211
Keeping Passwords in Source Control
I learned a neat tip from my co-worker, Craig Silverstein ( more on Craig joining Khan Academy ), recently and I thought others might find it to be useful.
212
213
Faking Bluetooth LE
Dmitry.GR: Creating BTLE-compliant advertisement packets, so that iOS and android devices can see and parse them.
214
XSS in Gmail through Rapportive
A blog on security, malware, cryptography, pentesting, javascript, php and whatnots
215
216
Is Unicode Safe?
Unicode is just too complex to ever be secure.  — Bruce Schneier, 2000 Over the last 25 years Unicode has succeeded. It hasn't displaced all other character encodings, but it's clearly on its way there. It's supported widely enough that it's a compatible choice, new projects use it, and it's becoming the…
217
Nice Security Mindset Example
A real-world one-way function: Alice and Bob procure the same edition of the white pages book for a particular town, say Cambridge. For each letter Alice wants to encrypt, she finds a person in the book whose last name starts with this letter and uses his/her phone number as the encryption of that letter. To decrypt…
218
219
220
221
Senator Feinstein Admits the NSA Taps the Internet Backbone
We know from the Snowden documents (and other sources) that the NSA taps the Internet backbone through secret agreements with major US telcos., but the US government still hasn’t admitted it. In late August, the Obama administration declassified a ruling from the Foreign Intelligence Surveillance Court. Footnote 3…
222
Microsoft ‘Mortally Wounds’ SHA-1
Microsoft has announced that CAs in its root program may not issue certs signed using the SHA-1 algorithm, starting just over two years from now, and that Windows will start refusing to recognise such certs starting just over 3 years from now.
223
224
NSA E-Mail Eavesdropping
More Snowden documents analyzed by the Guardian—two articles—discuss how the NSA collected e-mails and data on Internet activity of both Americans and foreigners. The program might have ended in 2011, or it might have continued under a different name. This is the program that resulted in that bizarre tale of Bush…
225
226
Licenses Over Data: A Case Study with Github v BitBucket
Our Commercial Lawyers deliver legal solutions to businesses in Brisbane and across Australia to meet their commercial targets.
227
Adobe credentials and the serious insecurity of password hints
Adobe had a little issue the other day with the small matter of 150 million accounts being breached and released to the public. Whoops. So what are we talking about? A shed load of records containing an internal ID, username, email, encrypted password and a password hint. Naked Security did
228
PingFS
shysecurity blog
229
Nordstrom Finds Cash Register Skimmers
Scam artists who deploy credit and debit card skimmers most often target ATMs, yet thieves can also use inexpensive, store-bought skimming devices to compromise modern-day cash registers. Just this past weekend, for instance, department store chain Nordstrom said it found a half-dozen of these skimmers affixed to…
230
The Factoring Cryptopocalypse
The key detail to understand about the work in the Joux papers is that it is limited to solving discrete logarithm problems over fields of small characteristic . As interesting as the work is, mathematically, it should not be a great surprise to cryptographers: We've known for over a decade that small-characteristic…
231
Why DRM is such a fucking stupid idea
Digital comics publisher JManga is collapsing . Two weeks from now you will no longer be able to "purchase" anything from them. Two months from now, anything that was "purchased" from them will cease to exist. If you spent hundreds of pounds in their store then, well, that's bad luck for you. This…
232
Why to use Twitter, Facebook and Google Plus share links and not buttons
Use share buttons for Facebook, Twitter and Google Plus in your blog, that does not expose your users to tracking, or violate their privacy. Use share links to do this
233
Most TOR servers are vulnerable (NSA crackable)
After more revelations, and expert analysis, we still aren't precisely sure what crypto the NSA can break. But everyone seems to agree that...
234
235
236
Comcast caught hijacking web traffic
On November 20th, 2012 Comcast hijacked my HTTP traffic and re-routed it through their own servers, injecting a “notice” on the page before completing the request. What this means is instead of my web request being routed to the website I wanted to visit, Comcast took it upon themselves to hijack my web…