Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 59 posts.
Privacy Not Included was launched in 2017 to help you understand the privacy risks of tech products that connect to the internet. We are continuing that work in the form of Product Reviews at our magazine Nothing Personal, where our privacy experts do hours of hands-on testing and research on the most popular consumer…
There's been a lot of concern recently about the Web Environment Integrity proposal, developed by a selection of authors from Google, and apparently being...
Citizen Lab found an actively exploited zero-click vulnerability being used to deliver NSO Group’s Pegasus mercenary spyware while checking the device of an individual employed by a Washington DC-based civil society organization with international offices. We refer to the exploit chain as BLASTPASS. The exploit chain…
Mozilla’s latest edition of *Privacy Not Included reveals how 25 major car brands collect and share deeply personal data, including sexual activity, facial expressions, and genetic and health information.
On April 18 at least six police officers from the National Operations Department (NOA) of the Swedish Police visited the Mullvad VPN office in Gothenburg with a search warrant. They intended to seize computers with customer data.
Initial Disclosure: After extensive research, we have taken a short position in shares of Block, Inc. (NYSE: SQ). This report represents our opinion, and we encourage every reader to do their own due diligence. Please see our full disclaimer at the bottom of the report.
The Signal Protocol is a set of cryptographic specifications that provides end-to-end encryption for private communications exchanged daily by billions of people around the world. After its publication in 2013, the Signal Protocol was adopted not only by Signal but well beyond. Technical informat...
The Data Protection Authority of Lower Saxony (LfD) decided that the “Pay or Okay” solution used by heise.de was unlawful
Deeper analysis of Storm-0558 techniques for obtaining unauthorized access to email data, tools, and unique infrastructure characteristics.
Today we announce that we no longer support port forwarding. New port forwards will no longer be supported, and existing ports will be removed 2023-07-01.
Our investigation of the security incident disclosed by Microsoft and CISA and attributed to Chinese threat actor Storm-0558, found that this incident seems to have a broader scope than originally assumed. Organizations using Microsoft and Azure services should take steps to assess potential impact.
This article was written on the basis of information related to the so-called "8 December" case (see the footnotes for a global overview of the case, we focus on the "numerical part" of it in this article<fn>For a summary of the 8 December affair see in particular the testimonies available in thi
At approximately 05:00 UTC on March 24, out of an abundance of caution, we replaced our RSA SSH host key used to secure Git operations for GitHub.com.
Recent iPhone models have additional hardware-based security protection for sensitive regions of the kernel memory. We discovered that to bypass this hardware-based security protection, the attackers used another hardware feature of Apple-designed SoCs.
Christiaan Brand, Group Product Manager We are excited to announce an update to Google Authenticator , across both iOS and Android, which a...
Microsoft Security Response Center Blog
Tamás Koczka, Security Engineer In 2020 , we integrated kCTF into Google's Vulnerability Rewards Program (VRP) to support researchers evalu...
Why Vivaldi browser thinks Google’s new proposal, the Web-Environment-Integrity spec, is a major threat to the open web and should be pushed back.
Starting later this year, we are updating our inactivity policy for Google Accounts to 2 years across our products.
While monitoring the traffic of our own corporate Wi-Fi network, we noticed suspicious activity that originated from several iOS-based phones. Since it is impossible to inspect modern iOS devices from the inside, we created offline backups of the devices, inspected them and discovered traces of compromise.
On Wednesday, October 18, 2023, we discovered attacks on our system that we were able to trace back to Okta. We have verified that no Cloudflare customer information or systems were impacted by this event because of our rapid response.
This post dives into the details of the HTTP/2 protocol, the feature that attackers exploited to generate the massive Rapid Reset attacks
The problem with enforcing TPMs on consumers
Today, we’re announcing new requirements for bulk senders that will help keep Gmail safer and more spam-free.
With customers ask whether they can use Microsoft’s Copilot services without worrying about copyright claims, we are providing a straightforward answer: yes, you can, and if you are challenged on copyright grounds, we will assume responsibility for the potential legal risks involved.
Early last week, Google released a new stable update for Chrome. The update included a single security fix that was reported by Apple's Security Engineering and Architecture (SEAR) team. The issue, CVE-2023-4863, was a heap buffer overflow in the WebP image library, and it had a familiar
How Wiz Research found a common misconfiguration in Azure Active Directory that compromised multiple Microsoft applications, including a Bing management portal
Today, we are officially introducing a proof-of-work (PoW) defense for onion services designed to prioritize verified network traffic as a deterrent against denial of service (DoS) attacks with the release of Tor 0.4.8.
Read CircleCI’s security alerts from January 2023. Last updated 1/13/2023.
