8671
Final post on Javascript crypto
The talk I gave last year on common crypto flaws still seems to generate comments. The majority of the discussion is by defenders of Javascript crypto. I made JS crypto a very minor part of the tal…
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,776 posts.
8672
Countering "Trusting Trust"
Way back in 1974, Paul Karger and Roger Schell discovered a devastating attack against computer systems. Ken Thompson described it in his classic 1984 speech, “Reflections on Trusting Trust.” Basically, an attacker changes a compiler binary to produce malicious versions of some programs, INCLUDING ITSELF. Once this is…
8673
CrowdStrike’s work with the Democratic National Committee: Setting the record straight
Get the key facts about CrowdStrike's work with the Democratic Natiional Committee in 2016 and debunk the false claims that have been made about our work.
8674
Changes to Trusted Certificate Authorities in Android Nougat
News and insights on the Android platform, developer tools, and events.
8675
NIST is No Longer Recommending Two-Factor Authentication Using SMS
NIST is no longer recommending two-factor authentication systems that use SMS, because of their many insecurities. In the latest draft of its Digital Authentication Guideline, there’s the line: [Out of band verification] using SMS is deprecated, and will no longer be allowed in future releases of this guidance.
8676
SSL added and removed here ;-)
This post is part of our ongoing series about networks, privacy, governments and (of course) online security tools like Cloak. Last week, the Washington Post unleashed yet another bombshell revelation from the Snowden documents.
8677
Google: Security Keys Neutralized Employee Phishing
Google has not had any of its 85,000+ employees successfully phished on their work-related accounts since early 2017, when it began requiring all employees to use physical Security Keys in place of passwords and one-time codes, the company told KrebsOnSecurity.
8678
PHP2Shell by Calif Research
A tale of two PHP remote vulnerabilities
8679
Errata: Steve Gibson
a summary of Steven Gibson events and quotes demonstrating charlatan status
8680
How Plex is doing HTTPS for all its users
This week Plex , a self-hosted media server, announced that they now offer TLS to secure all connections, including those to the user’s servers. This is actually pretty interesting.
8681
A new layer of security for certified Android devices
Starting in 2026 and in select countries first, Android apps must be registered to a verified developer in order to be installed.
8682
Cloudflare supports Privacy Pass
Cloudflare supports Privacy Pass, a recently-announced privacy-preserving protocol developed in collaboration with researchers from Royal Holloway and the University of Waterloo.
8683
sean cassidy : Don't Pipe to your Shell
It's everywhere . Sometimes they tell you to ignore certificates as well (looking at you, Salt). That's dumb.
8684
LavaRand in Production: The Nitty-Gritty Technical Details
As some of you may know, there's a wall of lava lamps in the lobby of our San Francisco office that we use for cryptography. In this post, we’re going to explore how that works in technical detail.
8685
The Linux Kernel, CDDL and Related Issues
The Software Freedom Law Center provides legal representation and other law related services to protect and advance Free and Open Source Software.
8686
Banking Applications Compatibility with GrapheneOS
Maintained Compatibility List for International Banking Apps This list includes banking apps that have been tested, submitted, reviewed, and verified as compatible. LIST | SUBMIT | UPDATE | POSSIBLE WORKAROUND SOLUTIONS Introduction Welcome to the crowd-sourced dataset for GrapheneOS users on currently supported…
8687
Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers
Team82 researched the attack surface of the Danfoss AK-SM 800A refrigeration controller platform and identified multiple vulnerabilities affecting the embedded web management interface. Team82 disclosed the vulnerabilities to Danfoss, which addressed them in a new firmware version. Successful exploits of the…
8688
SHA-1 Broken
SHA-1 has been broken. Not a reduced-round version. Not a simplified version. The real thing. The research team of Xiaoyun Wang, Yiqun Lisa Yin, and Hongbo Yu (mostly from Shandong University in China) have been quietly circulating a paper describing their results: collisions in the the full SHA-1 in 2**69 hash…
8689
What’s the matter with PGP?
Last Thursday, Yahoo announced their plans to support end-to-end encryption using a fork of Google’s end-to-end email extension. This is a Big Deal. With providers like Google and Yahoo onboa…
8690
Randomness 101: LavaRand in Production
As some of you may know, there's a wall of lava lamps in the lobby of our San Francisco office that we use for cryptography. In this post, we’re going to explore how that works.
8691
Is curl|bash insecure?
Take control of your web by running your own personal cloud server with Sandstorm.
8692
iCloud Private Relay: What Cloudflare Customers Need to Know
iCloud Private Relay is an Apple service for browsing more privately and securely. Learn how to ensure the best user experience using iCloud Private Relay.
8693
Android | Madaidan's Insecurities
By default, Android has a strong security model and incorporates full system SELinux policies , strong app sandboxing , full verified boot , modern exploit mitigations like fine-grained, forward-edge Control Flow Integrity and ShadowCallStack , widespread use of memory-safe languages (Java / Kotlin) and more. As such…
8694
Warrant Canary Frequently Asked Questions
What is a warrant canary? A warrant canary is a colloquial term for a regularly published statement that a service provider has not received legal process that it would be prohibited from saying it had received. Once a service provider does receive legal process, the speech prohibition goes into...
8695
Comcast caught hijacking web traffic
On November 20th, 2012 Comcast hijacked my HTTP traffic and re-routed it through their own servers, injecting a “notice” on the page before completing the request. What this means is instead of my web request being routed to the website I wanted to visit, Comcast took it upon themselves to hijack my web…
8696
Qwest CEO: NSA Punished Qwest for Refusing to Participate in Illegal Surveillance--Pre-9/11!
When Qwest refused the NSA’s illegal request that it hand over its customers’ data without a warrant, the NSA wasn’t happy. According to former Qwest CEO Joseph Nacchio, the government hit back for the telecom’s refusal by denying them lucrative contracts (log-in required) worth hundreds of...
8697
Yubico proposes WebAuthn protocol extension to simplify backup security keys
Yubico proposes a new WebAuthn extension to the World Wide Web Consortium (W3C) to add a user-friendly solution for backup security keys, and receives cryptographic proof from researchers at the Surrey Center for Cyber Security.
8698
WhatsApp's Signal Protocol integration is now complete
At Open Whisper Systems, our goal is to make private communication simple. A year ago, we announced a partnership with WhatsApp and committed to integrating the Signal Protocol into their product, moving towards full end-to-end encryption for all of their users by default. Over the past year, we...
8699
Private Access Tokens: eliminating CAPTCHAs on iPhones and Macs with open standards
Today we’re announcing Private Access Tokens, a completely invisible, private way to validate that real users are visiting your site
8700
