181
182
183
Building a PGP web of trust that people will actually use
Back in the early 1990s, PGP introduced the concept of web of trust (WoT)- a means by which users of personal encryption can know whether or...
184
We scanned the Internet for port 22
Yesterday (Sept. 12) we scanned the entire Internet for port 22 -- the port reserved for "SSH", the protocol used by sysadmins to remotely l...
185
Linux Foundation Secure Boot System Released
As promised, here is the Linux Foundation UEFI secure boot system. This was actually released to us by Microsoft on Wednesday 6 February, but with travel, conferences and meetings I didn’t really get time to validate it all until today. The files are here
186
Insecurities in the Linux /dev/random
New paper: “Security Analysis of Pseudo-Random Number Generators with Input: /dev/random is not Robust, by Yevgeniy Dodis, David Pointcheval, Sylvain Ruhault, Damien Vergnaud, and Daniel Wichs. Abstract: A pseudo-random number generator (PRNG) is a deterministic algorithm that produces numbers whose distribution is…
187
Deconstruction of Pinkie Pie's 64-bit Chrome exploit
Back in November 2012, a Chrome Releases blog post mysteriously stated: "Congratulations to Pinkie Pie for completing challenge: 64-bit exp...
188
Bruce Schneier awarded fellowship at Harvard's Berkman Center
I have been awarded a fellowship at the Berkman Center for Internet and Society at Harvard University, for the 2013–2014 academic year. I’m excited about this; Berkman and Harvard is where a lot of the cool kids hang out, and I’m looking forward to working with them this coming year. In particular, I have three goals…
189
How HTTPS Stops Attackers: What Every Web Dev Should Know
Hartley writes about full stack software engineering and AI-driven software development.
190
191
Applied Cryptography Engineering
Applied Cryptography taught two generations of developers what they know about crypto, and it is a dreadful instruction manual. The book to replace it with, and what you still have to learn after.
192
Facebook paid $4.5K for disclosure of my user account exploit
Back in 2009 I found a major security exploit on both Facebook and the than popular MySpace which exposed access to a user's personal data. I reported both data leaks to the social networks, and…
193
Time-lock encryption
How do you encrypt a file such that it can be decrypted after a date, but not before? Use serial computations for proof-of-work using successive squaring, chained hashes, or witness encryption on blockchains.
194
Who Does Skype Let Spy?
Lately I’ve been thinking a lot about power and the Internet, and what I call the feudal model of IT security that is becoming more and more pervasive. Basically, between cloud services and locked-down end-user devices, we have less control and visibility over our security—and have no point but to trust those in power…
195
196
197
Bypassing Gogo’s Inflight Internet Authentication
Two weeks ago I attended SIGCSE 2012 in Raleigh, NC. The plane on my return flight had Internet access through Gogo’s Inflight Internet. While I think it’s incredibly awesome that Internet access is readily available to those who travel by plane, I personally feel it is not worth …
198
199
200
201
Android Bug Superior to Master Key
Assuming you enjoy this article, I encourage you to read the next one in the series: Yet Another Android Master Key Bug .
202
Liberty Reserve Founder Arrested, Site Shuttered
The founder of Liberty Reserve , a digital currency that has evolved as perhaps the most popular form of payment in the cybercrime underground, was reportedly arrested in Spain this week on suspicion of money laundering. News of the law enforcement action may help explain an ongoing three-day outage at…
203
204
Achilles Heel of OAuth or Why Facebook Adds #_=_
This is a short addition to the previous rants on OAuth problems. We've got Nir Goldshlager working on our side (he simply loves bounties...
205
A Really Good Article on How Easy it Is to Crack Passwords
Ars Technica gave three experts a 16,000-entry encrypted password file, and asked them to break them. The winner got 90% of them, the loser 62%—in a few hours. The list of “plains,” as many crackers refer to deciphered hashes, contains the usual list of commonly used passcodes that are found in virtually every breach…
206
207
Exploiting a Go Binary
Earlier this year, tylerni7 showed us a proof of concept for a 32 bit Go exploit using this issue . geohot and I had a wager over who could get the first remote code execution on play.golang.org : he won, but just barely ;-). Props also to ricky for helping to find the underlying cause/writing the patch. Here is a…
208
Two-Factor Authentication and the Police State
In Britain - and many other countries - the police can legally force you to divulge your passwords. Whether it's to an encrypted file, a social network, or your email account, the state can legally rifle through your most intimate thoughts and (potentially) pose as you online. As we've recently seen, this can be done…
209
IDIV DoS (INT_MIN / -1)
A little fun for the last day of 2012: how to crash a program via division? x86’s IDIV instruction traps not only on division by zero, but also on INT_MIN / -1 (signed integer overflow).
210
How to botch TLS forward secrecy
There's been some discussion about forward secret TLS recently, spurred, I think, by this piece from Declan McCullagh on CNET.