SMTP smuggling is a critical vulnerability allowing email spoofing that bypasses standard authentication protocols like SPF and DMARC. This research presents a large-scale study on its prevalence, uncovering widespread issues due to shared infrastructure and incomplete patches, and introduces a novel, non-intrusive methodology for ethically testing private email services.
This talk introduces an "abusability analysis framework" to evaluate technologies like passkeys under interpersonal threat models, such as intimate partner violence. An analysis of 19 services revealed critical implementation flaws, including irrevocable cloned passkeys and the failure of password resets to secure accounts, which can create persistent backdoors for abusers.
A novel framework called zk-promises is introduced, enabling stateful anonymous credentials with Turing-complete state machines and asynchronous callbacks. This allows for robust moderation, such as banning or reputation updates, for anonymous users without compromising their privacy, using zk-objects and zero-knowledge proofs to ensure state integrity.
Tom Chothia and George Pavlides discuss how proprietary, uncoordinated features built on top of the core EMV specification by companies like Apple, Google, Square, Visa, and Mastercard lead to significant security vulnerabilities. They detail how these "black box" additions create subtle interactions and mismatches, enabling attacks that bypass authentication, allow high-value fraudulent offline transactions, and leave merchants vulnerable to significant financial loss.
Sy Brand, author of "Building a Debugger," and Tim Misiak explore how implementing a debugger is one of the most effective ways to gain a deep understanding of operating systems, compilers, and hardware. They delve into the unexpected complexities of core features like stack unwinding and code stepping, the challenges posed by legacy APIs like ptrace and debug formats like DWARF, and the future of debugging with advancements in time travel debugging and tools for optimized code.
A conversation with C++ expert Patrice Roy, author of 'Memory Management in C++', exploring the core principles of modern memory management. The discussion covers the pitfalls of over-allocation, the nuanced use of smart pointers, the importance of measurement before optimization, and when to consider custom allocators for peak performance.