181
Let’s talk about PAKE
The first rule of PAKE is: nobody ever wants to talk about PAKE. The second rule of PAKE is that this is a shame, because PAKE — which stands for Password Authenticated Key Exchange — is actually o…
182
Some thoughts on security after ten years of Qmail 1.0
Some thoughts on security after ten years of qmail 1.0 Bernstein, 2007 I find security much more important than speed. We need invulnerable software systems, and we need them today, even if they ar…
183
Master password in Firefox or Thunderbird? Do not bother
There is a weakness common to any software letting you protect a piece of data with a password: how does that password translate into an encryption key? If that conversion is a fast one, then you better don’t expect the encryption to hold. Somebody who gets hold of that encrypted data will try to guess the password…
184
Yubico sent marketing email to address submitted for product replacement
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
185
Long-Term Consequences of Spectre and Its Mitigations
Robert O'Callahan. Christian. Kiwi. Software guy. All content human-authored unless otherwise noted.
186
187
188
Leaf-Node Weakness in Bitcoin Merkle Tree Design
This document describes a weakness in Bitcoin Design that reduces the security of SPV proofs and therefore SPV Wallets. The weakness was discovered by me on August 2017, but during the responsable…
189
190
Brute Force Incognito Browsing
Both Firefox and Chrome have a feature for creating temporary private browsing sessions. Firefox calls it Private Browsing and Chrome calls it Incognito Mode . Both work essentially the same way. A temporary browsing session is started without carrying over most existing session state (cookies, etc.), and no state…
191
Capsicum
I spent a couple of years evangelizing about Capsicum. I wrote many articles about it. So, it is very natural that I would also like to update you on this blog about the progress of the Capsicum project in FreeBSD, because this is what I’m doing in my free time. That said I feel that this blog wouldn’t be completed…
192
Everyone is watching what you do online. How user tracking with cookies works
Have you ever wondered how after you visit a website you start seeing ads about that website everywhere. This post explains how user tracking enables it.
193
86% of CrashCrate subscribers used passwords already leaked in other breaches
A couple of months ago, I launched version 2 of Pwned Passwords [https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/]. This is a collection of over half a billion passwords which have previously appeared in data breaches and the intention is that they're used as a
194
Apple’s New Ad Conversion Tracking Will Benefit User Privacy
Apple has released new developer APIs that will allow mobile advertising conversion tracking while protecting individual user privacy. The new APIs are part of the StoreKit framework and include a …
195
Flattr now deletes your web browsing history within 3 months
Flattr improves customer privacy protections by automatically deleting collected data when its no longer needed for its core service.
196
The NSA is not made of magic (2014)
I am regularly asked what is the most surprising thing about the Snowden NSA documents. It’s this: the NSA is not made of magic. Its tools are no different from what we have in our world, it’s just better-funded. X-KEYSCORE is Bro plus memory. FOXACID is Metasploit with a budget. QUANTUM is AirPwn with a seriously…
197
198
Stealing Chrome cookies without a password
Stealing Chrome Cookies without root or password on OSX, Linux, and Windows via Remote Debugging Protocol.
199
Audio Adversarial Examples
Figure from our paper: given any waveform, we can modify it slightly to produce another (similar) waveform that transcribes as any different target phrase.
200
Compiler fuzzing, part 1
Much has been written about fuzzing compilers already, but there is not a lot that I could find about fuzzing compilers using more modern ...
201
The Digital Maginot Line
There is a war happening. We are immersed in an evolving, ongoing conflict: an Information World War in which state actors, terrorists, and ideological…
202
Cracking Litter Box DRM
TLDR : My robot cat litter box bricks itself after a set number of washes with each soap cartridge so I reverse engineered and suppressed the verfication process to enable refilling.
203
204
GitHub Pages generated a TLS cert for my own domain
How the hell is this blog served over HTTPS by GitHub Pages?
205
Reverse Engineering the Soundcloud API
Hi guys, in this post we will learn how to bypass downloading restrictions on Soundcloud. We will create a Python script which will allow us to download even…
206
207
208
Hacking Gmail’s UX with 'From' Fields – Another Phishing Vector
An Unexpected Consequence of a Bad Header
209
210