31
How we cracked millions of Ashley Madison passwords
Not long after the release of the Ashley Madison leaks, many groups and individuals attempted to crack the bcrypt hashes. Since t...
32
Introducing s2n, a New Open-Source TLS Implementation
February 22, 2022: s2n has been renamed to s2n-tls. See details. At Amazon Web Services, strong encryption is one of our standard features, and an integral aspect of that is the TLS (previously called SSL) encryption protocol. TLS is used with every AWS API and is also available directly to customers of many AWS…
33
Images that fool computer vision raise security concerns
Computers are learning to recognize objects with near-human ability. But Cornell researchers have found that computers, like humans, can be fooled by optical illusions, which raises security concerns.
34
35
36
Google announces Android for Work
Posted by Rajen Sheth, Director of Product Management, Android and Chrome for Work (Cross-posted on the Android Blog .) Over a billi...
37
Fighting spam with Haskell
Visit the post for more.
38
Microsoft’s new small print – how your personal data is abused
Microsoft has renewed its Privacy Policy and Service Agreement. The new services agreement goes into effect on 1 August 2015, only a couple of days after the launch of the Windows 10 operating system on 29 July. The new “privacy dashboard” is presented to give the users a possibility to control their data related to…
39
HealthCare.gov Sends Personal Data to Dozens of Tracking Websites
The Associated Press reports that healthcare.gov–the flagship site of the Affordable Care Act, where millions of Americans have signed up to receive health care–is quietly sending personal health information to a number of third party websites. The information being sent includes one's zip code,...
40
Deprecating Non-Secure HTTP
Today we are announcing our intent to phase out non-secure HTTP. There's pretty broad agreement that HTTPS is the way forward for the web. In recent months, there have been ...
41
42
Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges
Posted by Mark Seaborn, sandbox builder and breaker, with contributions by Thomas Dullien, revers...
43
44
Signal 2.0 released with private messaging support
Today we’re releasing Signal 2.0, with support for TextSecure private messaging. It is now possible to send end-to-end encrypted group, text, picture, and video messages between Signal on iPhone and TextSecure on Android, all without SMS and MMS fees. Signal 2.0 blends private phone calls and pri...
45
46
Using a single AWS account is a serious risk
Your AWS account is one of the most valuable things you own if you run a business on AWS. If you only own a single AWS accoun...
47
Black Hat USA 2015: The full story of how that Jeep was hacked
Recently we wrote about Jeep Cherokee hack incident. At Black Hat security researchers Charlie Miller and Chris Valasek finally explained, how exactly that hack was done
48
Do not let your CDN betray you: Use Subresource Integrity
Mozilla Firefox Developer Edition 43 and other modern browsers help websites to control third-party JavaScript loads and prevent unexpected or malicious modifications. Using a new specification called Subresource Integrity, a ...
49
50
Duplicate SSH Keys Everywhere
Back in December when I revamped the SSH banner and started collecting the fingerprint I noticed an odd behavior. It turns out that a few SSH keys are used a lot more than once. For example, the following SSH fingerprint can be found on more than 250,000 devices! dc:
51
52
ICANN's assault on personal and small business privacy
This post is extremely long and detailed and is on quite a dense subject. Here is the short version.
53
Firefox Now Offers a More Private Browsing Experience
We’re releasing a powerful new feature in Firefox Private Browsing called Tracking Protection. We created this feature because we believe in giving you m
54
OAuth Has Ruined Everything
Save time building sleek web, mobile and desktop apps with professional .NET UI Components, JavaScript UI Libraries, Reporting and Automated Testing solutions.
55
Decertifying the worst voting machine in the US
On Apr 14 2015, the Virginia State Board of Elections immediately decertified use of the AVS WinVote touchscreen Direct Recording Electronic (DRE) voting machine. This seems pretty minor, but it received a tremendous amount of pushback from some local election officials. In this post, I’ll explain how we got to that…
56
Court: Breaking Your Employer's Computer Policy Isn't a Crime
The United States Court of Appeals for the Second Circuit issued an opinion rejecting the government’s attempt to hold an employee criminally liable under the federal hacking statute—the Computer Fraud and Abuse Act (“CFAA”)—for violating his employer-imposed computer use restrictions. The decision...
57
In Wake of Charlie Hebdo Attack, Let’s Not Sacrifice Even More Rights
EFF is stunned and deeply saddened by the attack on Charlie Hebdo, a French satirical newspaper. As free speech advocates, we mourn the use of violence against individuals who used creativity and free expression to engage in cultural and political criticism. Murder is the ultimate form of...
58
How to Protect Yourself from NSA Attacks on 1024-bit DH
In a post on Wednesday, researchers Alex Halderman and Nadia Heninger presented compelling research suggesting that the NSA has developed the capability to decrypt a large number of HTTPS, SSH, and VPN connections using an attack on common implementations of the Diffie-Hellman key exchange...
59
60
Mysterious Planes Over Baltimore Spark Surveillance Suspicions
It all started with a simple Twitter query from a Baltimore man: “Anyone know who has been flying the light plane in circles above the city for the last few nights?” This was several days after the death of Freddie Gray in police custody, and the subsequent riots and protests. Pete Cimbolic, an aviation buff and…