ritter.vg

There's a popular post going around about Alibaba doing WebAudio fingerprinting and in the process, mucking around with the author's Bluetooth headphones.

WebGL exposes the details of your graphics hardware (specifically, the string that describes the rendering engine) in 2 ways.

Phew, it's been a minute since I last wrote anything, hasn't it.

This article originally appeared on the Mozilla Hacks blog.

Over time, I've accumulated a lot of ideas that I would love to work on myself, but have to admit I pretty much never will (there's only so many hours in the day.)

For the past year and change I've been working with dkg and Linus Nordberg on Certificate Transparency Gossip.

Recently I wanted to run a complex query across every certificate in the CT logs.

A little bit ago NCC Group North America had an all-hands retreat, and solicited technical talks.

A little bit ago, while in London at Real World Crypto and hanging out with some browser and SSL folks, I mentioned the thought "Why isn't there a directive in HSTS to require OCSP Stapling?"

Disk Encryption is “a litany of difficult tradeoffs and messy compromises” as our good friend and mentor Tom Ptacek put it in his blog post.

Tor is interesting for a lot of reasons.

Many moons ago, before Grub2 came about, I looked into booting from a RAID partition.

Last May, I was in Hong Kong for OpenITP's Circumvention Tech Summit - and I ended up taking an afternoon walk with none other than Daniel Kahn Gillmor.

I'd like to take a moment to talk about privacy preserving by default.

Background: there's this huge problem where TLS ClientHellos that exceed 255 bytes result in hangs for certain hardware (like some F5 hardware).

Over the past year, iSEC Partners has worked with the Open Technology Fund on several of their supported projects, and I've been extremely fortunate to have a finger, arm, or whole body in each of the audits.

Unless you've been living under a rock for the past weekend, you heard about several documents publish by The Guardian and The Washington Post that are (likely) from the NSA explaining how they deal with Tor.

Randomness, and DSA Last weekend, Bitcoin reported that several Android-based wallets were insecure and that bitcoin were stolen from them - all because the individual transactions (authenticated by a ECDSA signature) used a poor source of randomness.

I've been overwhelmed by the positive response to De-Anonymizing Alt.Anonymous.Messages on twitter, mailing lists, reddit, and all around.

For the past four years I've been working on a project to analyze Alt.Anonymous.Messages, and it was finally getting to a point where I thought I should show my work.

Hi all.

This week is the 19th Annual International C.

This blog post originally appeared on crypto.is.

If you spin up a Windows Instance on Amazon EC2, the only way to get your password to it is using an Amazon-provided command-line tool to decrypt the password (supplying your private SSH Key) or pasting your private SSH key into the Web Interface.

Liberation Technology is kind of a catch-all bucket I borrowed from Stanford's Program & Listserv that I use to describe technology that's designed to be used by activisits, journalists, folks with increased privacy needs (survey participants, whistleblow…

I don't write a lot, so when I do write for another blog (usualy an employer's) I tend to go to pains to copy the blog post here (with a credit).

SSL is designed to provide Authenticity, Confidentiality, and Integrity.

This is a tad dated, but I need to catch this blog up to the blog posts I've authored for my employer's blog.

This blog post originally appeared on crypto.is.

This blog post originally appeared on crypto.is.

This blog post originally appeared on crypto.is.

This blog post originally appeared on crypto.is.

This blog post originally appeared on crypto.is.

Pond is a personal project published this weekend by Adam Langley.

So Google Chrome has a preloaded list of sites they can force SSL on (Strict Transport Security) and certificates they can pin up to (Public Key Pinning).

Background Juliano Rizzo and Thai Duong, the authors of the BEAST attack on SSL (or TLS - used interchangeably here), have released a new attack dubbed CRIME, or Compression Ratio Info-leak Made Easy.

Scroll Down for an Update Recently Couchsurfing sent out an email about their new terms of service.

Jon Passki came to me a couple months ago with an idea for a new adaptive ciphertext attack on block cipher modes - similar to the Padding Oracle or Manger's Oracle attacks.

Something I've been interested in for the past few months is SSL/TLS, and in particular looking at undetectable attacks.

Just two weeks (to the day) after presenting Cloud & Control at RSA in San Francisco, I was in Amsterdam presenting at Black Hat EU.

Calyx Institute, Nick, et al I can't express how impressed and inspired I was by Nick's prolonged legal battle.

I gave my first presentation at a security conference on Friday, presenting at ekoparty on some work I did at the beginning of the year on distributing complex tasks to hundreds or thousands of computers.

I just got out of Dan Kaminsky's talk at Black Hat where he talked about a myriad of topics, but the one I want to focus on was his tool Phidelius.

I am not a lawyer, and this blog does not constitute legal analysis.

Several months ago I was looking at the proceedings from #days 2010 and read Pascal Junod's slides Open-Source Cryptographic Libraries and Embedded Platforms.

I've heard it from three different sources: Certificate Authorities will make verification more painful, more costly, and more difficult - but only if they're mandated industry-wide.

I've been working on a document for a while, and I'm happy to announce it's made it's way through the committees and has been accepted by the IETF.

I got some bleed-through badges at a client the other month.

A few weeks ago NYU Polytechnic held the final round of their Capture the Flag.

There's a million and one explanations of how RSA Encryption works, but significantly fewer on ElGamal - which is used more often these days (at least, based on the default key selection in gnupg).