511
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 1,584 posts.
512
Investigating three real-world incidents in our cybersecurity evaluations
We found three cases where a Claude model reached the internet from an evaluation environment and accessed real systems. We share what happened and what we're changing.
513
Fine-grained personal access tokens for GitHub
Fine-grained personal access tokens offer enhanced security to developers and organization owners, to reduce the risk to your data of compromised tokens.
514
Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance
Today, we open sourced our Zero-Knowledge Proof (ZKP) libraries, fulfilling a promise and building on our partnership with Sparkasse to support EU age assurance.
515
State Considered Harmful – A Proposal for a Stateless Laptop
Two months ago I have published a detailed survey of varioussecurity-related problems plaguing the Intel x86 platforms. While the picturepainted in the paper...
516
Technical Details Behind a 400Gbps NTP Amplification DDoS Attack
On Monday we mitigated a large DDoS that targeted one of our customers. The attack peaked just shy of 400Gbps. We've seen a handful of other attacks at this scale, but this is the largest attack we've seen that uses NTP amplification.
517
Using the HTML5 Fullscreen API for Phishing Attacks
Feross Aboukhadijeh is a computer security researcher, teacher, web developer, designer, long distance runner, gamer, music lover, and builder of websites that (sometimes) go viral.
518
Pledge() and unveil() in SerenityOS (2020)
This post describes the implementation and use of pledge() and unveil() in SerenityOS.
519
Zerocoin: making Bitcoin anonymous
Wow, what the heck is going on with Bitcoin? When I started this post, the value of a single bitcoin had surged upwards of $250. It’s corrected a bit since then (down $100 or so), but it̵…
520
No Copyright Intended
On October 26, a YouTube user named crimewriter95 posted a full-length version of Pulp Fiction, rearranged in chronological order. A couple things struck me about this video. First, I’m surprised that a full-length, 2.5-hour very slight remix of a popular film can survive on YouTube for over six weeks without getting…
521
The RubyGems "Security Incident"
Ruby Central posted an extremely concerning “Incident Response Timeline” today, in which they make a number of exaggerated or purely misleading claims. Here’s my effort to set the record straight. First, and most importantly: I was a primary operator of RubyGems.org, securely and successfully, for over ten years. Ruby…
522
Improving DNS Privacy in Firefox
Domain Name Service (DNS) is one of the oldest parts of internet architecture, and remains one that has largely been untouched by efforts to make the web safer and more ...
523
Extended Validation Certificates Are Really Dead
Almost one year ago now, I declared extended validation certificates dead [https://www.troyhunt.com/extended-validation-certificates-are-dead/]. The entity name had just been removed from Safari on iOS, it was about to be removed from Safari on Mojave and there were indications that Chrome would remove it
524
525
On the Perceived Value of EV Certs, Commercial CAs, Phishing and Let's Encrypt
Last week I wrote about how Life Is About to Get a Whole Lot Harder for Websites Without HTTPS [https://www.troyhunt.com/life-is-about-to-get-harder-for-websites-without-https/]. Somewhere in the comments there, the discussion went off on a tangent about commercial CAs, the threat
526
The State of SSL Stacks
The SSL landscape has shifted dramatically. In this paper, we examine OpenSSL 3.x, BoringSSL, LibreSSL, WolfSSL, and AWS-LC with HAProxy.
527
Django Security Release - 1.5.4
Posted by James Bennett on Sept. 15, 2013
528
AI models may be capable of self-replicating without access to a datacenter
Small AI models may be only months away from being able to self-replicate across cheap IoT devices like Android TV boxes, with no datacenter needed.
529
Containers and Docker: how secure are they?
Docker is a founding member of the Blueprint Alliance, a 12-company reference architecture for securing AI agents, built around four governance questions.
530
Ending CAPTCHAs: Introducing Cryptographic Attestation of Personhood
We want to remove CAPTCHAs completely. The idea is rather simple: a real human should be able to touch or look at their device to prove they are human, without revealing their identity. Let's explore!
531
TRESOR Runs Encryption Securely Outside RAM
TRESOR is a secure implementation of AES which is resistant against cold boot attacks. The basic idea behind this implementation is to store the secret key inside CPU registers rather than in RAM.
532
Reproducible Signal builds for Android
As of our latest Android release, Signal builds are reproducible. Reproducible builds help to verify that the source code in our GitHub repository is the exact source code used to build the compiled Signal APK being distributed through Google Play.
533
How Dropbox sacrifices user privacy for cost savings
Note: This flaw is different than the authentication flaw in Dropbox that Derek Newton recently published . Summary Dropbox , the popular cl...
534
535
Encrypt-then-MAC
First things first: Why use a composition of encryption and MAC instead of a single primitive which achieves both? Because people are very good at writing bad code. In my experience on the FreeBSD security team, writing dozens of security advisories, there are three types of code which are especially prone to have…
536
NPM debug and chalk packages compromised
The popular packages debug and chalk on npm have been compromised with malicious code
537
Why Is This Website Port Scanning Me?
Investigation of the practice of port scanning site visitors for fingerprinting and tracking.
538
We updated our RSA SSH host key
At approximately 05:00 UTC on March 24, out of an abundance of caution, we replaced our RSA SSH host key used to secure Git operations for GitHub.com.
539
Facebook Stored Hundreds of Millions of User Passwords in Plain Text for Years
Hundreds of millions of Facebook users had their account passwords stored in plain text and searchable by thousands of Facebook employees — in some cases going back to 2012, KrebsOnSecurity has learned. Facebook says an ongoing investigation has so far found no indication that employees have abused access to this data.
540
Zero-day in Sign in with Apple
What if I say, your Email ID is all I need to takeover your account on your favorite website or an app. Sounds scary, right? This is what a…