391
Changes to Trusted Certificate Authorities in Android Nougat
News and insights on the Android platform, developer tools, and events.
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 1,584 posts.
392
NIST is No Longer Recommending Two-Factor Authentication Using SMS
NIST is no longer recommending two-factor authentication systems that use SMS, because of their many insecurities. In the latest draft of its Digital Authentication Guideline, there’s the line: [Out of band verification] using SMS is deprecated, and will no longer be allowed in future releases of this guidance.
393
SSL added and removed here ;-)
This post is part of our ongoing series about networks, privacy, governments and (of course) online security tools like Cloak. Last week, the Washington Post unleashed yet another bombshell revelation from the Snowden documents.
394
Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers
Team82 researched the attack surface of the Danfoss AK-SM 800A refrigeration controller platform and identified multiple vulnerabilities affecting the embedded web management interface. Team82 disclosed the vulnerabilities to Danfoss, which addressed them in a new firmware version. Successful exploits of the…
395
SHA-1 Broken
SHA-1 has been broken. Not a reduced-round version. Not a simplified version. The real thing. The research team of Xiaoyun Wang, Yiqun Lisa Yin, and Hongbo Yu (mostly from Shandong University in China) have been quietly circulating a paper describing their results: collisions in the the full SHA-1 in 2**69 hash…
396
iCloud Private Relay: What Cloudflare Customers Need to Know
iCloud Private Relay is an Apple service for browsing more privately and securely. Learn how to ensure the best user experience using iCloud Private Relay.
397
Yubico proposes WebAuthn protocol extension to simplify backup security keys
Yubico proposes a new WebAuthn extension to the World Wide Web Consortium (W3C) to add a user-friendly solution for backup security keys, and receives cryptographic proof from researchers at the Surrey Center for Cyber Security.
398
A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution
Posted by Ian Beer & Samuel Groß of Google Project Zero We want to thank Citizen Lab ...
399
Security of Passkeys in the Google Password Manager
Posted by Arnar Birgisson, Software Engineer We are excited to announce passkey support on Android and Chrome for developers to test today, ...
400
Mitigating Spectre and Other Security Threats: The Cloudflare Workers Security Model
Cloudflare is a security company, and the heart of Workers is, in my view, a security project. Running code written by third parties is always a scary proposition, and the primary concern of the Workers team is to make that safe.
401
Flock Safety and Texas Sheriff Claimed License Plate Search Was for a Missing Person. It Was an Abortion Investigation.
New documents and court records obtained by EFF show that Texas deputies queried Flock Safety's surveillance data in an abortion investigation, contradicting the narrative promoted by the company and the Johnson County Sheriff that she was “being searched for as a missing person,” and that “it was about her safety.”…
402
Apple Says iPhone Jailbreaking is Illegal
Jailbreaking an iPhone constitutes copyright infringement and a DMCA violation, says Apple in comments filed with the Copyright Office as part of the 2009 DMCA triennial rulemaking. This marks the first formal public statement by Apple about its legal stance on iPhone jailbreaking.Apple's iPhone,...
403
GnuPG - What’s new in 2.1
A possibly revised version of this article can be found at: https://gnupg.org/faq/whats-new-in-2.1.html
404
Making messaging interoperability with third parties safe for users in Europe
To comply with a new EU law, the Digital Markets Act (DMA), which comes into force on March 7th, we’ve made major changes to WhatsApp and Messenger to enable interoperability with third-party messa…
405
On Covering Webcams
The problem isn’t your camera, it’s malware. Don’t install any software from unknown or sketchy sources, keep your OS up to date, and you should be fine. And if you do have malware on your Mac, the webcam is likely the least of your problems.
406
407
Analysis of Storm-0558 techniques for unauthorized email access
Deeper analysis of Storm-0558 techniques for obtaining unauthorized access to email data, tools, and unique infrastructure characteristics.
408
5 Problems with National ID Cards
The terrorist attacks of September 11have revived proposals for a national identity card system as a way to verify the identity of airline passengers and prevent terrorists from entering the country. For example, the Chairman and CEO of Oracle Corp., Larry Ellison, recently called for the creation of a national ID…
409
How the new Gmail image proxy works and what this means for you
Google recently announced that images in emails will be displayed automatically by default to Gmail users, thanks to an anonymizing proxy operated by them.
410
When you browse Instagram and find Tony Abbott's passport number
Do not get arrested challenge 2020
411
Whistleblower: Ubiquiti Breach “Catastrophic”
Last year, I posted a series of articles about a purported “breach” at Ubiquiti. My sole source for that reporting was the person who has since been indicted by federal prosecutors for his alleged wrongdoing – which includes providing false information to the press.
412
I tried creating a web browser, and Google blocked me
After 4 months of waiting, that is the response I got from Widevine, Google’s DRM for web browsers, regarding a license agreement. For the last 2 years I’ve been working on a web browser that now cannot be completed because Google, the creators of the open source browser Chrome, won’t allow DRM in an open source…
413
Apple previews Lockdown Mode
Apple today detailed two initiatives to help protect users who may be personally targeted by sophisticated digital threats.
414
Small models also found the vulnerabilities that Mythos found
When AISLE tested Mythos's showcase vulnerabilities on small, cheap, open-weights models, most found the same bugs. Here's what that means for cyber.
415
Timeline of the xz open source attack
Over a period of over two years, an attacker using the name “Jia Tan” worked as a diligent, effective contributor to the xz compression library, eventually being granted commit access and maintainership. Using that access, they installed a very subtle, carefully hidden backdoor into liblzma, a part of xz that also…
416
417
How I attacked myself using Google and I ramped up a $1000 bandwidth bill
It all started with an email. From: Amazon Web Services LLC Subject: Review of your AWS Account Estimated Month to Date Billing Charges...
418
An iOS zero-click radio proximity exploit odyssey
Posted by Ian Beer, Project ZeroNOTE: This specific issue was fixed before the launch of Privacy-...
419
CAN Injection: Keyless car theft
This is a detective story about how a car was stolen - and how it uncovered an epidemic of high-tech car theft. It begins with a tweet. In April 2022, my friend Ian Tabor tweeted that vandals had been at his car, pulling apart the headlight and unplugging the cables.
420
