121
Web Request and Declarative Net Request: Explaining the impact on Extensions
The Story So Far As part of an effort to increase user security and privacy, Chrome is planning a number of changes to the extensions pla...
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 900 posts.
122
About Emergency Access
The emergency access feature of the Bitwarden password manager enables you to designate trusted emergency contacts to access your vault in an emergency.
123
Warrant Canary Frequently Asked Questions
What is a warrant canary? A warrant canary is a colloquial term for a regularly published statement that a service provider has not received legal process that it would be prohibited from saying it had received. Once a service provider does receive legal process, the speech prohibition goes into...
124
Qwest CEO: NSA Punished Qwest for Refusing to Participate in Illegal Surveillance--Pre-9/11!
When Qwest refused the NSA’s illegal request that it hand over its customers’ data without a warrant, the NSA wasn’t happy. According to former Qwest CEO Joseph Nacchio, the government hit back for the telecom’s refusal by denying them lucrative contracts (log-in required) worth hundreds of...
125
Forensic Methodology Report: How to catch NSO Group’s Pegasus
NSO Group claims that its Pegasus spyware is only used to “investigate terrorism and crime” and “leaves no traces whatsoever”. This Forensic Methodology Report shows that neither of these statements are true. This report accompanies the release of the Pegasus Project, a collaborative investigation that involves more…
126
Smashing the Stack for Fun and Profit by Aleph One
An excellent (if a bit dated) article/tutorial on exploiting buffer overflow vulnerabilities. It was written by Aleph One for Phrack 49.
127
EFF's New Wordlists for Random Passphrases
Joe Bonneau dives deep into systems using dice to generate random passphrases and introduces EFF's three new wordlists.
128
Announcing the first SHA-1 collision
Posted by Marc Stevens (CWI Amsterdam), Elie Bursztein (Google), Pierre Karpman (CWI Amsterdam), Ange Albertini (Google), Yarik Markov (Goog...
129
Security advisory: Critical remote code execution vulnerabilities, update now
PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.
130
NSO group iPhone zero-click, zero-day exploit captured in the wild
Citizen Lab found an actively exploited zero-click vulnerability being used to deliver NSO Group’s Pegasus mercenary spyware while checking the device of an individual employed by a Washington DC-based civil society organization with international offices. We refer to the exploit chain as BLASTPASS. The exploit chain…
131
LastPass autofill exploit
Mathias Karlsson decided to check out the security of the LastPass browser extensions. Here's what he found.
132
Chrome users beware: Manifest v3 is deceitful and threatening
Like FLoC and Privacy Sandbox before it, Google Chrome’s Manifest V3 is another example of the inherent conflict of interest that comes from Google controlling both the dominant web browser and one of the largest internet advertising networks.
133
Hardening Firefox with Anthropic's Red Team
Claude Opus 4.6 found 22 Firefox vulnerabilities in two weeks, 14 rated high-severity, with proofs-of-concept and candidate patches for Mozilla.
134
135
Apple can comply with the FBI court order
Earlier today, a federal judge ordered Apple to comply with the FBI’s request for technical assistance in the recovery of the San Bernadino gunmen’s iPhone 5C. Since then, many have argued whether these requests from the FBI are technically feasible given the support for strong encryption on iOS devices. Based on my…
136
Sharing details on a recent incident impacting one of our customers
Google Cloud shares details of an incident impacting one Australian customer's use of Google Cloud VMware Engine. Learn what happened and how we're preventing it from happening again.
137
Distrusting New WoSign and StartCom Certificates
Mozilla has discovered that a Certificate Authority (CA) called WoSign has had a number of technical and management failures. Most seriously, we discovered they were backdating SSL certificates in order ...
138
Negative Result: Reading Kernel Memory from User Mode
I were going to write an introduction about how important negative results can be. I didn’t. I assume you can figure out for yourself why that is and if not you got all the more reason to read this blog post. If you think it’s trivial why my result is negative, you definitely need to read the blog post.
139
Why Constant-Time Crypto?
In 1996, Paul Kocher published a novel attack on RSA, specifically on RSA implementations , that extracted information on the private key by simply measuring the time taken by the private key operation on various inputs. It took a few years for people to accept the idea that such attacks were practical and could be…
140
Chrome phasing out Manifest v2 support from Jan 2022
Details of the Manifest V2 phase-out and end of life.
141
Cloudflare supports Privacy Pass
Cloudflare supports Privacy Pass, a recently-announced privacy-preserving protocol developed in collaboration with researchers from Royal Holloway and the University of Waterloo.
142
How To Create an SSH CA to Validate Hosts and Clients with Ubuntu
When dealing with an extensive infrastructure and many team members, managing SSH keys for authentication can become unwieldy. However, SSH can utilize cert…
143
Multi-Perspective Validation Improves Domain Validation Security
At Let’s Encrypt we’re always looking for ways to improve the security and integrity of the Web PKI. We’re proud to launch multi-perspective domain validation today because we believe it’s an important step forward for the domain validation process. To our knowledge we are the first CA to deploy multi-perspective…
144
How Do Lava Lamps Help with Internet Encryption?
The Cloudflare lava lamps are used for Internet encryption. Learn about entropy in cryptography and why randomness is essential for SSL encryption.
145
146
Firefox 85 cracks down on supercookies
Trackers and adtech companies have long abused browser features to follow people around the web. Since 2018, we have been dedicated to reducing the number of ways our users can ...
147
We Chat, They Watch
WeChat communications conducted entirely among non-China-registered accounts are subject to pervasive content surveillance that was previously thought to be exclusively reserved for China-registered accounts.
148
Android developer verification: Early access starts
News and insights on the Android platform, developer tools, and events.
149
Grand jury subpoena for Signal user data, Central District of California
Signal still knows nothing about you, but inexplicably the government continues to ask.
150
