61
Why Android SSL was downgraded from AES256-SHA to RC4-MD5 in late 2010
blog about networking, cameras, old gear, and xmpp
62
EFF Makes Formal Objection to DRM in HTML5
San Francisco - Today the Electronic Frontier Foundation (EFF) filed a formal objection to the inclusion of digital rights management (DRM) in HTML5, arguing that a draft proposal from the World Wide Web Consortium (W3C) could stymie Web innovation and block access to content for people across the...
63
64
Why you should not trust emails sent from Google
As you might know, Google is running a vulnerability reward program , where they award researchers monetary awards or a place in their Hall of Fame when they responsibly disclose vulnerabilities. With this in mind, I was scooping around on several Google services, including Google Scholar. As I recently started a PhD…
65
A determined 'hacker' decrypts RDS-TMC
RDS-TMC uses an encryption algorithm simple enough to be run using pen-and-paper hardware.
66
Worst CAPTCHA Ever
By definition, CAPTCHA should be easy to read by humans but hard to read by machines. Apparently, they don’t agree with that at D&B:
67
68
69
70
71
72
Air Gaps
Since I started working with Snowden’s documents, I have been using a number of tools to try to stay secure from the NSA. The advice I shared included using Tor, preferring certain cryptography over others, and using public-domain encryption wherever possible. I also recommended using an air gap, which physically…
73
74
Our Newfound Fear of Risk
We’re afraid of risk. It’s a normal part of life, but we’re increasingly unwilling to accept it at any level. So we turn to technology to protect us. The problem is that technological security measures aren’t free. They cost money, of course, but they cost other things as well. They often don’t provide the security…
75
NSA Spying Documents to be Released As Result of EFF Lawsuit
In a major victory in one of EFF's Freedom of Information Act (FOIA) lawsuits, the Justice Department conceded yesterday that it will release hundreds of pages of documents, including FISA court opinions, related to the government’s secret interpretation of Section 215 of the Patriot Act, the law...
76
Releasing my book "Hacking the Xbox" as a free PDF in honor of Aaron Swartz
Dear Reader, No Starch Press and I have decided to release this free ebook version of Hacking the Xbox in honor of Aaron Swartz. As you read this book, I hope that you’ll be reminded of how important freedom is to the hacking community and that you’ll be inclined to support the causes that Aaron believed in. Download…
77
Improving the security of your SSH private key files
Update (July 2015): This post is now rather outdated, and the procedure for modifying your private key files is no longer recommended. A better solution is to use ssh-keygen -o .
78
Government Says Secret Court Opinion on Law Underlying PRISM Must Stay Secret
In a rare public filing in the secret Foreign Intelligence Surveillance Court (FISC), the Justice Department today urged continued secrecy for a 2011 FISC opinion that found the National Security Agency's surveillance under the FISA Amendments Act to be unconstitutional. Significantly, the...
79
Severing Ties with the NSA
Note: These pages make extensive use of the latest XHTML and CSS Standards . They ought to look great in any standards-compliant modern browser. Unfortunately, they will probably look horrible in older browsers, like Netscape 4.x and IE 4.x. Moreover, many posts use MathML, which is, currently only supported in…
80
81
Mozilla Recognized as Most Trusted Internet Company for Privacy
I’m very happy to share that Mozilla has been named the Most Trusted Internet Company for Privacy in 2012, according to a study performed by the Ponemon
82
Metadata Equals Surveillance
Back in June, when the contents of Edward Snowden’s cache of NSA documents were just starting to be revealed and we learned about the NSA collecting phone metadata of every American, many people—including President Obama—discounted the seriousness of the NSA’s actions by saying that it’s just metadata. Lots and lots…
83
84
85
Problems with the TSA
Coverage: Hacker News , Slashdot , BoingBoing , RT America News , Tumblr , RightThisMinute , RTM update , PapersPlease 2014 & 2015
86
Introducing Google+ Sign-In: simple and secure, minus the social spam
Today we’re adding a new feature to the Google+ platform: application sign-in . Whether you’re building an app for Android, iOS or the web, ...
87
Experian Sold Consumer Data to ID Theft Service
An identity theft service that sold Social Security and drivers license numbers — as well as bank account and credit card data on millions of Americans — purchased much of its data from Experian , one of the three major credit bureaus, according to a lengthy investigation by KrebsOnSecurity.
88
89
Hacking Github with Webkit
Previously on Github: XSS , CSRF ( My github followers are real , I gained followers using CSRF on bitbucket ), access bypass, mass assignm...
90
How we hacked Facebook with OAuth2 and Chrome bugs
TL;DR We (me and @isciurus ) chained several different bugs in Facebook, OAuth2 and Google Chrome to craft an interesting exploit. Mallory...