L
Light Blue Touchpaper
lightbluetouchpaper.org · Group blog · on HN since 2007
The University of Cambridge security group, including Ross Anderson, writes about security research, payment card flaws, and hardware attacks.
What HN saysCommenters hold it in high regard, pointing to its work on Chip and PIN and card payment weaknesses, and ask when it went offline.
164HN people shared it
58linked it in comments
220stories submitted
4.1Kstory points
1 year agolast shared
2007people per year2026
Most-shared posts
- 1Homepage10 people · first shared 2011
- 2Chip and Pin is Broken (Credit Card Security Issue)9 people · 16 points · first shared 2010 · 2 comments on HN
- 3Contact Tracing in the Real World5 people · 118 points · first shared 2020 · 80 comments on HN
- 4Cloning Chip+PIN/EMV cards with a pre-play attack5 people · 12 points · first shared 2012 · discussion on HN
- 5Will GPT models choke on their own exhaust?5 people · 7 points · first shared 2023 · discussion on HN
- 6Making sense of the alleged Supermicro motherboard attack3 people · 707 points · first shared 2018 · 313 comments on HN
- 7Formal CHERI: design-time proof of full-scale architecture security properties (2022)3 people · 155 points · first shared 2022 · 47 comments on HN
- 8Data ordering attacks on deep neural networks3 people · 45 points · first shared 2021 · 4 comments on HN
- 9A one-line software patent, and a fix (2012)3 people · 18 points · first shared 2012 · discussion on HN
- 10Security Engineering: Third Edition3 people · 12 points · first shared 2019 · discussion on HN
- 11SRI and Cambridge release CHERI software stack for Arm Morello3 people · 8 points · first shared 2020 · discussion on HN
- 12How Privacy Fails: The Facebook Applications Debacle3 people · 5 points · first shared 2009 · discussion on HN
- 13Tool to recover files from FileVault 2 (Apple's full-disk encryption)3 people · 4 points · first shared 2012 · 1 comments on HN
- 14Struck by a Thunderbolt2 people · 156 points · first shared 2019 · 61 comments on HN
- 15A new way to detect ‘deepfake’ picture editing2 people · 147 points · first shared 2021 · 88 comments on HN
What HN people wrote when they linked it
confounded · 2016-07-30
Interestingly (on reflection, not surprisingly) since going back to RSS, I've been reading a lot more from sites with expert content, but ugly typography.
- Math Babe (https://mathbabe.org)
+ Superb musings and coverage on the societal
impact of everything becoming a prediction
problem (occasional applied technical
discussion)
- Tech Dirt (https://www.techdirt.com/)
+ Lawyers Rule Everything Around Me
- Light Blue Touchpaper (https://www.lightbluetouchpaper.org)
+ Thoughts on infosec from Cambridge Computer
Laboratory (influential on policy, excellent
coverage of conferences)
- Muckrock (https://www.muckrock.com/)
+ News from the FOIA wars
moocowduckquack · 2013-07-26
They should try and publish it with the cambridge lot who write the light blue touchpaper blog.
http://www.lightbluetouchpaper.org/
They ran into a similar situation with the banks and answered with one of the best academic slap downs I have ever read.
http://www.cl.cam.ac.uk/~rja14/Papers/ukca.pdf
alecmuffett · 2012-05-28
@laughinghan if you have to ask my suspicion is that no word of mouth will be enough for you, so instead may I recommend:
http://en.wikipedia.org/wiki/Ross_J._Anderson
http://en.wikipedia.org/wiki/Markus_Kuhn
http://en.wikipedia.org/wiki/Steven_Murdoch
...and http://www.lightbluetouchpaper.org/ ; I am unaffiliated with Cambridge other than knowing a few of the people there.
tialaramex · 2025-06-01
Light Blue Touchpaper https://www.lightbluetouchpaper.org/ might well be interested in this work, the card payment tech is something they spent lots of time looking at and they tend to have a more realistic assessment of where the weaknesses might be that the industry which tends to see itself as infallible.
masfuerte · 2025-04-06
This is tangential, but seeing a Ross Anderson article reminded me...
Does anyone know if <https://www.lightbluetouchpaper.org/> is permanently gone or just temporarily down?
Zarkonnen · 2015-06-25
Ah, good old Markus Kuhn. Always up for poking security features using any way possible. If you're interested in this kind of thing, you should read https://www.lightbluetouchpaper.org/ which is UoC's security research blog.
nickpsecurity · 2015-05-30
I'll add that passwords are used because they're the best default given all the constraints and risks:
https://www.lightbluetouchpaper.org/2012/05/22/the-quest-to-replace-pa…
They fail when their correct use depends on human beings. Just like you said.
bgentry · 2013-07-27
tikkun.org seems to be down. Here's the Google cache: http://webcache.googleusercontent.com/search?q=cache:http://www.tikkun…
Here's the blog post from the Google Engineer (Joseph Bonneau) about accepting the award: http://www.lightbluetouchpaper.org/2013/07/19/nsa-award-for-best-scien…
gtani · 2013-05-19
this is a good blog to follow: http://www.lightbluetouchpaper.org/category/banking-security/
rdl · 2012-12-17
http://theinvisiblethings.blogspot.com/ - blue pill company, etc.
http://www.lightbluetouchpaper.org/ - cambridge (uk) security group
DanBC · 2011-10-31
I hope you give a couple of prototypes to Richard Clark for testing.
(http://www.cl.cam.ac.uk/~rnc1/)
(http://www.lightbluetouchpaper.org/)
thaumasiotes · 2025-05-07
Imagine?
> This week brought an announcement from a banking association that “identity fraud” is soaring to new levels, with 89,000 cases reported in the first six months of 2017 and 56% of all fraud reported by its members now classed as “identity fraud”.
> So what is “identity fraud”? The announcement helpfully clarifies the concept:
> “The vast majority of identity fraud happens when a fraudster pretends to be an innocent individual to buy a product or take out a loan in their name.
> Now back when I worked in banking, if someone went to Barclays, pretended to be me, borrowed £10,000 and legged it, that was “impersonation”, and it was the bank’s money that had been stolen, not my identity. How did things change?
https://www.lightbluetouchpaper.org/2017/08/26/is-the-city-force-corru…
SamuelAdams · 2023-10-02
Probably not. What is your threat model?
Full disk encryption only solves part of an overall threat model. The biggest difference between VeraCrypt and FileVault is that one is open source and auditable. FileVault does have some publicly available technical whitepapers, however Apple has not released the source code.
So aside from black box testing FileVault itself, you’ll just have to trust that the engineers at Apple did a good job.
Otherwise the differences are largely the same: how long is your passphrase, where do you store that, etc.
https://www.lightbluetouchpaper.org/2012/08/06/analysis-of-f...
https://eprint.iacr.org/2012/374.pdf
barathr · 2023-06-16
I wonder what metrics can be used to detect the emergence of "model collapse" as described by Ross Anderson's group in this paper:
https://www.lightbluetouchpaper.org/2023/06/06/will-gpt-models-choke-o…
throwaway202302 · 2023-02-28
https://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-dem…
Rather old one, where 25m was claimed. (Markus Kuhn).
Some like 200m were claimed by anons in random threads (https://www.mikrocontroller.net/topic/319197, in german), but that might have been related to CRT, not sure. They said they pointed antennas towards an office building.
All in all, the topic seems valid but unfortunately the discussions tend to be trolled.
One takeaway from the original link for me was to prefer displayport cable over hdmi/dvi. Yet, if the shielded connectors you have been referring to are easy to find, sounds good as well.
Absolute security is not possible, they say. Yet I wonder, can we have some sort of it at least outside a horizon of lets say 5 meters? Broadcasting the signals few meters/across the street/100m seem to be quite of a difference.
gnufx · 2022-08-19
It's at least still used where it originated in proof systems, like Isabelle (as used, for example, in hardware verification work like https://www.lightbluetouchpaper.org/2022/07/22/formal-cheri/ for indirect industrial relevance).
melissalobos · 2022-01-29
Similar-ish concerns have been raised before: https://www.lightbluetouchpaper.org/2021/11/01/trojan-source-invisible…
theptip · 2020-12-14
> a paper voting system that is easier to verify and audit
Couldn't agree more.
It's interesting that voter fraud used to be a "left-wing conspiracy theory", given that Cheney had ties to Diebold (e.g. see https://www.peoplesworld.org/article/who-is-counting-your-vote-diebold…
And prior to this election cycle there was more concern from the Democrats around potential Russian interference with voting machines.
Perhaps now we'll have bipartisan support for what should be apolitical and uncontroversial election security initiatives that researchers have been advocating for years, e.g. https://www.lightbluetouchpaper.org/2020/11/26/three-paper-thursday-ve…
kitd · 2020-05-05
Further more, any contact tracing app that uses a technological solution is limited in its usefulness anyway. Viral transmission is not well modelled by radio packet transmission. Bruce Schneier has views on this [1], as do the Uni of Cambridge Digital Research team who consulted on the NHS app [2].
In fact, this is a benefit of the centralised matching model proposed by the NHS. The algorithm, eg number of packets received, time window in which they are received, can be tailored to improve the model.
But in any case, using Bluetooth to model virus transmission risks becoming a massive red herring.
[1] - https://www.schneier.com/blog/archives/2020/05/me_on_covad-19_.html
[2] - https://www.lightbluetouchpaper.org/2020/04/12/contact-tracing-in-the-…
rapjr9 · 2020-04-22
Here's another good explanation of what some of the issues are:
https://www.lightbluetouchpaper.org/2020/04/12/contact-tracing-in-the-…
The problem of trolling seems important to solve.
howard941 · 2019-04-03
Certainly it's possible that the many sources - there were more than a dozen if the reporters are to be believed - were lying. Wouldn't it be fairer to hold that the jury's still out? There's this https://www.theregister.co.uk/2018/10/04/supermicro_bloomberg/?page=3 documenting an attack ("...how the attack played out at Elemental...") . At that same page is a reasonable quote of advice from SANS' director. And another take here https://www.lightbluetouchpaper.org/2018/10/05/making-sense-of-the-sup…
sohkamyung · 2019-02-27
Write-up of the paper at [1]
[1] https://www.lightbluetouchpaper.org/2019/02/26/struck-by-a-thunderbolt…
sumedh · 2018-10-14
> There is no new information,
It links to the Cambridge university security team blog and they say Bloomberg's claim passes the sniff test.
https://www.lightbluetouchpaper.org/2018/10/05/making-sense-of-the-sup…
etiam · 2018-03-21
Standard operating procedure for Facebook.
Let violations go on unless and until seriously threatened by PR damage or legal action. Deny knowledge, claim "mistakes were made", claim "We're so sorry. We will make sure it can't happen again", repeat.
Data exfiltrations of roughly this kind has been going on at least since 2009. Handled according to the formula above.
I just posted links to two writeups from back then:
http://theharmonyguy.com/oldsite/2009/05/28/about-that-verification/
https://www.lightbluetouchpaper.org/2009/06/09/how-privacy-fails-the-f…
pjc50 · 2017-11-06
How about a chip and pin terminal playing Tetris? https://www.lightbluetouchpaper.org/2006/12/24/chip-pin-terminal-playi…
discreditable · 2017-09-07
"Now back when I worked in banking, if someone went to Barclays, pretended to be me, borrowed £10,000 and legged it, that was "impersonation", and it was the bank's money that had been stolen, not my identity. How did things change?" https://www.lightbluetouchpaper.org/2017/08/26/is-the-city-force-corru…
voltagex_ · 2017-01-06
Why run your own instance when you can just flog the crap out of the public pool for free? [1]
Digging into the internals of a few "high end" consumer modem/routers, I wouldn't trust any manufacturer to provide a secure ntpd, so we'd probably just end up with NTP amplification attacks [2] on a Mirai scale.
1: https://www.lightbluetouchpaper.org/2006/04/07/when-firmware-attacks-d…
2: https://blog.cloudflare.com/technical-details-behind-a-400gbps-ntp-amp…
PhantomGremlin · 2016-10-29
This is called an "externality" by economists
Yes, and it's been a problem for well over a decade. E.g. a while ago the clowns at D-Link decided to hammer NTP servers, then had the chutzpah to call it "extortion" when one operator attempted to get them to stop. https://www.lightbluetouchpaper.org/2006/04/07/when-firmware-attacks-d…
bri3d · 2015-10-19
Here's a good write-up of SDA (very vulnerable to the yes-card) and DDA (not vulnerable to the yes-card if authenticated online, but still vulnerable if authenticated offline due to a bad protocol):
https://www.lightbluetouchpaper.org/2009/08/25/defending-against-wedge…