Dan Goodin
@dangoodin.bsky.social
Cybersecurity Reporter, Ars Technica: https://arstechnica.com/author/dan-goodin/ Hungry for tips. Text me on Signal: DanArs.82. "The world isn’t run by weapons anymore, or energy, or money. It’s run by little 1s and 0s, little bits of data."
A quantum-resistant cryptography algorithm that was under consideration to become an official US standard has been taken out of the running after an Anthropic security model helped find a flaw that rendered it broken. arstechnica.com/security/202...
Mythos attack on 3rd-round PQC algorithm candidate puts it out of commission
HAWK withstood years of testing that had yet to uncover a fatal weakness found through Mythos.
arstechnica.com
You too can turn a Bluetooth device into a PC-pwning proxy arstechnica.com/security/202...
How a USB-connected speaker can infect a PC without ever being touched
Seller of the Sound Blaster Katana V2X doesn't consider the behavior a vulnerability.
arstechnica.com
If it wasn't already, 2FA spraying is now a thing, as Dashlane users now know. arstechnica.com/security/202...
Dashlane explains how attackers managed to download encrypted password vaults
By targeting large numbers of users, attackers increased their chances of success.
arstechnica.com
Incident responder who gets to see behind the scenes on a lot of these: In 2026, if the company is being this obtuse it's either REALLY BAD(tm) or they have horrible incident response preparedness. Neither one is good for their customers.
Dan Goodin@dangoodin.bsky.social · 2mo agoCan’t make sense of Dashlane’s vault theft notification? You’re not alone. arstechnica.com/security/202...
Can’t make sense of Dashlane’s vault theft notification? You’re not alone. arstechnica.com/security/202...
Can't make sense of Dashlane's vault theft notification? You're not alone.
Security advisory leaves out key details. Dashlane maintains complete silence.
arstechnica.com
Anybody know of any Linux distributions that have released fixes for Dirty Frag?
I just donated to SPLC because the work it does makes the world a safer and more just place. Please do the same if able.
The Washington Post@washingtonpost.com · 4mo agoThe Southern Poverty Law Center, an organization founded to promote racial justice in the South, said it is facing a Justice Department investigation including possible criminal charges over its past use of paid informants to infiltrate extremist groups.
With growing focus on the threat quantum computing poses to crucial and widely used forms of encryption, @filippo.abyssdomain.expert wants to make one thing clear: Contrary to popular mythology that refuses to die, AES 128 is perfectly fine in a post-quantum world arstechnica.com/security/202...
Contrary to popular superstition, AES 128 is just fine in a post-quantum world
A stubborn misconception is hampering the already hard work of quantum readiness.
arstechnica.com
“Transitioning the Internet to post-quantum, especially for digital signatures, is a massive undertaking. By setting a 2029 goal, they are giving themselves some slack. If they target 2035 and miss by 2 years, we are getting uncomfortably close to the danger zone.” arstechnica.com/security/202...
Recent advances push Big Tech closer to the Q-Day danger zone
Here's which players are winning the race to transition to post-quantum crypto.
arstechnica.com
Now, there's a 3rd Rowhammer attack on Nvidia GPUs that gains CPU root even when IOMMU is enabled. My story has been updated throughout. arstechnica.com/security/202...
New Rowhammer attacks give complete control of machines running Nvidia GPUs
Both GDDRHammer and GeForge hammer GPU memory in ways that compromise the CPU.
arstechnica.com
Dan Goodin@dangoodin.bsky.social · 4mo agoThe cost and shortage of GPUs means they're frequently shared among dozens of users in cloud environments. 2 new Rowhammer attacks demonstrate how a malicious user can gain full root control of the host machine running high-performance Nvidia GPU cards. arstechnica.com/security/202...
The cost and shortage of GPUs means they're frequently shared among dozens of users in cloud environments. 2 new Rowhammer attacks demonstrate how a malicious user can gain full root control of the host machine running high-performance Nvidia GPU cards. arstechnica.com/security/202...
New Rowhammer attacks give complete control of machines running Nvidia GPUs
Both GDDRHammer and GeForge hammer GPU memory in ways that compromise the CPU.
arstechnica.com
Building a utility-scale quantum computer that can crack one of the most vital cryptosystems—elliptic curves—doesn’t require nearly the resources anticipated just a year or two ago, two independently written whitepapers have concluded. arstechnica.com/security/202...
Quantum computers need vastly fewer resources than thought to break vital encryption
No, the sky isn't falling, but Q Day is coming, and it won't be as expensive as thought.
arstechnica.com
Kaspersky has linked Coruna with Operation Triangulation. This somes a few weeks after we reported that L3Harris Trenchant was the company behind some components of Coruna. And we also reported that it was possible Coruna was used in Operation Triangulation. securelist.com/coruna-frame...
Google is dramatically shortening its readiness deadline for the arrival of Q Day, the point at which existing quantum computers can break public-key algorithms that secure decades’ worth of secrets belonging to militaries, banks, and nearly every individual on earth arstechnica.com/security/202...
Google bumps up Q Day deadline to 2029, far sooner than previously thought
Company warns entire industry to move off RSA and EC more quickly.
arstechnica.com
I was lucky enough to cover Cindy Cohn's trailblazing work BEFORE she joined @eff . Here's one of several stories I wrote about her when she was still an associate attorney in private practice.
Burner accounts on social media sites can increasingly be analyzed to identify the pseudonymous users who post to them using AI in research that has far-reaching consequences for privacy on the Internet, researchers said. arstechnica.com/security/202...
LLMs can unmask pseudonymous users at scale with surprising accuracy
Pseudonymity has never been perfect for preserving privacy. Soon it may be pointless.
arstechnica.com
Excellent article on the work by @dangoodin.bsky.social: arstechnica.com/security/202... I'd say we bypass Wi-Fi encryption, in the sense that we can bypass client isolation. We don't break Wi-Fi authentication or encryption. Crypto is often bypassed instead of broken. And we bypass it ;)
New AirSnitch attack breaks Wi-Fi encryption in homes, offices, and enterprises
That guest network you set up for your neighbors may not be as secure as you think.
arstechnica.com
That guest SSID you set up for your neighbors may not be as secure as you think arstechnica.com/security/202...
New AirSnitch attack breaks Wi-Fi encryption in homes, offices, and enterprises
That guest network you set up for your neighbors may not be as secure as you think.
arstechnica.com
This local Wolfdog joined an Olympic ski event and triggered the finish-line camera. This is Nazgul. He snuck into a cross-country skiing sprint this morning and raced the homestretch with some competitors before being escorted home. 14/10 someone get him a medal
The makers of password managers like Bitwarden, 1Password, Dashlane and LastPass promise they can't see your password vault. But that's not always true. A server compromise can mean game over for you, say researchers who examined some of the top password managers on the market
Password managers' promise that they can't see your vaults isn't always true
Contrary to what password managers say, a server compromise can mean game over.
arstechnica.com
Contrary to what password managers say, a server compromise can mean game over. arstechnica.com/security/202...
Password managers' promise that they can't see your vaults isn't always true
Contrary to what password managers say, a server compromise can mean game over.
arstechnica.com
Contrary to what password managers say, a server compromise can mean game over. arstechnica.com/security/202...
Password managers' promise that they can't see your vaults isn't always true
Contrary to what password managers say, a server compromise can mean game over.
arstechnica.com
Scoop: A report published last week outlined what Palo Alto researchers believed was a China-linked hacking campaign. But after an intervention from execs, the report's language was changed to refer more vaguely to "a state-aligned group that operates out of Asia." www.reuters.com/world/china/...
Exclusive: Palo Alto chose not to tie China to hacking campaign for fear of retaliation from Beijing, sources say
Palo Alto Networks opted not to tie China to a global cyberespionage campaign the firm exposed last week over concerns that the cybersecurity company or its clients could face retaliation from Beijing...
reuters.com
I filed this FOIA after publishing this investigation into ICE agents abusing law-enforcement databases. www.wired.com/story/ice-ag.... Those records are here: airtable.com/appxK2tDF0YA...
ICE Records Reveal How Agents Abuse Access to Secret Data
Documents obtained by WIRED detail hundreds of investigations by the US agency into alleged database misuse that includes harassment, stalking, and more.
wired.com
If throngs of people handed over their IDs in exchange for a vanity blue check from a pro-authoritarian site, what reason is there to think Discord users won't do the same?
Two security professionals who were arrested in 2019 after performing an authorized security assessment of a county courthouse in Iowa will receive $600,000 to settle a lawsuit they brought alleging wrongful arrest and defamation. arstechnica.com/security/202...
County pays $600,000 to pentesters it arrested for assessing courthouse security
Settlement comes more than 6 years after Gary DeMercurio and Justin Wynn's ordeal began.
arstechnica.com
Trump’s federal thugs beat up on His face and his chest Then we heard the gunshots And Alex Pretti lay in the snow, dead Their claim was self defense, sir Just don’t believe your eyes It’s our blood and bones And these whistles and phones Against Miller and Noem’s dirty lies (Full lyrics @ YT page)
Bruce Springsteen@brucespringsteen.net · 6mo agoI wrote this song on Saturday, recorded it yesterday and released it to you today in response to the state terror being visited on the city of Minneapolis. It’s dedicated to the people of Minneapolis, our innocent immigrant neighbors and in memory of Alex Pretti and Renee Good. Stay free
Thanks to @dangoodin.bsky.social for writing one of the few articles that actually questioned the @nytimes.com report.
Val@vallha11a.neocities.org · 7mo agoAffirming that a U.S. cyberattack caused a large scale power outage in Caracas on Jan 3, while not even mentioning the intentional bombing of power infrastructure, is misleading. The NYT article is speculative and doesn't provide any technical evidence. 👉 arstechnica.com/security/202...
Conservatives Say Renée Good Was Brainwashed By Bible Into Loving Thy Neighbor https://theonion.com/conservatives-say-renee-good-was-brainwashed-by-bible-into-loving-thy-neighbor/
New, by me: Security researcher Eaton Zveare spent weeks trying to alert a little-known but critical U.S. cargo tech giant that their shipping systems and customers' data were exposed to the web. After weeks of trying, Zveare asked TechCrunch for help. We heard back! ...from the company's law firm.
Exclusive: US cargo tech company publicly exposed its shipping systems and customer data to the web
Shipping tech company Bluspark left internal plaintext passwords, including those of executives, exposed to the internet, at a time when hacks in the shipping industry are on the rise.
techcrunch.com