61
62
63
SSH vs. OpenVPN for Tunneling
Update 28.01.16 I found some sites referring to this post. Below are the common complaints I saw, and my replies:
64
65
66
67
Equifax Breach Fallout: Your Salary History
In May, KrebsOnSecurity broke a story about lax security at a payroll division of big-three credit bureau Equifax that let identity thieves access personal and financial data on an unknown number of Americans. Incredibly, this same division makes it simple to access detailed salary and employment history on a large…
68
APFS is not safe to use with names which have Unicode normalisation issues
APFS is not currently safe to use with names which might have Unicode normalisation issues – which means it is only safe with a limited ASCII character set.
69
Equifax Argentinian portal secured with admin/admin
Equifax last week disclosed a historic breach involving Social Security numbers and other sensitive data on as many as 143 million Americans. The company said the breach also impacted an undisclosed number of people in Canada and the United Kingdom. But the official list of victim countries may not yet be complete…
70
Elliptic Curve Cryptography for Beginners
A description of ECC without using advanced math
71
Don't tell people to turn off Windows Update
You know what really surprised me about this whole WannaCry ransomware problem [https://www.troyhunt.com/everything-you-need-to-know-about-the-wannacrypt-ransomware/]? No, not how quickly it spread. Not the breadth of organisations it took offline either and no, not even that so many of them hadn'
72
Cross-Site Request Forgery is dead
After toiling with Cross-Site Request Forgery on the web for, well forever really, we finally have a proper solution, it's Same-Site Cookies.
73
300M Freely Downloadable Pwned Passwords
Edit 1: The following day, I loaded another set of passwords which has brought this up to 320M. More on why later on. Edit 2: The API model described below has subsequently been discontinued [https://www.troyhunt.com/enhancing-pwned-passwords-privacy-by-exclusively-supporting-anonymity/] in favour of the
74
What If We Put Warnings on IoT Devices?
A couple of years ago, I was heavily involved in analysing and reporting on the massive VTech hack [https://www.troyhunt.com/when-children-are-breached-inside/], the one where millions of records were exposed including kids' names, genders, ages, photos and the relationship to parents' records which included their
75
Hacker, Hack Thyself
We’ve read so many sad stories about communities that were fatally compromised or destroyed due to security exploits. We took that lesson to heart when we founded the Discourse project; we endeavor to build open source software that is secure and safe for communities by default, even if there
76
Explain like I’m 5: Kerberos (2013)
Explain like I’m 5 years old: Kerberos – what is Kerberos, and why should I care?
77
78
Hacking Voting Machines at Defcon
Let's rig some elections.
79
I will not log in to your website
Two or three times a day, I get an email whose basic structure is as follows: Prof. Aaronson, given your expertise, we’d be incredibly grateful for your feedback on a paper / report / gr…
80
81
Switching from 1Password to Bitwarden
I've been using an OpenBSD laptop as my workstation a lot more lately, probably because most of my hardware just works now and I don't have to think too much about it. The touchpad works when I touch it, I can be confident that when I close the lid, the laptop will fully suspend and then fully resume again when I open…
82
83
ShadowBrokers: The NSA Compromised the SWIFT Network
This is by far, the most interesting release from Shadow Brokers as it does not only contain tools — but also materials describing the most…
84
How I Stole a User's Siacoin
A lesson in Sia wallet seed safety
85
86
What I'm Telling US Congress about Data Breaches
Last week I wrote about my upcoming congressional testimony [https://www.troyhunt.com/im-testifying-in-front-of-congress-in-washington-dc-about-data-breaches-what-should-i-say/] and wow - you guys are awesome! Seriously, the feedback there was absolutely sensational and it's helped shape what I'll
87
Life Is About to Get Harder for Websites Without HTTPS
In case you haven't noticed, we're on a rapid march towards a "secure by default" web when it comes to protecting traffic. For example, back in Feb this year, 20% of the Alexa Top 1 Million sites were forcing the secure scheme: These figures are from Scott Helme'
88
Kids Pass Just Reminded Us How Hard Responsible Disclosure Is
Only a couple of months ago, I did a talk titled "The Responsibility of Disclosure: Playing Nice and Staying Out of Prison". The basic premise was to illustrate where folks finding security vulnerabilities often go wrong in their handling of the reporting, but I also wanted to show how organisations
89
90
Linux sandboxing improvements in Firefox 57
Firefox 57 not only ships a large amount of performance improvements and a UI refresh, it also contains a number of technological improvemen...