61
CSRF in Doorkeeper OAuth2 gem
I read a post about CSRF on DigitalOcean (in Russian) by Sergey Belove . My first reaction was, obviously, how come ? DigitalOcean is not k...
62
63
64
Reading the Silk Road configuration
Many of us believe it wasn't the FBI who discovered the hidden Silk Road server, but the NSA (or other intelligence organization). We believ...
65
Free Your Android
After all the recent NSA revelations, it's been even more important to use Free Software on our mobile phones. Let me express this in another way: We should be very careful about what software we use on a device that is always on and in our pocket 24h a day. Starting from the very basic thing tha...
66
67
Reverse engineering a counterfeit 7805 voltage regulator
Update: It turns out my 7805 isn't counterfeit. eclectro did an in-depth search ( details on reddit ) and found an old 7805 datasheet fro...
68
We may have witnessed a NSA "Shotgiant" TAO-like action
Last Friday, the New York Times reported that the NSA has hacked/infiltrated Huawei, a big Chinese network hardware firm. We may have witne...
69
Myths about /dev/urandom
Randomness, entropy, and the Linux kernel.
70
How NSA and GCHQ are tapping internet cables
A weblog about Signals Intelligence, Communications Security and top level telecommunications equipment
71
Yik Yak Hack
Yik Yak is an anonymous, controversial social media application that allows people to make posts that are visible to other users within ~2 miles. Often landing a top 10 spot in the iOS App Store, this app has become increasingly popular with high school and college students. Due to the anonymous nature of the app…
72
What does the NSA think of academic cryptographers?
Brighten Godfrey was one of my officemates when we were grad students at Berkeley. He’s now a highly-successful computer networking professor at the University of Illinois Urbana-Champaign, …
73
iOS 8 Privacy Updates
A summary of all iOS 8 Security and Privacy updates and their importance.
74
Why can't Apple decrypt your iPhone?
Last week I wrote about Apple’s new default encryption policy for iOS 8. Since that piece was intended for general audiences I mostly avoided technical detail. But since some folks (and appar…
75
Tarsnap: No heartbleed here
There's a few reasons for this. First, the Tarsnap client-server protocol does not use TLS; instead, it uses a protocol which is about 100x simpler (in terms of the number of pages of documentation required to define it). This means there's less code and far fewer edge cases where bugs can lurk without being triggered…
76
Feedly gets hit by DDoS attack, refuses to give in to blackmail
Feedly reports that it is suffering from a denial-of-service attack that could impact users’ ability to catch up with the latest updates from their favourite websites.
77
Nobody expects CDATA sections in XML
I made a very explicit, pragmatic design decision with afl-fuzz : for performance and reliability reasons, I did not want to get into stati...
78
79
80
Holy War on Sites That Demand Pinboard Passwords
Over two years ago I introduced an API authentication method so people could authorize outside third-party websites to add things to their Pinboard account without sharing their Pinboard password.
81
The No CAPTCHA problem
When I read about No CAPTCHA for the first time I was really excited. Did we finally find a better solution? Hashcash? Or what? Finally it...
82
Hijacking user sessions with the Heartbleed vulnerability
The Heartbleed issue is actually worse than it might immediately seem (and it seems pretty bad already).
83
84
85
The US Intelligence Community has a Third Leaker
Ever since the Intercept published this story about the US government’s Terrorist Screening Database, the press has been writing about a “second leaker”: The Intercept article focuses on the growth in U.S. government databases of known or suspected terrorist names during the Obama administration. The article cites…
86
87
88
89
90
On the new Snowden documents
If you don’t follow NSA news obsessively, you might have missed yesterday’s massive Snowden document dump from Der Spiegel. The documents provide a great deal of insight into how the NSA brea…