wellness, sports, science, weather, lifestyle and more.
8057
Yubico with new 4096-bit keys and gpg-agent for ssh authentication
Collection of my projects and hacks.
8058
8059
8060
8061
8062
8063
Towards a test suite for TOTP codes
Because I'm a massive nerd, I actually try to read specification documents. As I've ranted ad nauseam before, the current TOTP spec is irresponsibly obsolete. The three major implementations of the spec - Google, Apple, and Yubico - all subtly disagree on how it should be implemented. Every other MFA app has their own…
8064
WordPress 5.2: Mitigating Supply-Chain Attacks
We wrote a cryptography library entirely in PHP to make your WordPress site secure against supply-chain attacks.
8065
Building Password Purgatory with Cloudflare Pages and Workers
I have lots of little ideas for various pet projects, most of which go nowhere ( Have I Been Pwned [https://haveibeenpwned.com/] being the exception), so I'm always looking for the fastest, cheapest way to get up and running. Last month as part of my blog post on How
8066
Bitsquatting: DNS Hijacking without exploitation
Researchers have exploited bit-errors before in amazing ways . But bit-errors can be detected and exploited in new ways on an Internet-wide scale. One of these means is by bitsquatting, or registering domain names one bit different than frequently resolved domains.
8067
2,000 NHS Security Vulnerabilities Disclosed
This is part 3 of a series of blog posts looking at the security of the UK Government's web infrastructure. Britain's National Health Service is riddled with old and insecure WordPress-based websites. Many of these sites have severe flaws including being vulnerable to XSS attacks. There is absolutely no suggestion…
8068
Vietnam's contact tracing app broadcasting a fixed ID
Prologue Bluezone ( Android , iOS ) is a Bluetooth-based contact tracing app sponsored by the Government of Vietnam and developed by a c...
8069
Olympics 2012: A Bruce Schneier Moment
An east London estate, where 700 people live, has received leaflets saying a "Higher Velocity Missile system" could be placed on a water tower. ...
8070
EFF's “Yellow Dots of Mystery” (2008)
Since late 2004, EFF has been warning the public about "printer dots" -- tiny yellow dots that appear on documents produced by many color laser printers and copiers. These yellow dots form a coded pattern on every page the printer produces and can be used to identify specific details about a...