301
Cname cloaking, a disguise of third-party trackers
An in-depth exploration of a new method used by tracking companies to disguise their third-party trackers as first-party trackers.
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 900 posts.
302
Investigating three real-world incidents in our cybersecurity evaluations
We found three cases where a Claude model reached the internet from an evaluation environment and accessed real systems. We share what happened and what we're changing.
303
Fine-grained personal access tokens for GitHub
Fine-grained personal access tokens offer enhanced security to developers and organization owners, to reduce the risk to your data of compromised tokens.
304
Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance
Today, we open sourced our Zero-Knowledge Proof (ZKP) libraries, fulfilling a promise and building on our partnership with Sparkasse to support EU age assurance.
305
Technical Details Behind a 400Gbps NTP Amplification DDoS Attack
On Monday we mitigated a large DDoS that targeted one of our customers. The attack peaked just shy of 400Gbps. We've seen a handful of other attacks at this scale, but this is the largest attack we've seen that uses NTP amplification.
306
Improving DNS Privacy in Firefox
Domain Name Service (DNS) is one of the oldest parts of internet architecture, and remains one that has largely been untouched by efforts to make the web safer and more ...
307
The State of SSL Stacks
The SSL landscape has shifted dramatically. In this paper, we examine OpenSSL 3.x, BoringSSL, LibreSSL, WolfSSL, and AWS-LC with HAProxy.
308
Django Security Release - 1.5.4
Posted by James Bennett on Sept. 15, 2013
309
AI models may be capable of self-replicating without access to a datacenter
Small AI models may be only months away from being able to self-replicate across cheap IoT devices like Android TV boxes, with no datacenter needed.
310
Containers and Docker: how secure are they?
Docker is a founding member of the Blueprint Alliance, a 12-company reference architecture for securing AI agents, built around four governance questions.
311
Ending CAPTCHAs: Introducing Cryptographic Attestation of Personhood
We want to remove CAPTCHAs completely. The idea is rather simple: a real human should be able to touch or look at their device to prove they are human, without revealing their identity. Let's explore!
312
TRESOR Runs Encryption Securely Outside RAM
TRESOR is a secure implementation of AES which is resistant against cold boot attacks. The basic idea behind this implementation is to store the secret key inside CPU registers rather than in RAM.
313
Reproducible Signal builds for Android
As of our latest Android release, Signal builds are reproducible. Reproducible builds help to verify that the source code in our GitHub repository is the exact source code used to build the compiled Signal APK being distributed through Google Play.
314
NPM debug and chalk packages compromised
The popular packages debug and chalk on npm have been compromised with malicious code
315
We updated our RSA SSH host key
At approximately 05:00 UTC on March 24, out of an abundance of caution, we replaced our RSA SSH host key used to secure Git operations for GitHub.com.
316
Signal Secure Backups
In the past, if you broke or lost your phone, your Signal message history was gone. This has been a challenge for people whose most important conversations happen on Signal. Think family photos, sweet messages, important documents, or anything else you don’t want to lose forever. This explains wh...
317
NSO Group iMessage Zero-Click Exploit Captured in the Wild
While analyzing the phone of a Saudi activist infected with NSO Group’s Pegasus spyware, we discovered a zero-day zero-click exploit against iMessage. The exploit, which we call FORCEDENTRY, targets Apple’s image rendering library, and was effective against Apple iOS, MacOS and WatchOS devices.
318
An even worse anti-encryption bill than EARN IT
Stanford Center for Internet and Society2020903 points351 commentscited by 7Society, Policy & Culture details
On Tuesday, June 23, Senators Graham (R-SC), Cotton (R-AR), and Blackburn (R-TN) introduced a bill that is a full-frontal nuclear assault on encryption in the United States. You can find the bill text here. It's been formally introduced as Senate bill 4051, which you can
319
Firefox rolls out Total Cookie Protection by default to all users
Updated Aug. 28, 2024. Take back your privacy Firefox is rolling out Total Cookie Protection by default to more Firefox users worldwide, making Firefox the
320
Multiple Russia-aligned threat actors actively targeting Signal Messenger
Russia state-aligned threat actors target Signal Messenger accounts used by individuals of interest to Russia's intelligence services.
321
Today's PHP security release, and how we're strengthening security
Describing the story behind how critical security vulnerabilities were found and fixed.
322
With SESTA/FOSTA, lawmakers failed to separate good intentions from bad law
In Passing SESTA/FOSTA, Lawmakers Failed to Separate Their Good Intentions from Bad LawToday was a dark day for the Internet.The U.S. Senate just voted 97-2 to pass the Allow States and Victims to Fight Online Sex Trafficking Act (FOSTA, H.R. 1865), a bill that silences online speech by forcing...
323
Contextual Identities on the Web
The Containers Feature in Firefox Nightly enables users to login to multiple accounts on the same site simultaneously and gives users the ability to segregate site data for improved privacy and security. We all portray different characteristics of ourselves in different situations. The way I speak with my son is much…
324
Critical Update on DAO Vulnerability
<span style="font-weight: 400;">An attack has been found and exploited in <a href="https://etherscan.io/address/0xbb9bc244d798123fde783fcc1c72d3bb8c189413">the...
325
Operation Triangulation: What you get when attack iPhones of researchers
Recent iPhone models have additional hardware-based security protection for sensitive regions of the kernel memory. We discovered that to bypass this hardware-based security protection, the attackers used another hardware feature of Apple-designed SoCs.
326
327
Google Authenticator now supports Google Account synchronization
Christiaan Brand, Group Product Manager We are excited to announce an update to Google Authenticator , across both iOS and Android, which a...
328
Yahoo's Fight for its Users Earns the Company Special Recognition by EFF
Each year, EFF’s Who Has Your Back campaign assesses the policies and practices of major Internet companies as a way to encourage and incentivize those companies to take a stand for their users in the face of government demands for data. Normally, when a company demonstrates it has a policy or...
329
Results of technical investigations for Storm-0558 key acquisition
Microsoft Security Response Center Blog
330
How Go mitigates supply chain attacks
Go tooling and design help mitigate supply chain attacks at various stages.