Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 900 posts.
Ring isn't just a product that allows users to surveil their neighbors. The company also uses it to surveil its customers.An investigation by EFF of the Ring doorbell app for Android found it to be packed with third-party trackers sending out a plethora of customers’ personally identifiable...
On March 8, out of an abundance of caution, we logged all users out of GitHub.com. In this post we share technical details of the vulnerability and steps we're taking to ensure it doesn't happen again.
Learn more about how to use each Zoom product to connect with coworkers, customers, businesses, and more with insights and best practices.
Google is rolling out Federated Learning of Cohorts (FLoC) for the Chrome browser. TL;DR: FLoC places people in groups based on their browsing habits to target advertising. Why is this bad? As the …
Google has created a new tracking mechanism called FLoC, put it in Chrome, and automatically turned it on for millions of users. It's bad for privacy, which is why we're now blocking it in the DuckDuckGo extension.
When Let’s Encrypt first launched, we needed to ensure that our certificates were widely trusted. To that end, we arranged to have our intermediate certificates cross-signed by IdenTrust’s DST Root CA X3. This meant that all certificates issued by those intermediates would be trusted, even while our own ISRG Root X1…
This article is by our founders and sole shareholders, Daniel Berntsson and Fredrik Strömberg. Mullvad VPN is here to stay, and we are not interested in ever selling it.
CORRECTION: This post previously identified the sender of the 550 falsely identified URLs as Europol's EU Internet Referral Unit (EU IRU). The sender was in fact, the French national Internet Referral Unit, using Europol's application, which sends the email from an @europol.europa.eu address. The EU IRU has informed…
From media reports and individual findings that various people have presented to us, it seems that the new social media platform owned by the former president of the United States, Donald J. Trump, so-called Truth Social, is using Mastodon’s source code with various visual adjustments. The platform has not formally…
Update: March 11, 2026 If you use Certbot, see Six-Day and IP Address Certificates Available in Certbot for details on requesting these certificates. Short-lived and IP address certificates are now generally available from Let’s Encrypt. These certificates are valid for 160 hours, just over six days. In order to get a…
This page was migrated from the old website and has not been manually reviewed, or is here for historical purposes. We make no guarantees that the content is up-to-date or reflects SIPB's current views. Contact sipb-www@mit.edu if anything is broken or you have other questions or feedback.
Intel Newsroom delivers the latest news, announcements, and updates. Stay informed on Intel innovations.
I recently found a surprising leak vector in Windows 10 installations. We were porting our Beacon to Windows and for easy deployment…
Apple AirTags: Arbitrary data can be uploaded from non-internet-connected devices by sending Find My BLE broadcasts to nearby Apple devices. We're releasing an ESP32 firmware that turns the microcontroller into an (upload only) modem, and a macOS application to retrieve, decode and display the uploaded data.
With Site Isolation enabled on Firefox for Desktop, Mozilla takes its security guarantees to the next level.
ACLU documents how surveillance camera company Flock has lied to local officials about its operations
Explaining more about the information we get from other websites and apps; how we use the data they send to us; and the controls you have.
Vault is a platform for centralized secrets management, encryption as a service, and identity-based access.
GhostLock (CVE-2026-43499) is a Linux kernel vulnerability found by Nebu that exists in every major distribution since 2011. Triggering the bug does not require any special kernel config or privilege. By turning it into a 97% stable privilege escalation and container escape, Google has rewarded us $92,337 in…
You're reading the Keybase blog. There are more posts . When you're done, you can install Keybase .
At Open Whisper Systems, we want everyone to have access to advanced secure communication tools that are as easy and reliable to use as making a normal phone call or sending a normal text message. Over the past year, we’ve been working to bring the privacy software we’ve developed for Android to ...
We didn’t think hard enough about how our actions would affect the community, and we’re sorry for letting you down. How we got here Over the co
In this research paper James Kettle introduces multiple new classes of HTTP/2-exclusive attacks, demonstrated on popular websites and servers.
Over 400 vulnerabilities on Qualcomm’s Snapdragon chip threaten mobile phones’ usability worldwide With over 3 billion users globally, smartphones are an %
Posted by Dan Lorenc, Infrastructure Security Team Memory-safety vulnerabilities have dominated the security field for years and often lead ...
Our discovery of two privilege escalation vulnerabilities in a driver highlights the strength of Microsoft Defender ATP’s sensors. These sensors expose anomalous behavior and give SecOps personnel the intelligence and tools to investigate threats, as we did.
Learn how the new DDoS attack technique Rapid Reset works, and how to mitigate it
The largest European hacker club, "Chaos Computer Club" (CCC), has reverse engineered and analyzed a "lawful interception" malware program used by German police forces. It has been found in the...
