Cryptography on Locodigital

Adobe Breach 2013: 153 Million Passwords and a Crypto Blunder

Sat, 03 Oct 2026 09:00:00 -0300

On October 3, 2013, Adobe published a short statement: attackers had broken into its network, copied nearly 3 million customer card records and taken source code for products such as ColdFusion. The number looked manageable. Weeks later, a file with more than 150 million username/password pairs surfaced on a forum, and the case became a textbook example of how not to protect passwords. Thirteen years on, the same mistake is still being made.

Red telephone: 63 years of the hotline that was never a phone

Sun, 30 Aug 2026 08:00:00 -0300

On August 30, 1963 — exactly 63 years ago — the American operator in the Pentagon's transmission room typed the first message sent over the new direct channel with Moscow: "The quick brown fox jumped over the lazy dog's back 1234567890." It was a pangram used to test every key on the teletype. On the other end, the Soviets replied with a poetic description of a sunset — in Russian, of course. The most important communication channel of the Cold War was operational.

Heartbleed: the OpenSSL bug that exposed 17% of HTTPS servers

Sun, 26 Jul 2026 09:00:00 -0300

On April 7, 2014, the internet woke up to news that should have been impossible: the protocol protecting secure communication for half the web had a hole that had been open for two years. It wasn't a fresh zero-day. It was a bug introduced back in December 2011, present in silence in versions of OpenSSL running on servers at Yahoo!, Amazon, Dropbox and hundreds of thousands of other systems. Anyone with technical knowledge could have stolen private keys, passwords and session data — without leaving a trace in the logs. The name researchers chose for the bug said it all: Heartbleed.

YellowKey: the zero-day that bypasses BitLocker on Windows

Wed, 20 May 2026 10:00:00 -0300

Imagine leaving a work laptop locked in the car for ten minutes. It is encrypted with BitLocker — protected, right? CVE-2026-45585, nicknamed YellowKey, questions exactly that premise. Researcher Chaotic Eclipse published the PoC on 12 May and, eight days later, Microsoft issued emergency mitigations — still with no definitive patch. Right now, any affected Windows device in TPM-only mode is vulnerable to anyone with a few minutes of physical access.