61
62
Chainalysis CTO said blockchain is easier to trace than paper money
Contrary to his original intentions, cryptocurrencies and DeFi platforms are now more vulnerable to privacy breaches and hacking than…
63
I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped
The perils of remaining neutral on a global scale: fanning the flames and selling the extinguisher.
64
SATCOM terminals under attack in Europe: a plausible analysis
------ Update 03/12/2022 Reuters has published new information on this incident, which initially matches the proposed scenario. You can find...
65
A Kernel Hacker Meets Fuchsia OS
Fuchsia is a general-purpose open-source operating system created by Google. It is based on the Zircon microkernel written in C++ and is currently under active development. The developers say that Fuchsia is designed with a focus on security, updatability, and performance. As a Linux kernel hacker, I decided to take a…
66
Sending spammers to password purgatory
How best to punish spammers? I give this topic a lot of thought because I spend a lot of time sifting through the endless rubbish they send me. And that's when it dawned on me: the punishment should fit the crime - robbing me of my time - which means that
67
Oh, the Places Your Apple ID Will Go
Here is a short and curious Twitter thread from app developers and security researchers Tommy Mysk and Talal Haj Bakry: Apple’s analytics data include an ID called “dsId”. We were able to verify that “dsId” is the “Directory Services Identifier”, an ID that uniquely identifies an iCloud account. Meaning, Apple’s…
68
The bait-and-switch hidden in today’s cookie announcement
T oday is going to be the day that you read a lot about the UK’s intention to kill cookie pop-ups as part of its post-Brexit Data Reform Bill. By now you should have somehow realised that there’s a bit more to it than that, and that your work is not set to get any easier.
69
Apple has a bug in its disk I/O throttling code that affects raw disk copies
Matt Jacobson, recovering software engineer.
70
71
Norway to track all supermarket purchases?
Statistics Norway wants to receive several million daily receipts from food stores, signalling a new era in state data collection. Privacy advocates and the supermarkets themselves are unhappy. People living in Norway are used to
72
73
74
LogJ4 Security Inquiry – Response Required
On Friday January 21, 2022 I received this email. I tweeted about it and it took off like crazy. The email comes from a fortune-500 multi-billion dollar company that apparently might be using a product that contains my code, or maybe they have customers who do. Who knows? My guess is that they do this … Continue…
75
76
PayPal phishing scam uses invoices sent via PayPal
Scammers are using invoices sent through PayPal.com to trick recipients into calling a number to dispute a pending charge. The missives — which come from Paypal.com and include a link at Paypal.com that displays an invoice for the supposed transaction — state that the user’s account is about to be charged hundreds of…
77
RaidForums gets raided, alleged admin arrested
The U.S. Department of Justice (DOJ) said today it seized the website and user database for RaidForums , an extremely popular English-language cybercrime forum that sold access to more than 10 billion consumer records stolen in some of the world’s largest data breaches since 2015. The DOJ also charged the alleged…
78
79
IRS Will Soon Require Selfies for Online Access
If you created an online account to manage your tax records with the U.S. Internal Revenue Service (IRS), those login credentials will cease to work later this year. The agency says that by the summer of 2022, the only way to log in to irs.gov will be through ID.me , an online identity verification service that…
80
“Invalid Username or Password”: a useless security measure (2014)
Login attempts fail because computer users can't remember their email or didn't input the right password. Most websites on the Internet won't tell you which one is actually incorrect.
81
The optimal amount of fraud is non-zero
Counterintuitively, businesses, customers, and society prefer having fraud to what they'd need to do to not have it.
82
On-device browser translations with Firefox Translations
Firefox can now do offline and privacy-preserving translation of eight languages with more on the way. Powered by open-source and machine-learning.
83
84
Who is squatting IPv4 addresses?
It’s an established fact on the internet that we have ran out of IP(v4) addresses , and we are starting to see the pressure on obtaining IPv4 space. For example if you want to get a /24 block from RIPE NCC when you sign up as a member, then you are currently looking at a 2 month wait for a recycled IPv4 /24 block .
85
Let's Encrypt now supports ACME-CAA: closing the DV loophole
Today, Let's Encrypt announced that they are enabling an extension to DNS CAA records known as ACME-CAA ( RFC 8657 ). This came as a surprise to me, but a very pleasant one, since I wrote the ACME-CAA specification back in 2016 with Let's Encrypt in mind, and it was finally published as RFC 8657 back in 2019. To my…
86
Psychic Signatures in Java
The long-running BBC sci-fi show Doctor Who has a recurring plot device where the Doctor manages to get out of trouble by showing an identity card which is actually completely blank. Of course, thi…
87
Achieving an open-source implementation of Apple Code Signing and notarization
As I've previously blogged in Pure Rust Implementation of Apple Code Signing (2021-04-14) and Expanding Apple Ecosystem Access with Open Source, Multi Platform Code signing (2022-04-25), I've been hacking on an open source implementation of Apple code signing and notarization using the Rust programming language. This…
88
Missouri governor’s office responsible for teacher data leak
Missouri Governor Mike Parson made headlines last year when he vowed to criminally prosecute a journalist for reporting a security flaw in a state website that exposed personal information of more than 100,000 teachers. But Missouri prosecutors now say they will not pursue charges following revelations that the data…
89
Privacy is ok
I hate to write a piece just saying Someone Is Wrong On The Internet. But Reid Blackman’s The Signal App and the Danger of Privacy at All Costs (in the NYTimes , forsooth) is not just wrong but dangerously misleading. I haven’t seen a compact explainer on why, so here goes.
90
