31
The .feedback scam
Do you have feedback you'd like to give to Google, Facebook, StackOverflow, Inc., or Gandi? Now there's a website that will collect that feedback. Or... not.
32
33
Encrypted email is still a pain
Today I sent an email to somebody who specified that he "prefers GPG mail". I didn't have any GPG set up, so I just sent a normal email, which worked perfectly well. But it made me look in to GPG, and this is what I learnt...
34
35
There are over a billion outdated Android devices in use
It's common knowledge that Android device tend to be more out of date than iOS devices, but what does this actually mean? Let’s look at android marketshare data to see how old devices in the wild are. The x axis of the plot below is date, and the y axis is Android marketshare. The share of all devices sums to 100%…
36
CircleCI trusts 8 analytics companies with your source code and API tokens
When you navigate to your project in CircleCI's UI, Javascript from eight different analytics companies gets loaded and executed in your browser.
37
CloudPets teddy bears leaked and ransomed, exposing kids' voice messages
Only a couple of weeks ago, there were a lot of news headlines about how Germany had banned an internet-connected doll called "Cayla" over fears hackers could target children [http://www.telegraph.co.uk/news/2017/02/17/germany-bans-internet-connected-dolls-fears-hackers-could-target/] . One of
38
IOHIDeous OS X Local Kernel Vulnerability
Siguza’s Blog
39
40
TP-Link firmware sends six DNS requests and one NTP query every 5 seconds
A design flaw in TP-Link Wi-Fi repeater firmware causes it to waste an excessive amount of bandwidth on NTP timekeeping. DDoS’ed public NTP servers in the process.
41
Secret Dots from Printer Outed NSA Leaker
Today, The Intercept released documents on election tampering from an NSA leaker. Later, the arrest warrant request for an NSA contractor ...
42
Firefox 57 delays requests to tracking domains
Firefox Quantum - version 57 - introduced number of changes to the network requests scheduler. One of them is using data of the Tracking Protection database to delay load of scripts from tracking domains when possible during the time a page is actively loading and rendering - I call it tailing. This has a positive […]
43
How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security
How Chrome OS, Termux, YubiKey & Duo Mobile make for great usable security. A travel Chromebook for modern development, online and offline.
44
Falling through the KRACKs
The big news in crypto today is the KRACK attack on WPA2 protected WiFi networks. Discovered by Mathy Vanhoef and Frank Piessens at KU Leuven, KRACK (Key Reinstallation Attack) leverages a vulnerab…
45
Examining a vintage RAM chip, I find a counterfeit with a different die inside
A die photo of a vintage 64-bit TTL RAM chip came up on Twitter recently, but the more I examined the photo the more puzzled I became. The c...
46
Exploding Git Repositories
The git bomb. Crafting compact repos that can't be cloned.
47
Passwords Evolved: Authentication Guidance for the Modern Era
In the beginning, things were simple: you had two strings (a username and a password) and if someone knew both of them, they could log in. Easy. But the ecosystem in which they were used was simple too, for example in MIT's Time-Sharing Computer [https://www.wired.com/
48
Golang SSH Security
Working on a project for a client recently, I needed to speak the SSH protocol in Golang code. So I started with the x/crypto/ssh package, part of the suite of libraries from the Golang developers which is not part of the standard library and not part of their usual compatibility guarantees, but more along the lines…
49
OnePlus OxygenOS built-in analytics
We take a look at the analytics built into the OxygenOS, the flavour of Android built by phone manufacturer OnePlus.
50
Curl’s backdoor threat
-- "Have you ever detected anyone trying to add a backdoor to curl?" -- "Have you ever been pressured by an organization or a person to add suspicious code to curl that you wouldn't otherwise accept?" -- "If a crime syndicate would kidnap your family to force you to comply, what backdoor would you be … Continue…
51
Equihax
Trawling the darknet as one does, I came across this little simple page this morning. It claims to be the real EQUIFAX hackers, unlike the last darknet site that was soon taken down by morons. I ha…
52
53
DRM Is Toxic to Culture
In pursuit of market control now, deployers of DRM are robbing us of our culture in perpetuity by enclosing the future commons. It’s possible that you think that unauthorised use of copyright…
54
On Password Managers
It has come to my attention that people are Wrong On The Internet about password managers. This matters, because almost everybody should be using one. Herewith background, opinions, and a description of my own setup, which is reasonably secure.
55
We’ve lost control of our personal data, including 33M NetProspex records
Earlier this week, I read a really interesting piece on 3 things that need to be done to save the web [https://www.theguardian.com/technology/2017/mar/11/tim-berners-lee-web-inventor-save-internet] . The first observation was that "we’ve lost control of our personal data" and
56
57
How I implemented my own crypto
Despite advice to the contrary, I have implemented my own crypto for serious use. Here's how.
58
An analysis of the Nomx secure communications device
With slick marketing, catchy taglines and some pretty bold claims about their security, nomx claim to have cracked email security. Let's see if they have.
59
Feeling safer online with Firefox
The latest privacy and security improvements in Firefox [This post originally appeared on Medium ] Firefox is the only browse...
60
Things to Use Instead of JSON Web Tokens
You might have heard that you shouldn't be using JWT. That advice is correct - you really shouldn't use it. In general, specifications that allow the attacker to choose the algorithm for negotiation have more problems than ones that don't (see TLS). N libraries need to implement M different encryption and decryption…