Somewhere around 2014 I found an /etc/passwd file in some dumps of the BSD 3 source tree, containing passwords of all the old timers such as Dennis Ritchie, Ken Thompson, Brian W. Kernighan, Steve Bourne and Bill Joy.
After 4 months of waiting, that is the response I got from Widevine, Google’s DRM for web browsers, regarding a license agreement. For the last 2 years I’ve been working on a web browser that now cannot be completed because Google, the creators of the open source browser Chrome, won’t allow DRM in an open source…
I use Firefox, and this morning I've spent quite some time proving to passive-aggressive Google that I'm not a robot.
Hundreds of millions of Facebook users had their account passwords stored in plain text and searchable by thousands of Facebook employees — in some cases going back to 2012, KrebsOnSecurity has learned. Facebook says an ongoing investigation has so far found no indication that employees have abused access to this data.
A new phishing technique that displays a fake URL bar in Chrome for mobile. A key innovation is the "scroll jail" that traps the user in a fake browser.
telegra.ph/private-internet-access-vpn-acquired-by-malware-business-founded-by-former-israeli-spies-12-0120191,004 points359 commentsSecurity & Privacy details
arccompute.com/blog The following article contains quotes and links meant to inform VPN consumers concerning the ownership, affiliations, and past business practices of Kape Technologies (formerly known as Crossrider) in light of their acquisition of Private Internet Access VPN. I'd like to start by giving credit…
I recently started having issues with the admin interface of a website I run and decided to check the browser console to see if any errors were being displayed there. There were and among them was an error stating that a JavaScript map file being loaded (and failing) that I did not recognise. This meant that the…
What computer do you use? Who made it? Have you ever thought about what came with your computer? When we think of Remote Code Execution (RCE) vulnerabilities in mass, we might think of vulnerabilities in the operating system, but another attack vector to consider is "What third-party software came with
A description of each security header, why it is important, and how to configure your website in a secure way.
Back in 2013, I was beginning to get the sense that data breaches were becoming a big thing. The prevalence of them seemed to be really ramping up as was the impact they were having on those of us that found ourselves in them, myself included. Increasingly, I was writing
This post got *a lot* of attention. I’m super happy about that because I had been afraid that we had reached a point where we collectively didn’t care about cameras or meaningful disclosure. Although, to that point here’s a comment someone posted: "I just assume that there will be camera constantly recording when I…
Looking at a dataset of 350 million ssl connections inspires some initial questions:
How many web servers are running on your machine right now? Do all of those development web servers have a secure login, and restrictive CORS permissions? You don’t know? Allow me to check for you:
I recently updated minor and patch versions of the gems our Rails app uses. We want to keep dependencies fresh, bugs fixed, security vulnerabilities addressed while maintaining a high chance ...
I did a detailed privacy check of the app TikTok and its corresponding website. Multiple law infringements, trust, transparency and data protection breaches were found.I provide all technical an
I’m excited to announce that OnionShare 2.2 is released! You can download it from onionshare.org. When I first wrote OnionShare in 2014, it let you anonymously and securely send files to people. It worked like this: OnionShare zips up the files, starts a local web server on
Motivation For a moderately security conscious geek like myself, there can be a number of reasons to want to set up a home VPN server: Accessing your home computer via screen sharing without exposing it to the Internet (and thereby to potential evil-doers). Accessing servers with IP white lists (common case for…
On 26 Nov 2019 at 14:55 UTC, I logged into my server that hosts my website to perform a simple maintenance activity. Merely three minutes later, at 14:58 UTC, the domain name susam.in used to host this website was transferred to another registrant without any authorisation by me or without any notification sent to me…
Why open source firmware is important for security.
Learn how to pair lock your iPhone to break law enforcement forensics tools and protect your data.
This article was discussed on Hacker News ( later ), on reddit ( also ), featured in BSD Now 294 . Also check out this Endlessh analysis .
One of the more interesting things I've had the opportunity to hack on is the Tesla Model 3. It has a built in web browser, free premium LTE, and over-the-air software updates. It's a network connected computer on wheels that drives really fast.
Before the US crypto export regulations were finally disolved the export version of Lotus Notes used to include a key escrow / backdoor feature called differential cryptography. The idea was that they got permission to export 64 bit crypto if 24 of those bits were encrypted for the NSA's public key. The NSA would then…
I’m a software engineer based in Edinburgh, Scotland. My interests include getting computers to behave, helping other people get computers to behave, open source, maths, and music.
Personal Blog of Christian Haschek
