In my estimation, there has not been in American history a more important leak than Edward Snowden’s release of NSA material – and that definitely includes the Pentagon Papers 40 years ago. Snowden’s whistleblowing gives us the possibility to roll back a key part of what has amounted to an “executive coup” against the…
But the latest revelations scare me. It's one thing to find and exploit vulnerabilities in software; there's a lot of software out there which was written by developers with very little understanding of cryptography or software security, and it shows. If you care about security, we reasoned, stick to software written…
History, background, visiting, ordering, using, & analyzing the drug market Silk Road 1
In which I relate my experience as an NSA employee and impart my thoughts on the policies in place, my former coworkers, and the current cyber war.
Today, at around 2:30 PM EST, Scripts went down. For most MIT students, this means a few class websites are inaccessible, a few friends' b...
blog about networking, cameras, old gear, and xmpp
RDS-TMC uses an encryption algorithm simple enough to be run using pen-and-paper hardware.
By definition, CAPTCHA should be easy to read by humans but hard to read by machines. Apparently, they don’t agree with that at D&B:
Since I started working with Snowden’s documents, I have been using a number of tools to try to stay secure from the NSA. The advice I shared included using Tor, preferring certain cryptography over others, and using public-domain encryption wherever possible. I also recommended using an air gap, which physically…
We’re afraid of risk. It’s a normal part of life, but we’re increasingly unwilling to accept it at any level. So we turn to technology to protect us. The problem is that technological security measures aren’t free. They cost money, of course, but they cost other things as well. They often don’t provide the security…
Update (July 2015): This post is now rather outdated, and the procedure for modifying your private key files is no longer recommended. A better solution is to use ssh-keygen -o .
Back in June, when the contents of Edward Snowden’s cache of NSA documents were just starting to be revealed and we learned about the NSA collecting phone metadata of every American, many people—including President Obama—discounted the seriousness of the NSA’s actions by saying that it’s just metadata. Lots and lots…
Coverage: Hacker News , Slashdot , BoingBoing , RT America News , Tumblr , RightThisMinute , RTM update , PapersPlease 2014 & 2015
An identity theft service that sold Social Security and drivers license numbers — as well as bank account and credit card data on millions of Americans — purchased much of its data from Experian , one of the three major credit bureaus, according to a lengthy investigation by KrebsOnSecurity.
Previously on Github: XSS , CSRF ( My github followers are real , I gained followers using CSRF on bitbucket ), access bypass, mass assignm...
TL;DR We (me and @isciurus ) chained several different bugs in Facebook, OAuth2 and Google Chrome to craft an interesting exploit. Mallory...
Earlier this month I discovered that my new LG Smart TV was displaying ads on the Smart landing screen. After some investigation, I f...
Alice and Bob are crossword enthusiasts. Every morning they rush to complete the Daily Telegraph cryptic crossword . One morning Alice fini...
After DoctorBeet’s blog post detailing his LG TV’s shady logging practices I decided to have a look at what my own was doing. To start off I couldn’t seem to find an option to disable logging…
Interesting speculation that the NSA is storing everyone’s phone calls, and not just metadata. Definitely worth reading. I expressed skepticism about this just a month ago. My assumption had always been that everyone’s compressed voice calls is just too much data to move around and store. Now, I don’t know. There’s a…
How to create perfect secret messages that can be decoded using just your eyes.
