151
Aren't AMP Caches committing copyright infringement?
How can mass-copying pages from web publishers without a license not be mass-copyright infringement? The weird copyright law exemption that enables AMP Caches.
152
Setting Up an Ad-Blocking VPN with WireGuard and Pihole
This guide will walk you through the setup of a remote machine that will act as a personal VPN server at the cost of 3 to 5 USD per month. We will also configure it to act as a DNS resolver that will automatically block spam, tracking, advertising and malware domains on all of your connected devices.
153
154
A Go implementation of Poly1305 that makes sense
Cryptography code could be understandable if only we commented it. This Poly1305 implementation is an attempt to prove it. It should be readable with just an idea of what MACs are for, a beginner level of Go, and high school math.
155
Trust is good, control is better: Reproducible builds at F-Droid
Free Software is a great thing, because it allows users to check that apps are doing what they pretend to do. But almost nobody compiles apps themselves.
156
157
Freeing My Phone from Google
Phones are so full of ads that you don’t even notice them anymore. Suggestions and notifications you didn’t ask for, tracking mechanisms you don’t even know are there, services over which you have no control. It’s absurd how much smartphones, a large extension of our private and social lives, are controlled and…
158
Google Forcing Nest Cameras’ Visual Indicator Light To Be On
Google Forcing Nest Cameras Visual Indicator Light To Be On
159
How Not to Acknowledge a Data Breach
I’m not a huge fan of stories about stories, or those that explore the ins and outs of reporting a breach. But occasionally I feel obligated to publish such accounts when companies respond to a breach report in such a way that it’s crystal clear they wouldn’t know what to do with a data breach if it bit them in the…
160
Banks, Arbitrary Password Restrictions and Why They Don't Matter
Allow me to be controversial for a moment: arbitrary password restrictions on banks such as short max lengths and disallowed characters don't matter. Also, allow me to argue with myself for a moment: banks shouldn't have these restrictions in place anyway. I want to put forward cases for
161
State of Industrial Control Systems in Poland and Switzerland
TL;DR New update for Kamerka allows to map Industrial Control Systems of whole country. As in previous version, interactive map is created…
162
How to Track Your Kids (and Other People's Kids) with the TicTocTrack Watch
Do you ever hear those stories from your parents along the lines of "when I was young..." and then there's a tale of how risky life was back then compared to today. You know, stuff like having to walk themselves to school without adult supervision, crazy stuff like that
163
Github became the web's largest font piracy site (2017)
Front-end antics and typographic mischievousness
164
2FA on the command line
OTP: One-Time Password TOTP: Time-based One-time Password algorithm 2FA: Two-factor authentication There is no shortage of OTP 2FA apps availiable for your phone, such as Google Authenticator or Duo Mobile. These apps take an initial secret code, and create a TOTP anytime you need a 2FA code for login.… …
165
166
167
So You Want to Be a Penetration Tester?
This is an old and outdated version of the blog. If you haven’t read this post yet, then please see the new one for the most up-to-date content: “So You Want To Work in Cyber Security?”. This version is kept here for archival purposes only.
168
Use GitHub actions at your own risk
Malicious code can be inserted into any GitHub action, even those which are tagged.
169
Adventures in reverse engineering Broadcom NIC firmware
For some time now, I've been reverse engineering the firmware of the Broadcom BCM5719 Ethernet NIC chip, so that open source firmware can be produced for it. The BCM5719 is a PCIe chip which provides up to four Gigabit Ethernet ports, and is mainly intended for use in server applications. It can be used with the Linux…
170
Time protection: the missing OS abstraction
Time protection: the missing OS abstraction Ge et al., EuroSys’19 Ever since the prominent emergence of timing-based microarchitectural attacks (e.g. Spectre, Meltdown, and friends) I’ve been…
171
Writing Exploit-Resistant Code with OpenBSD
On April 27, 2019, I gave a talk on how to use OpenBSD to write better software at CarolinaCon 15 in Charlotte.
172
Don’t underestimate grep-based code scanning
Static analysis tools (SAST) are perhaps the most common tool for an AppSec team in the endless effort to move security to the left. They can be integrated into development pipelines in order to of…
173
NY Payroll Company Vanishes with $35M
MyPayrollHR , a now defunct cloud-based payroll processing firm based in upstate New York, abruptly ceased operations this past week after stiffing employees at thousands of companies. The ongoing debacle, which allegedly involves malfeasance on the part of the payroll company’s CEO, resulted in countless people…
174
Extended Validation Certificates Are Really Dead
Almost one year ago now, I declared extended validation certificates dead [https://www.troyhunt.com/extended-validation-certificates-are-dead/]. The entity name had just been removed from Safari on iOS, it was about to be removed from Safari on Mojave and there were indications that Chrome would remove it
175
Ginseng: Keeping secrets in registers when you distrust the operating system
Ginseng: keeping secrets in registers when you distrust the operating system Yun & Zhong et al., NDSS’19 Suppose you did go to the extreme length of establishing an unconditional root of …
176
The sorry state of OpenSSL usability (2017)
OpenSSL's inadequate documentation, confusing key formats, and deprecated interfaces make it difficult to use, despite its importance.
177
178
Cryptography Dispatches: Hello World, and OpenPGP Is Broken
This is the inaugural issue of Cryptography Dispatches, meant to be quick, frequent and lightly edited discussions of cryptographic topics. Longer form can be found at blog.filippo.io. If you are not reading this in your email client, you can subscribe here .
179
SWATters Target Dozens of Journalists
Nearly three dozen journalists at a broad range of major publications have been targeted by a far-right group that maintains a Deep Web database listing the personal information of people who threaten their views. This group specializes in encouraging others to harass those targeted by their ire, and has claimed…
180
Phone Numbers Stink as Identity Proof
Phone numbers stink for security and authentication. They stink because most of us have so much invested in these digits that they’ve become de facto identities. At the same time, when you lose control over a phone number — maybe it’s hijacked by fraudsters, you got separated or divorced, or you were way late on your…