271
272
Hardening unused (sub)domains
Proper implementation of email hardening techniques can be beneficial even to (sub)domains that are not intended to be used with email.
273
Is “acceptably non-dystopian” self-sovereign identity even possible?
In the recent paper about "soulbound" tokens, Vitalik Buterin et al. write that they aim to build technology that is "acceptably non-dystopian". Do any of today's self-sovereign identity projects fit that bill?
274
Should you use Let's Encrypt for internal hostnames?
Julien Savoie has written a brilliant post explaining how you can enable https on your intranet. This is useful for several reasons. It means your employees aren't constantly fighting browser warnings when trying to submit stuff internally. All your http traffic is encrypted. You don't need to install a self-generated…
275
Let’s Encrypt Receives the Levchin Prize for Real-World Cryptography
On April 13, 2022, the Real World Crypto steering committee presented the Max Levchin Prize for Real-World Cryptography to Let’s Encrypt. The following is the speech delivered by our Executive Director, Josh Aas, upon receiving the award. We’d like to thank our community for supporting us and invite you to join us in…
276
What NPM should do to stop a new colors attack
Over the weekend, a developer named Marak Squires intentionally sabotaged his popular NPM package colors and his less popular package faker . As I write this, NPM claims 18,971 direct dependents for colors and 2,751 for faker . Open Source Insights counts at least 42,000 more indirect dependents for colors . Many…
277
Stage win: FinFisher is bankrupt
FinFisher, the Munich-based state Trojan exporter, is bankrupt. For over a decade, a wide variety of international groups, including the CCC, have worked toward its end.
278
Tailnet Lock
Use this article learn how to decide who to trust when it comes to your tailnet’s coordination server and how nodes are added to your tailnet.
279
Hardening macOS
Quick and easy guide for securing macOS systems, for both laymen and security enthusiasts. Last updated for Golden Gate.
280
Privacy preserving attribution for advertising
Advertising provides critical support for the Web. We’ve been looking to apply privacy preserving advertising technology to the attribution problem, so t
281
Analyzing iOS 16 Lockdown Mode: Browser Features and Performance
Another year, another Apple iOS/iPadOS/MacOS release, right? But shortly before the iOS 16 betas dropped, Apple made an interesting announcement.
282
Bluetooth relay attacks allow Tesla Model 3 / Y to be unlocked and driven away
Cutting-edge cyber security research from NCC Group. Find public reports, technical advisories, analyses, & other novel insights from our global experts.
283
Bringing passkeys to Android and Chrome
developers can enroll in the Google Play Services beta and use Chrome Canary. Both features will be generally available on stable channels
284
SMS Multifactor Authentication in Antarctica
Issues pertaining to SMS (for multifactor auth) in Antarctica.
285
286
An Open Letter to Pixsy CEO Kain Jones, Who Keeps Sending Me Legal Threats
Once is happenstance. Twice is coincidence. Three times is enemy action.
287
Unintended consequences of blocking IP addresses
A discussion about IP blocking: why we see it, what it is, what it does, who it affects, and why it’s such a problematic way to address content online.
288
289
New two-factor authenticator: Commodore 64
Multi-factor authentication is ripe for disruption. SMS 2FA is inherently defective. Phone authenticators get stolen. Security tokens get lo...
290
Hijacking infrared to make a dumb device smart
I own a very old ‘flat’ screen television from 2009. One of the reason this TV is still kicking around is because I have a strange sentimental affection for it. Another is that I have written automation for it that works really well and it would be a pain to migrate away from it.
291
Scapy: Low level packet hacking toolkit for Python
Code level discussion of web scraping, gray hat automation, growth hacking and bounty hunting
292
293
294
Plausibly deniable encryption (2020)
It is safe to assume that in any useful cryptosystem C k there exists at least one person with access to the key k . An adversary with sufficient leverage can bypass the computational cost of a conventional attack by exerting their influence on this person.
295
Have lots of AWS accounts
“You should have lots of AWS accounts” has moved to https://src-bin.com/substrate/blog/you-should-have-lots-of-aws-accounts/ .
296
SSH commit verification now supported
GitHub now supports SSH commit verification, so you can sign commits and tags locally using a self-generated SSH public key, which will give others confidence about the origin of a…
297
Find You: Building a stealth AirTag clone
We built an AirTag clone capable of silently and continuously tracking someone. The device accomplishes this by sending just one beacon per generated public key, thereby staying invisible to tracking notifications for iOS users and Apple’s Tracker Detect Android app.
298
CNIL makes Google Analytics almost illegal in France
In reaction to the invalidation of the Privacy Shield in July 2020 by the Court of Justice of the European Union (CJEU), US President Joe Biden adopted on 7 October 2022 a new legal framework (Executive Order) to strengthen safeguards on the collection and use of personal data by US intelligence agencies.
299
300
GitHub will require 2FA by the end of 2023
GitHub will require all users who contribute code on GitHub.com to enable one or more forms of two-factor authentication (2FA) by the end of 2023.