151
152
153
Lifetimes of cryptographic hash functions
Quick summary of my recommendations on compare-by-hash: If you are using compare-by-hash to generate addresses for data that can be supplied by malicious users, you should have a plan to migrate to a new hash every few years. For example, BitTorrent falls into this category, but rsync doesn't. Keep in mind that new…
154
155
Anonymity Is Hard
Anonymity in the real world is very hard In late 2011 Hezbollah rolled up a CIA spy ring in Lebanon. This provides an interesting lesson in CIA …
156
How Browsers Store Your Passwords (and Why You Shouldn't Let Them)
Introduction In a previous post , I introduced a Twitter bot called dumpmon which monitors paste sites for account dumps, configuration fi...
157
158
Worthless security claims
I’ve been considering purchasing one of these t-shirts: This shirt would announce to everyone who crosses my path that I am, in fact, the world’s greatest lover. They would know this because I have a t-shirt that tells them so and it would give them enormous
159
The UK "Porn" Filter Blocks Kids' Access To Tech, Civil Liberties Websites
It fell to the UK Tories to actually implement the Nanny State. Too bad Nanny Tory does not want kinds to read up on tech web sites, or civi...
160
Surveillance and the Internet of Things
The Internet has turned into a massive surveillance tool. We’re constantly monitored on the Internet by hundreds of companies—both familiar and unfamiliar. Everything we do there is recorded, collected, and collated—sometimes by corporations wanting to sell us stuff and sometimes by governments wanting to keep an eye…
161
Geohot presents an evasi0n7 writeup
Hi, I'm on a plane from SFO to New York, and made something for you. Not even a rap song. ******* geohot( @tomcr00se ) presents an evasi0n7 writeup ******* == Intro == I was bored, reversed, wrote this write-up, and wanted to do something with it. I tried to sell it to the Chinese for $7 and a trip to the Pizza Hut…
162
A Profanity-Laced Video Game Password That Breaks Everything
Most of these passwords were gibberish that required a pen-and-paper to write down and remember. One password, however, is more memorable, and much more sinister.
163
Finding Sociopaths on Facebook
On his blog, Scott Adams suggests that it might be possible to identify sociopaths based on their interactions on social media. My hypothesis is that science will someday be able to identify sociopaths and terrorists by their patterns of Facebook and Internet use. I’ll bet normal people interact with Facebook in ways…
164
RJS leaking vulnerability in multiple Rails applications
I wrote about this problem in May, without showcases, just a theoretical post http://homakov.blogspot.com/2013/05/do-not-use-rjs-like-techn...
165
Linkedin's Response to My "Phishing with Intro" Post
Security and Programming Blog
166
Can I Be Trusted?
Slashdot asks the question: I’m a big fan of Bruce Schneier, but just to play devil’s advocate, let’s say, hypothetically, that Schneier is actually in cahoots with the NSA. Who better to reinstate public trust in weakened cryptosystems? As an exercise in security that Schneier himself may find interesting, what…
167
ISP Advertisement Injection - CMA Communications
Apple Inc. endorsing H&R Block with a beautiful bright green banner ad, compliments of CMA Communications. Tired from the day’s ev...
168
PuTTY 0.63 released, fixing four security holes
Home | FAQ | Feedback | Licence | Updates | Mirrors | Keys | Links | Team Download: Stable · Snapshot | Docs | Privacy | Changes | Wishlist
169
A simple solution to credit card fraud, and why you won't see it any time soon
This is the first in what will probably be a very long series of articles. Ultimately, this is the beginning of the story of why I stopped ...
170
171
Detaining David Miranda
Last Sunday, David Miranda was detained while changing planes at London Heathrow Airport by British authorities for nine hours under a controversial British law—the maximum time allowable without making an arrest. There has been much made of the fact that he’s the partner of Glenn Greenwald, the Guardian reporter whom…
172
173
Mail from the (Velvet) Cybercrime Underground
Over the past six months, “fans” of this Web site and its author have shown their affection in some curious ways. One called in a phony hostage situation that resulted in a dozen heavily armed police surrounding my home . Another opened a $20,000 new line of credit in my name. Others sent more than $1,000 in bogus…
174
How to implement HTTPS in an insufficient manner
HTTPS or SSL or TLS or whatever you want to call it can be a confusing beast. Some say it’s just about protecting your password and banking info whilst the packets are flying around the web but I’ve long said that SSL is not about encryption [https://www.
175
Excess Automobile Deaths as a Result of 9/11
People commented about a point I made in a recent essay: In the months after 9/11, so many people chose to drive instead of fly that the resulting deaths dwarfed the deaths from the terrorist attack itself, because cars are much more dangerous than airplanes. Yes, that’s wrong. Where I said “months,” I should have…
176
1% of CMS-Powered Sites Expose Their Database Passwords (2011)
Feross Aboukhadijeh is a computer security researcher, teacher, web developer, designer, long distance runner, gamer, music lover, and builder of websites that (sometimes) go viral.
177
178
179
RSA warns developers not to use RSA products
In today’s news of the weird, RSA (a division of EMC) has recommended that developers desist from using the (allegedly) ‘backdoored’ Dual_EC_DRBG random number generator — w…
180
What I've Been Thinking About
I’m starting to think about my next book, which will be about power and the Internet—from the perspective of security. My objective will be to describe current trends, explain where those trends are leading us, and discuss alternatives for avoiding that outcome. Many of my recent essays have touched on various facets…