1
2
3
How I attacked myself using Google and I ramped up a $1000 bandwidth bill
It all started with an email. From: Amazon Web Services LLC Subject: Review of your AWS Account Estimated Month to Date Billing Charges...
4
5
Schneier removed from TSA oversight meeting at TSA request
I was supposed to testify today about the TSA in front of the House Committee on Oversight and Government Reform. I was informally invited a couple of weeks ago, and formally invited last Tuesday: The hearing will examine the successes and challenges associated with Advanced Imaging Technology (AIT), the Screening of…
6
Backdoor found in a China-made US military chip
The latest news on hardware security research and achievements
7
8
9
10
The weakest link by far is Apple
Apple tech support gave the hackers access to my iCloud account. Amazon tech support gave them the ability to see a piece of information — a partial credit card number — that Apple used to release information. In short, the very four digits that Amazon considers unimportant enough to display in the clear on the web…
11
The most dangerous code in the world
Abstract: SSL (Secure Sockets Layer) is the de facto standard for secure Internet communications. Security of SSL connections against an active network attacker depends on correctly validating public-key certificates presented when the connection is established. We demonstrate that SSL certificate validation is…
12
13
UK anti-encryption law
There was some surprise in the comments of yesterday's post over the fact that the United Kingdom has effectively outlawed encryption: the UK will...
14
How the Norwegians Reacted to Terrorism
An antidote to the American cycle of threat, fear, and overspending in response to terrorism is this, about Norway on the first anniversary of its terrorist massacre: And at the political level, the Prime Minister Jens Stoltenberg pledged to do everything to ensure the country’s core values were not undermined. “The…
15
16
Lessons in website security anti-patterns by Tesco
Update, 14 Feb 2014: A year and a half on from writing this, Tesco has indeed suffered a serious security incident almost certainly as a result of some of the risks originally detailed here. Read more about it in The Tesco hack – here’s how it (probably) happened [https://www.
17
Chrome connects to three random domains at startup
When you start Chrome, it attempts to connect to three random domains. I've seen a few theories about why exactly this happens that brush up against the nefarious. The true rationale is incredibly mundane: hopefully this short summary will clear things up.
18
How github was hacked
So I commited in rails/rails repo I simply added a <input value=USER_ID name=public_key[user_id]> field to Public key update form, where U...
19
Abolish the Department of Homeland Security
I have a love/hate relationship with the Cato Institute. Most of their analysis I strongly disagree with, but some of it I equally strongly agree with. Last September 11—the tenth anniversary of 9/11—Cato’s David Rittgers published “Abolish the Department of Homeland Security“: DHS has too many subdivisions in too…
20
21
Living with HTTPS
( These are my notes from the first half of my talk at HOPE9 last weekend. I write notes like these not as a script, but so that I have at least some words ready in my head when I'm speaking. They are more conversational and less organised than a usual blog post, so please forgive me the rough edges. )
22
A Tor of the Dark Web
Tell me if you’ve been in this situation: you’re chatting about online anonymity with your wife and the other Knight-Mozilla Fellows over a pizza in Florence. A quiet-spoken stranger who had been sitting across the room walks up to your table and says “are you all here for the Tor hackathon?” You respond “why yes, yes…
23
Why does that QR Code go to justinsomnia.org?
Back in 2007 I stumbled upon something called a QR Code . It was a neat two-dimensional barcode that encodes textual information visually—with URLs being a promising application for the emerging smartphone market (thanks to the release of the iPhone that year). So I did what any self-respecting personal blogger would…
24
25
John Nash's Letter to the NSA
The National Security Agency (NSA) has recently declassified an amazing letter that John Nash sent to it in 1955. It seems that around the year 1950 Nash tried to interest some US security organs …
26
27
28
Playing chicken with cat.jpg
I was reminded of this by 37signals' response on Monday to last week's cat.jpg privacy failure . To be clear, I have a lot of sympathy for 37signals: Once someone looked in their logs and saw "cat.jpg" as the name of the one hundred millionth file they had stored, I'm sure the resulting fit of laughter significantly…
29
The EC2 firewall is broken
As most standards-aware network administrators know, blocking ICMP is evil. Sure, there are certain ICMP packets which should be blocked; but to quote RFC 2979 :
30
Followup to "I bought more than 1 million Facebook data entries for $5"
Warning: According to Facebook you are not allowed to read this post, so beware.