91
92
A possible flaw in open-source bcrypt implementations
[NOTE: See updates below and here .] I'm working on an application that requires a secure password hash. The state of the art is Colin Perc...
93
Nym Wars (Google+ "real name" rules)
I hadn't been paying much attention to the Google "Real Names" clusterfuck, because it was so obvious to me that they were going to lose this one in the press that it would all be over soon. But it's still not over, and the Google brass appear to be digging in their heels, despite the universally bad press they're…
94
95
96
Searching for "semicolon injection" bugs in embedded Linux devices
Introduction I recently bought a D-Link DCS-2121 surveillance camera. This is good stuff: Megapixel camera + microphone + speaker WiFi,...
97
98
99
Hacking Twitter's Javascript
New Twitter uses a massive amount of javascript (for a webapp). Nearly 1 Megabyte of minified, obfuscated javascript powers the site's frontend.
100
I’m sorry, but were you actually trying to remember your comical passwords?
I love a good XKCD comic; Randall Munroe has a unique way of cutting right to the crux of technology issues and always doing it in a humorous fashion. Little Bobby Tables [http://xkcd.com/327/] remains an all-time classic and it’s amazing how many times you’ll
101
102
103
104
105
Yet Another "People Plug in Strange USB Sticks" Story
I’m really getting tired of stories like this: Computer disks and USB sticks were dropped in parking lots of government buildings and private contractors, and 60% of the people who picked them up plugged the devices into office computers. And if the drive or CD had an official logo on it, 90% were installed. Of course…
106
107
1 Database Containing 35,000,000 Google Profiles. Implications?
UPDATE 2012-02-16: raver1975 released a SQL database w/35M Google Profiles as .torrent on The Pirate Bay. UPDATE 2011-06-10: Central question in the Google discussion is whether mass-aggregation of profile data…
108
109
How Dropbox sacrifices user privacy for cost savings
Note: This flaw is different than the authentication flaw in Dropbox that Derek Newton recently published . Summary Dropbox , the popular cl...
110
De-anonymizing Apple UDIDs with OpenFeint
Every iPhone, iPad and iPod touch has an associated Unique Device Identifier (UDID). You can think of the UDID as a serial number burned into the device - one that can't be removed or changed 1 . This number is exposed to app developers through an API, without requiring the device owner's permission or knowledge.
111
Public key pinning coming in Chrome 13
Starting with Chrome 13, we'll have HTTPS pins for most Google properties. This means that certificate chains for, say, https://www.google.com , must include a whitelisted public key. It's a fatal error otherwise. Credit goes to my colleague, Chris Evans, for much of this.
112
lloyd.io - How BrowserID Works
lloyd.io is the personal website of Lloyd Hilaiel, a software engineer who lives in Denver, Colorado.
113
"Schneier's Law"
Back in 1998, I wrote: Anyone, from the most clueless amateur to the best cryptographer, can create an algorithm that he himself can’t break. In 2004, Cory Doctorow called this Schneier’s law: …what I think of as Schneier’s Law: “any person can invent a security system so clever that she or he can’t think of how to…