31
32
Gas Pump Skimmers
What’s the first thing that should scare you? There’s three. And the next? The label ‘46’. They’ve got so many in the field criminals need to number them just to keep track.
33
34
Dangers of CSV Injection
I’ve been doing the local usergroup circuit with this lately and have been asked to write it up.
35
Get your loved ones off Facebook
I originally wrote this for my friends and family in 2015, to explain why the latest Facebook privacy policy is really harmful. It’s since been read b
36
How Bank of America Gave Away My Money
TLDR: Bank of America is a horrible business and it should be ashamed by how bad it is. Two weeks ago, I suddenly received emails informing me that my Bank of America…
37
HTTPS on Your Landing Page Is Important
Occasionally, I feel like I'm just handing an organisation more shovels - "here, keep digging, I'm sure this'll work out just fine..." The latest such event was with NatWest [http://personal.natwest.com] (a bank in the UK), and it culminated with this tweet from them: > I'm
38
I'm Testifying to Congress about Data Breaches – What Should I Say?
Edit: I'm putting this up front as a lot of people are asking for it - the hearing will be live-streamed on YouTube and there's already an embedded video on the hearing page [https://energycommerce.house.gov/hearings/identity-verification-post-breach-world/] . There's a title I
39
Defending a website with Zip bombs
Personal Blog of Christian Haschek
40
Lavabit Reloaded
There is nothing here so move right along.
41
42
Upspin – Another option for file sharing
Posted by Andrew Gerrand, Eric Grosse, Rob Pike, Eduardo Pinheiro and Dave Presotto, Google Software Engineers Existing mechanisms for fil...
43
Face ID, Touch ID, No ID, PINs and Pragmatic Security
I was wondering recently after poring through yet another data breach how many people actually use multi-step verification. I mean here we have a construct where even if the attacker has the victim's credentials, they're rendered useless once challenged for the authenticator code or SMS which is
44
Stupid security things
My mate Lars Klint shared this tweet the other day: > Your password is not unique. pic.twitter.com/ga4GwxtzrQ [https://t.co/ga4GwxtzrQ] — Lars Klint (@larsklint) April 16, 2017 [https://twitter.com/larsklint/status/853507749488975873] Naturally, I passed it on [https://twitter.com/troyhunt/status/853517036131041280]…
45
Something is wrong when the ‘telephone app’ on your phone becomes 3rd party
Since I am not living in my home country, I frequently use two different SIM cards and prefer having a phone with dual-sim support. This limits your choice s...
46
Inside a low-budget consumer hardware espionage implant
The following analysis was performed on a S8 data line locator which replied to the hidden SMS command for version query ( *3646655* ) with:
47
Obama Expands Surveillance Powers on His Way Out
With mere days left before President-elect Donald Trump takes the White House, President Barack Obama’s administration just finalized rules to make it easier for the nation’s intelligence agencies to share unfiltered information about innocent people. New rules issued by the Obama administration...
48
Milestone: 100M Certificates Issued
Let’s Encrypt has reached a milestone: we’ve now issued more than 100,000,000 certificates. This number reflects at least a few things: First, it illustrates the strong demand for our services. We’d like to thank all of the sysadmins, web developers, and everyone else managing servers for prioritizing protecting your…
49
Call of Duty gaming community points to ‘swatting’ in Wichita police shooting
A 28-year-old Kansas man was shot and killed by police officers on the evening of Dec. 28 after someone fraudulently reported a hostage situation ongoing at his home. The false report was the latest in a dangerous hoax known as “ swatting ,” wherein the perpetrator falsely reports a dangerous situation at an address…
50
HTTPS on Stack Overflow: The End of a Long Road
Today, we deployed HTTPS by default on Stack Overflow. All traffic is now redirected to https:// and Google links will change over the next few weeks. The ac...
51
Machine learning without centralized training data
Posted by Brendan McMahan and Daniel Ramage, Research ScientistsStandard machine learning approaches require centralizing the training data on one ...
52
The Line of Death
When building applications that display untrusted content, security designers have a major problem— if an attacker has full control of a block of pixels, he can make those pixels look like anything…
53
How the Bitcoins Were Stolen from Mt. Gox [video]
The thought “I know PHP! How hard could running an exchange be?” never goes anywhere good.
54
The .feedback scam
Do you have feedback you'd like to give to Google, Facebook, StackOverflow, Inc., or Gandi? Now there's a website that will collect that feedback. Or... not.
55
56
57
EFF, ACLU Sue Over Warrantless Phone, Laptop Searches at U.S. Border
Boston, Massachusetts—The Electronic Frontier Foundation (EFF) and the American Civil Liberties Union (ACLU) sued the Department of Homeland Security (DHS) today on behalf of 11 travelers whose smartphones and laptops were searched without warrants at the U.S. border. The plaintiffs in the case are...
58
59
60
Encrypted email is still a pain
Today I sent an email to somebody who specified that he "prefers GPG mail". I didn't have any GPG set up, so I just sent a normal email, which worked perfectly well. But it made me look in to GPG, and this is what I learnt...