Top all-time · #1192
Defuse Security Research and Development
Personal blog · defuse.casecurityprogrammingmath
Defuse Security Research and Development is a personal blog at defuse.ca about security, programming and math. Since 2012, 61 different Hacker News readers have linked it 85 times, most often “EncFS Security Audit”. No feed was found, so read it on the site itself.
Defuse Security. Home of PIE Bin, TRENT, and more...
Most-linked posts?
- EncFS Security Audit14 people · 15 mentions · first linked 2014-01-15
- Triangle of Secure Code Delivery (2014)7 people · 12 mentions · first linked 2014-07-27
- TrueCrypt's Plausible Deniability is Theoretically Useless (2013)6 people · 6 mentions · first linked 2014-01-17
- ECryptfs Security Audit5 people · 5 mentions · first linked 2014-03-12
- Password Policy Hall of SHAME3 people · 3 mentions · first linked 2013-04-02
- Encrypted Pastebin – Keep your data private and secure3 people · 3 mentions · first linked 2013-08-05
- Gocryptfs Security Audit3 people · 3 mentions · first linked 2017-03-10
- Microsoft visits links you send in Skype2 people · 3 mentions · first linked 2014-02-24
- /race-conditions-in-web-applications.htm2 people · 2 mentions · first linked 2015-04-27
- Exploiting C++ VTABLES: Instance Replacement2 people · 2 mentions · first linked 2013-05-12
What Hacker News says?
If you find a way to prevent this in Chrome/Edge please let me know. Edit: https://defuse.ca/in-browser-port-scanning.htm There doesn't seem to be a way to access anything locally, just test for open ports. I use SSH tunneling a lot and was having a minor freak out.
Comment linking /in-browser-port-scanning.htm
on “Why Is This Website Port Scanning Me?”Submitted EncFS Security Audit as a story · 84 points
HN discussion@DefuseSec > I'll give $100 USD to anyone who can trick me into inserting the string "BackdoorPoCTwitter" into a release of any of my software projects. @Sc00bzT > @DefuseSec You should put this challenge on your website. @DefuseSec > @Sc00bzT Good idea, added it to this page: https://defuse.ca/security-contact-vulnerability-disclosure.... @Sc00bzT > @DefuseSec Did I just win? @DefuseSec > @Sc00bzT FUCK. What's yo…
Comment linking /security-contact-vulnerability-disclosure.htm
on “Did I just win?”Submitted ECryptfs Security Audit as a story · 77 points
HN discussionhttps://defuse.ca/passgen.htm uses /dev/(u)random on Linux and CryptGenRandom() on Windows, with source code on GitHub for Linux https://github.com/defuse/passgen and https://github.com/defuse/WinPassGen Without a pile of dependencies :P
Comment linking /passgen.htm
on “"Pwned Passwords" V2 With Half a Billion Passwords”Submitted Triangle of Secure Code Delivery (2014) as a story · 35 points
HN discussionThere is a relatively recent audit[1] of EncFS with some damning results. I really wouldn't use it. [1]: https://defuse.ca/audits/encfs.htm
Comment linking /audits/encfs.htm
on “TrueCrypt suggesting migration to BitLocker?”Submitted TrueCrypt's Plausible Deniability is Theoretically Useless (2013) as a story · 29 points
HN discussionNot exactly that service -- too much uncertainty about when quantum computers will get cheap enough -- but https://defuse.ca/quantum-computer-time-capsule.htm
Comment linking /quantum-computer-time-capsule.htm
on “Stanislav Petrov, a Soviet officer who averted nuclear war, has died”Submitted Bochs Hacking Guide (2014) as a story · 20 points
HN discussionThey use a conservative GC, which I understand, as they were using it before FTL JIT, and it required minimal changes for integration with LLVM-based JIT. However, in the blog post, they mention several times that they wanted to avoid stack maps because that would require spilling pointers from registers to stack, which they say is undesirable for performance reasons. I wonder, however, how slow register spilling re…
Comment linking /online-x86-assembler.htm
on “Introducing the WebKit FTL JIT”Submitted Microsoft visits links you send in Skype as a story · 7 points
HN discussionThis is good to know. Thank you for the great work. I've been looking for alternatives, but I think I'll stick with TC for now. 1. Download it for your OS : https://www.grc.com/misc/truecrypt/truecrypt.htm 2. Verify the hash : https://defuse.ca/truecrypt-7.1a-hashes.htm
Comment linking /truecrypt-7.1a-hashes.htm
on “Truecrypt report”Submitted Advice to Aspiring Computer Security Engineers/Scientists as a story · 6 points
HN discussionAn example where auditors not having the threat model did not help the audit: https://defuse.ca/audits/gocryptfs.htm > We believe the reason these vulnerabilities exist is because gocryptfs doesn’t have a clearly spelled-out threat model. Some of the attacks seem hard to avoid given gocryptfs’s performance goals and may have been introduced “by design” to meet these goals. We suggest writing down an explicit threat…
Comment linking /audits/gocryptfs.htm
on “Review of Mullvad VPN”Submitted A Plausible Reason It's So Hard to Prove P =NP as a story · 4 points
HN discussionAh, you're right, I had it confused with a similar analysis on EncFS which had more significantly damaging findings. https://defuse.ca/audits/encfs.htm I wasn't even aware Ext4 had native encryption support though! I'll definitely have to give that a go. Thanks for the tip.
Comment linking /audits/encfs.htm
on “Ending support for Dropbox syncing to drives with certain uncommon file systems”Submitted EncFS Security Audit Results as a story · 4 points
HN discussionThere was also a series of issues found by with the encryption used by ecryptfs: https://defuse.ca/audits/ecryptfs.htm The full disk block-based (as opposed to this file-based) encryption is really the way to go if you want a good security and performance margin.
Comment linking /audits/ecryptfs.htm
on “Ending support for Dropbox syncing to drives with certain uncommon file systems”Submitted TrueCrypt's Plausible Deniability Is Theoretically Useless (2013) as a story · 3 points
HN discussion@kefs: I can't agree more. Here is it with Skype chats- https://defuse.ca/microsoft-reads-your-skype-messages.htm
Comment linking /microsoft-reads-your-skype-messages.htm
on “Facebook Chats Are Being Scanned by a CIA Funded Company?”Submitted Gocryptfs Security Audit as a story · 3 points
HN discussionhttps://defuse.ca/audits/encfs.htm is an EncFS security audit, that didn't come out too clean. If you install encfs on debian it pops up a warning screen telling you to not use it for anything too sensitive atm.
Comment linking /audits/encfs.htm
on “Even the LastPass Will Be Stolen”Submitted TrueCrypt's Plausible Deniability Is Theoretically Useless (2013) as a story · 2 points
HN discussionEncfs didn't survive its security audit very well: https://defuse.ca/audits/encfs.htm (I don't know how much has it improved since then, though)
Comment linking /audits/encfs.htm
on “KeePass – questionable security”Submitted Time Capsule: Send a Message to the Future as a story · 2 points
HN discussionas long as you do proper signing of code, reproducible builds, then your security concerns go away. https://defuse.ca/triangle-of-secure-code-delivery.htm
Comment linking /triangle-of-secure-code-delivery.htm
on “AppImage: Linux apps that run anywhere”Submitted Encrypted Pastebin – Keep your data private and secure as a story · 2 points
HN discussionIf you go down to the "proof of concept" here it's not hard to test this: https://defuse.ca/race-conditions-in-web-applications.htm
Comment linking /race-conditions-in-web-applications.htm
on “Race conditions on Facebook, DigitalOcean and others (fixed)”Submitted The Triangle of Secure Code Delivery as a story · 2 points
HN discussion
