601
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 1,584 posts.
602
Apple is becoming an ad company despite privacy claims
Apple’s ad business is growing fast. It tracks you in its apps and uses that data to sell ads despite its privacy claims.
603
604
How to botch TLS forward secrecy
There's been some discussion about forward secret TLS recently, spurred, I think, by this piece from Declan McCullagh on CNET.
605
Google Wallet launches new age and identity verification features (ZK proofs)
Learn more about new Google Wallet updates, including new ways to use your digital ID for age and identity verification.
606
Understanding STIR/SHAKEN – New Anti-Robocalling Protocol
This whitepaper explains the basic technical details of STIR/SHAKEN call authentication and how it prevents caller ID spoofing.
607
608
About rel=noopener (2016)
2021 update: Browsers now implicitly set rel=noopener for any target=_blank link, following a spec change . If the demo on this page no longer seems scary, congratulations — you’re using a modern browser!
609
EFF on Apple's iPhone Developer Program Agreement
The entire family of devices built on the iPhone OS (iPhone, iPod Touch, iPad) have been designed to run only software that is approved by Apple—a major shift from the norms of the personal computer market. Software developers who want Apple's approval must first agree to the iPhone Developer...
610
The Sad State of Mobile XMPP in 2014
blog about networking, cameras, old gear, and xmpp
611
Launching in 2015: A Certificate Authority to Encrypt the Entire Web
Today EFF is pleased to announce Let’s Encrypt, a new certificate authority (CA) initiative that we have put together with Mozilla, Cisco, Akamai, IdenTrust, and researchers at the University of Michigan that aims to clear the remaining roadblocks to transition the Web from HTTP to HTTPS.Although...
612
Instagram's Million Dollar Bug
How participation in Facebook's bug bounty not only led to the complete compromise of Instagram, but also legal threats and intimidation
613
Everyone knows all the apps on your phone
Until a few years ago, any app you installed on an Android device could see all other apps on your phone without your permission.
614
Who’s behind the “reopen” domain surge?
The past few weeks have seen a large number of new domain registrations beginning with the word “reopen” and ending with U.S. city or state names. The largest number of them were created just hours after President Trump sent a series of all-caps tweets urging citizens to “liberate” themselves from new gun control…
615
Bitwarden raises $100M
A message from the Bitwarden CEO on accelerating value for Bitwarden users and customers.
616
617
Extracting the SuperFish certificate
I extracted the certificate from the SuperFish adware and cracked the password (" komodia ") that encrypted it. I discuss how down below. T...
618
619
Whistleblower: DOGE Siphoned NLRB Case Data
A security architect with the National Labor Relations Board (NLRB) alleges that employees from Elon Musk ‘s Department of Government Efficiency (DOGE) transferred gigabytes of sensitive data from agency case files in early March, using short-lived accounts configured to leave few traces of network activity. The NLRB…
620
RFC 35140: HTTP Do-Not-Stab (2023)
Date: March 7, 2111
621
Chrome 68 will mark all HTTP sites as “not secure”
Posted by Emily Schechter, Chrome Security Product Manager For the past several years, we’ve moved toward a more secure web by strongly adv...
622
Face ID and Touch ID for the Web
People often see passwords are the original sin of authentication on the web.
623
Unpacking Google’s Web Environment Integrity specification
Why Vivaldi browser thinks Google’s new proposal, the Web-Environment-Integrity spec, is a major threat to the open web and should be pushed back.
624
Project Svalbard: The Future of Have I Been Pwned
Back in 2013, I was beginning to get the sense that data breaches were becoming a big thing. The prevalence of them seemed to be really ramping up as was the impact they were having on those of us that found ourselves in them, myself included. Increasingly, I was writing
625
I used o3 to find a remote zeroday in the Linux SMB implementation
In this post I’ll show you how I found a zeroday vulnerability in the Linux kernel using OpenAI’s o3 model. I found the vulnerability with nothing more complicated than the o3 API ̵…
626
Dangers of CSV Injection
I’ve been doing the local usergroup circuit with this lately and have been asked to write it up.
627
The EARN IT Act Violates the US Constitution
Since senators introduced the EARN IT Act (S. 3398) in early March, EFF has called attention to the many ways in which the bill would be a disaster for Internet users’ free speech and security. We’ve explained how the EARN IT Act could be used to drastically undermine encryption. Although the bill...
628
Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta
We have added a feature to block fingerprinting and cryptomining in Firefox Nightly as an option for users to turn on.
629
Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit
Government operatives used NSO Group’s Pegasus spyware to hack 36 personal phones belonging to journalists, producers, anchors, and executives at Al Jazeera. The journalists were hacked by four Pegasus operators, including one operator MONARCHY that we attribute to Saudi Arabia, and one operator SNEAKY KESTREL that we…
630
The xz attack shell script
Andres Freund published the existence of the xz attack on 2024-03-29 to the public oss-security@openwall mailing list. The day before, he alerted Debian security and the (private) distros@openwall list. In his mail, he says that he dug into this after “observing a few odd symptoms around liblzma (part of the xz…