Top all-time · #2133
Hanno
Personal blog · blog.hboeck.desecurityprogrammingsystems
Hanno's personal blog at blog.hboeck.de covers security, programming and systems. Since 2014, 37 different Hacker News readers have linked it 85 times, most often “Pwncloud – Bad crypto in the Owncloud encryption module”. It is still writing: the last post was on 2025-02-25, and you can follow it by feed.
Most-linked posts?
- Pwncloud – Bad crypto in the Owncloud encryption module6 people · 7 mentions · first linked 2016-04-04
- About the supposed factoring of a 4096 bit RSA key4 people · 4 mentions · first linked 2015-05-17
- How Kaspersky makes you vulnerable to the FREAK attack3 people · 5 mentions · first linked 2015-04-26
- OCSP Stapling, Must Staple and Why Certificate Revocation Is Still Broken3 people · 5 mentions · first linked 2017-05-19
- Safer use of C code – running Gentoo with Address Sanitizer3 people · 4 mentions · first linked 2016-01-26
- How Heartbleed could've been found3 people · 3 mentions · first linked 2015-04-07
- Don't update NTP – stop using it3 people · 3 mentions · first linked 2014-12-19
- LibreSSL on Gentoo2 people · 3 mentions · first linked 2014-07-12
- Efail: HTML Mails have no Security Concept and are to blame2 people · 3 mentions · first linked 2018-06-27
- Abandoned Domain Takeover as a Web Security Risk2 people · 3 mentions · first linked 2017-09-05
What Hacker News says?
I've written and talked about this a couple of times. Each and every one of these products does some kind of TLS security degredation: * https://blog.hboeck.de/archives/869-How-Kaspersky-makes-you-... * https://media.ccc.de/v/camp2015-6833-tls_interception_consid...
Comment linking /archives/869-How-Kaspersky-makes-you-vulnerable-to-the-FREAK-attack-and-other-ways-Antivirus-software-lowers-your-HTTPS-security.html
on “Avoid Non-Microsoft Antivirus Software”Submitted #include </etc/shadow> as a story · 406 points
HN discussionYes. I got this realization during a study project where I investigated the use of secure cookies (was 2009, it's public [1]). It's just one example, but you can find similar things everywhere. Sessions in Web applications are realized using cookies, which is not a very good way, because once someone manages to steal your cookie your session management is broken. And there are plenty of ways to do that, because ther…
Comment linking /archives/681-Study-research-project-about-session-cookies,-SSL-and-session-hijacking.html
on “Ask HN: Is web programming a series of hacks on hacks?”Submitted Comodo ships Adware Privdog worse than Superfish as a story · 274 points
HN discussionAn intermediate step is to run everything under AddressSanitizer, since it's fast enough for many cases. See, for example: https://blog.hboeck.de/archives/879-Safer-use-of-C-code-runn...
Comment linking /archives/879-Safer-use-of-C-code-running-Gentoo-with-Address-Sanitizer.html
on “Glibc getaddrinfo stack-based buffer overflow”Submitted About the supposed factoring of a 4096 bit RSA key as a story · 231 points
HN discussionInstead of downvoting, let's educate people a bit more: 1. Picking a small key is all on the user. It's like choosing the single letter 'a' as a password. If you want to do so why not? 2. The key you give to github is a "public" key. It is made to be public so this should be irrelevant. 3. There is 'almost' no known countermeasures against mass crawls of public keys. Look at the recent attacks: https://blog.hboeck.d…
Comment linking /archives/872-About-the-supposed-factoring-of-a-4096-bit-RSA-key.html
on “Auditing GitHub users’ SSH key quality”Submitted Please do not put IP addresses into DNS MX records as a story · 228 points
HN discussionActually, libressl is practical drop-in replacement of openssl if you use only sane parts of openssl's functionality. Biggest problem now is some upstream softwares still depends on insanity Openbsd devs nuked away, like RAND_egd() or won't admit that libressl actually exist :) ( https://devsonacid.wordpress.com/2014/07/12/how-compatible-i... , https://blog.hboeck.de/archives/851-LibreSSL-on-Gentoo.html ) But situat…
Comment linking /archives/851-LibreSSL-on-Gentoo.html
on “OpenSSL Security Advisory”Submitted How I Tricked Symantec with a Fake Private Key as a story · 200 points
HN discussionActually doing this at the network level is already done by some ad blockers. And it likely is going to cause more problems than it solves in light of https usage. The only thing you can do there is Man-in-the-Middle connections - with all the bad implications this has: https://blog.hboeck.de/archives/874-More-TLS-Man-in-the-Midd...
Comment linking /archives/874-More-TLS-Man-in-the-Middle-failures-Adguard,-Privdog-again-and-ProtocolFilters.dll.html
on “Show HN: FuckFuckAdblock”Submitted Pwncloud – Bad crypto in the Owncloud encryption module as a story · 175 points
HN discussionWhen efail came out, I wrote a blogpost about the security risks of HTML mail. It is really amazing how problematic all of this is, despite its widespread use. The HTML mail spec is really old, and contains almost no security considerations. HTML in emails can only be a subset of HTML to be secure. But nobody has ever defined what exactly that subset is, so everyone does whatever they think. And unsurprisingly, this…
Comment linking /archives/894-Efail-HTML-Mails-have-no-Security-Concept-and-are-to-blame.html
on “Kobold letters: HTML emails are a risk”Submitted Userdir URLs like https://example.org/~username/ are dangerous as a story · 155 points
HN discussionThere was a blog post and a FOSDEM presentation by (misguided) Gentoo developers a few years ago, and it was retracted, because sanitizers add their own exploitable vulnerabilities due to the way they work. https://blog.hboeck.de/archives/879-Safer-use-of-C-code-runn... https://www.openwall.com/lists/oss-security/2016/02/17/9
Comment linking /archives/879-Safer-use-of-C-code-running-Gentoo-with-Address-Sanitizer.html
on “The Byte Order Fiasco”Submitted How Heartbleed could've been found as a story · 144 points
HN discussionI don't even understand why people use antivirus software. Sure, if you're on an ancient version of your OS, like Windows XP, then it might serve some purpose, but assuming modern versions of these operating systems, antivirus software does more harm than good. Worried about browser extensions? Another problem is that popular antivirus software are also installing their own root certificate so they can MITM secure H…
Comment linking /archives/869-How-Kaspersky-makes-you-vulnerable-to-the-FREAK-attack-and-other-ways-Antivirus-software-lowers-your-HTTPS-security.html
on “Mozilla and Opera remove Avast extensions from their add-on stores”Submitted LibreSSL on Gentoo as a story · 99 points
HN discussionWikipedia has a good description on what OCSP Stapling is[1] and how it works. When I read the Apache projects' WONTFIX reason, I presumed that it was related to how plain OCSP requires the client to "phone home" in order to check whether a certificate has been revoked or not – which has implications for the privacy of the browser. However, now that I know OCSP Stapling works (the web server caches and proxies time-…
Comment linking /archives/886-The-Problem-with-OCSP-Stapling-and-Must-Staple-and-why-Certificate-Revocation-is-still-broken.html
on “Let's Encrypt OCSP and Issuance Outage Postmortem”Submitted Don't Leave Coredumps on Web Servers as a story · 87 points
HN discussionI had covered the issue of AV mitm-ware a while ago on my blog: https://blog.hboeck.de/archives/869-How-Kaspersky-makes-you-... It is not superfish-bad, but it's still bad. But AVs are full of security problems, it's really just a broken concept.
Comment linking /archives/869-How-Kaspersky-makes-you-vulnerable-to-the-FREAK-attack-and-other-ways-Antivirus-software-lowers-your-HTTPS-security.html
on “Avast’s man in the middle”Submitted Generating Crime Safe CSRF Tokens as a story · 35 points
HN discussionI crossed Kazakhstan by rail+bus in 2013, I wrote a few blogposts: https://blog.hboeck.de/plugin/tag/kazakhstan
Comment linking /plugin/tag/kazakhstan
on “Across Kazakhstan by rail”Submitted File Exfiltration via LibreOffice in BigBlueButton and JODConverter as a story · 32 points
HN discussion> Still think it was 'cosmic rays' on SKS's machines? Just FYI, this kind of stuff seems to have been done before, with vulnerable keys found: https://eprint.iacr.org/2012/064.pdf (2012), https://factorable.net/ (these two are mentioned and linked to from https://blog.hboeck.de/archives/872-About-the-supposed-facto... ) And (off-topic) if you are wondering why some of your recent comments are being downvoted so much…
Comment linking /archives/872-About-the-supposed-factoring-of-a-4096-bit-RSA-key.html
on “4096 RSA key in the strongset factored?”Submitted #include </etc/shadow> as a story · 16 points
HN discussionCouldn't agree more, this (among others) was brilliant: https://blog.hboeck.de/archives/888-How-I-tricked-Symantec-w...
Comment linking /archives/888-How-I-tricked-Symantec-with-a-Fake-Private-Key.html
on “Comodo fails to check CAA records”Submitted PrivDog wants to protect your privacy – by sending data home in clear text as a story · 12 points
HN discussionI agree. Just pointing out that the specific problem the above poster mentioned as a reason to choose OwnCloud also is similarly true of OwnCloud. https://blog.hboeck.de/archives/880-Pwncloud-bad-crypto-in-t...
Comment linking /archives/880-Pwncloud-bad-crypto-in-the-Owncloud-encryption-module.html
on “Owncloud has been forked into Nextcloud”Submitted Dancing protocols, POODLEs and other tales from TLS as a story · 11 points
HN discussion
