151
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 900 posts.
152
Privacy Nightmare on Wheels’: Every Car Brand Reviewed by Mozilla
Mozilla’s latest edition of *Privacy Not Included reveals how 25 major car brands collect and share deeply personal data, including sexual activity, facial expressions, and genetic and health information.
153
Removing SMS support from Signal Android (soon)
For many years, the Signal app on Android has supported sending and receiving plaintext SMS and MMS messages in addition to Signal messages. SMS and MMS are standardized communication protocols that allow mobile devices to send and transmit messages, and most people picking up their phone to text...
154
iMessage with PQ3 Cryptographic Protocol
We are introducing PQ3, a groundbreaking cryptographic protocol for iMessage that advances the state of the art of end-to-end secure messaging. With compromise-resilient encryption and extensive defenses against even highly sophisticated quantum attacks, PQ3 provides protocol protections that surpass those in all…
155
AdFection: Targeted ads turned into a pipeline for zero-click mercenary spyware
This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. We call the technique AdFection, and show how it was used to infect devices at Al Jazeera with Candiru’s spyware. We also uncover Discover-Tech, and show how the company helps mercenary surveillance vendors track and…
156
Improving DNS Privacy with Oblivious DoH
Oblivious DoH (ODoH) makes secure DNS over HTTPS (DoH) queries into private queries which prevent the leakage of client IP addresses to resolvers. The new proposed ODoH standard addresses this problem and today we are enabling users to use this protocol with 1.1.1.1
157
The database servers powering Let's Encrypt
Let’s Encrypt helps to protect a huge portion of the Web by providing TLS certificates to more than 235 million websites. A database is at the heart of how Let’s Encrypt manages certificate issuance. If this database isn’t performing well enough, it can cause API errors and timeouts for our subscribers. Database…
158
If you’re not using SSH certificates you’re doing SSH wrong (2019)
SSH has some pretty gnarly issues when it comes to usability, operability, and security. The good news is this is all easy to fix. SSH is ubiquitous. It’s the de-facto solution for remote administration of *nix systems. SSH certificate authentication makes SSH easier to use, easier to operate, and more secure.
159
Moving from reCAPTCHA to hCaptcha
We recently migrated the CAPTCHA provider we use from Google's reCAPTCHA to a service provided by the independent hCaptcha. Here's a walk through of the rationale in more detail.
160
Hardening Firefox with Claude Mythos Preview
New details about what we found, and how agentic harnesses are now able to reproduce real bugs and dismiss false positives.
161
Deprecating Non-Secure HTTP
Today we are announcing our intent to phase out non-secure HTTP. There's pretty broad agreement that HTTPS is the way forward for the web. In recent months, there have been ...
162
The Linux Backdoor Attempt of 2003 (2013)
Josh wrote recently about a serious security bug that appeared in Debian Linux back in 2006, and whether it was really a backdoor inserted by the NSA. (He concluded that it probably was not.) Today I want to write about another incident, in 2003, in which someone tried to backdoor the Linux kernel. This one […]
163
Rust and C++ Interoperability in Chrome
Chrome engineers are experimenting with Rust. For the foreseeable future, C++ is the reigning monarch in our codebase, and any use of Rust will need to fit in with C++ — not the other way around. This seems to present some C++/ Rust interoperability challenges which nobody else has faced.
164
Privacy-Preserving Ad Click Attribution for the Web
A typical website is made of numerous components coming from a wide variety of sources.
165
Noyb aims to end “cookie banner terror” and issues more than 500 GDPR complaints
Today, noyb.eu sent over 500 draft complaints to companies who use unlawful cookie banners - making it the largest wave of complaints since the GDPR came into force.
166
Detecting and countering misuse of AI: September 2026
Case studies from threat actors disrupted between December 2025 and August 2026 across seven areas of harm, from cyber operations to biological misuse.
167
Saying goodbye to encrypted SMS/MMS
It’s 2015, and the end of the road for encrypted SMS/MMS in TextSecure. The TextSecure story started back in 2009, at the dawn of the smartphone era. Back then, TextSecure focused on securing the transport that everyone coming from feature phones was familiar with: SMS. Today, many things have c...
168
Privacy not included: Holiday gift list for privacy and security
Privacy Not Included was launched in 2017 to help you understand the privacy risks of tech products that connect to the internet. We are continuing that work in the form of Product Reviews at our magazine Nothing Personal, where our privacy experts do hours of hands-on testing and research on the most popular consumer…
169
The PGP problem (2019)
The PGP problem
170
Why Rust for safe systems programming
In this series , we have explored the need for proactive measures to eliminate a class of vulnerabilities and walked through some examples of memory safety issues we’ve found in Microsoft code that could have been avoided with a different language. Now we’ll peek at why we think that Rust represents the best…
171
New [July 2, 2021] Audacity Data Collection Policy
Audacity is the world's most popular audio editing and recording app. Edit, mix, and enhance your audio tracks with the power of Audacity. Download now!
172
Facebook and Genocide: How Facebook contributed to genocide in Myanmar and why it will not be held accountable - Harvard Law School
On July 22, 2013, Turkish scholar and social media expert Zeynep Tufekci tweeted “Last year, I pondered the first ‘social-media fueled ethnic cleansing.’ With ethnic tensions & expanding online hate speech, is it Burma?” 1
173
Is curl|bash insecure?
Take control of your web by running your own personal cloud server with Sandstorm.
174
Sophos News - The Sophos Blog
The Sophos Blog
175
Intel's Management Engine
Recent CPUs from Intel requires a binary called the “Management Engine” (Intel ME, or ME for short). This binary is one of three parts required if a business elects to use Intel’s Active Management Technology (AMT), which Purism avoids. Purism laptops can function with a neutralized and disabled ME, as we have tested…
176
Privacy in Ubuntu 12.10: Amazon Ads and Data Leaks
See part 2 of Privacy in Ubuntu 12.10: Full Disk Encryption. Earlier this month the eagerly awaited free software operating system Ubuntu 12.10 was released, and it includes a slew of new features (YouTube link), some of which have infuriated users because of privacy concerns. Over the last couple...
177
Today's CPU vulnerability: what you need to know
Posted by Matt Linton, Senior Security Engineer and Pat Parseghian, Technical Program Manager [Google Cloud, G Suite, and Chrome customers...
178
Sustaining Digital Certificate Security
Posted by Ryan Sleevi, Software Engineer This post updates our previous notification of a misissued certificate for google.com Followin...
179
Mitigating Spectre with Site Isolation in Chrome
Posted by Charlie Reis, Site Isolator Speculative execution side-channel attacks like Spectre are a newly discovered security risk for web...
180
Ethereum is a Dark Forest
It’s no secret that the Ethereum blockchain is a highly adversarial environment. If a smart contract can be exploited for profit, it eventually will be. But this unforgiving environment pales in comparison to the mempool. If the chain itself is a battleground, the mempool is something worse: a dark forest.