Topics /
The most popular blog posts about security & privacy on Hacker News. 391 posts.
LibreSSL was officially announced to the world just about exactly five months ago. Bob spoke at BSDCan about the first 30 days. For those who weren't there, I'll quickly rehash some of that material. Also, it's always best to start at the beginning, but then I'll try to focus on some new material and updates.
I am a software engineer based out of Seattle, WA
Today I am going to publicly disclose a critical vulnerability I have found during my research in PayPal, This vulnerability enabled me to completely bypass the CSRF Prevention System implemented by PayPal, The vulnerability is patched very fast and PayPal paid me the maximum bounty they give ;).
Update (Oct 22 13:15 UTC): Windows users that are affected by Tor Browser crashes might try to...
Access to this page requires authorization. You can try signing in or changing directories .
Security and Programming Blog
Update – Since this was posted, Max Allan and Damion Yates have investigated further and found that BT are intercepting DNS queries and replying with doctored DNS results, which I didn’…
I don’t have a lot to say about the Sony hack, which seems to still be ongoing. I want to highlight a few points, though. At this point, the attacks seem to be a few hackers and not the North Korean government. (My guess is that it’s not an insider, either.) That we live in the world where we aren’t sure if any given…
Can I drop a pacemaker 0day at DefCon that is capable of killing people? Computers now run our cars. It's now possible for a hacker to i...
Early results from my scan: there's about 3000 systems vulnerable just on port 80, just on the root "/" URL, without Host field. That doesn'...
With a bit of care and a cooperative compiler, we can zero a buffer — but that's not what we need. What we need to do is zero every location where sensitive data might be stored. Remember, the whole reason we had sensitive information in memory in the first place was so that we could use it; and that usage almost…
Heartbleed is a catastrophic bug in OpenSSL: “The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of…
Posted by Adam Langley, Security Engineer On Wednesday, July 2, we became aware of unauthorized digital certificates for several Google ...
San Francisco - The Electronic Frontier Foundation (EFF) today presented a federal court with a detailed explanation of how the NSA taps into the Internet backbone and requested the judge rule that the agency is violating the Fourth Amendment by copying and searching the collected data. EFF argues...
Yesterday afternoon, Ars Technica published a story reporting two possible logs of Heartbleed attacks occurring in the wild, months before Monday's public disclosure of the vulnerability. It would be very bad news if these stories were true, indicating that blackhats and/or intelligence agencies...
My wife likes to set reminders for herself in Google Calendar. Recently, she added a note to her personal Google Calendar reading "Email alice@example.com to discuss pay rise" and set the date for a few months from now. She'd had a discussion with her boss, Alice, and they'd agreed to talk about salary later in the…
June 30th, 2014 marks a turning point for Austria. Not only was the Vorratsdatenspeicherung (data retention) terminated preliminarily for good (no, really), the operation of TOR exit nodes supposedly was also declared a criminal offense by a regional criminal court. The accused was operating a TOR exit node which was…
The government is using shaky legal arguments to silence major Internet companies without giving them – or the public – the opportunity to respond. In three separate recent cases, the government has sent a grand jury subpoena to Yahoo or Twitter and requested a gag order from a magistrate judge, attempting to bar…
Passwordless is an authentication middleware for Node.js that improves security for your users while being fast and easy to deploy. The last months were very exciting for everyone interested in ...
