Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 1,584 posts.
I was recently asked whether it was safe to store session tokens using Web Storage (sessionStorage/localStorage) instead of cookies. Upon googling this I found the top results nearly all assert that w
It’s here! A couple of months ago, we announced that as part of our efforts with Ferrocene, we were creating the Ferrocene Language Specification – and now our first draft is online. The Ferrocene Language Specification (FLS) is an effort of Ferrocene
A core value CloudFlare is that security information should be shared between organizations to make the entire Internet safer. That is how CloudFlare's systems work: if one site is attacked, data about that attack is immediately shared with the rest of the network so other sites can be safe.
You might have heard that C2PA is a technology that will miraculously save us from rampant AI forgeries, by having cameras cryptographically sign the images they capture. Hooray for cryptography !
The Qubes OS project has been around for nearly 8 years now, since its original announcement back in April 2010 (and the actual origin date can be traced back to November 11th, 2009, when an initial email introducing this project was sent within ITL internally). Over these years Qubes h...
We’d like to provide a further update to our customers in regards to the SolarWinds breach. At this point we reiterate the message we posted yesterday – we have not played any role in this breach, nor are we aware of any vulnerabilities in TeamCity that may have led to this breach, as we are also not aware of any…
Microsoft and identity management platform Okta both this week disclosed breaches involving LAPSUS$ , a relatively new cybercrime group that specializes in stealing data from big companies and threatening to publish it unless a ransom demand is paid. Here’s a closer look at LAPSUS$, and some of the low-tech but…
By Martin Lee, Warren Mercer, Paul Rascagneres, and Craig Williams. Executive Summary A major ransomware attack has affected many organizations across the world reportedly including Telefonica in Spain, the National Health Service in the UK, and FedEx in the US. The malware responsible for this attack is a ransomware…
Digital ID is a new way for users to create an ID in Apple Wallet using their U.S. passport, and present it with the privacy of iPhone or Apple Watch.
Authenticate and authorize your users with Supabase Auth
For the last year, we've been working on the development of rust-minidump. The final part in this series takes you through fuzzing rust-minidump.
Posted by Matthew Maurer and Mike Yu, Android team To help keep Android users’ DNS queries private, Android supports encrypted DNS. I...
This is a quick recap of why I’m sad about SMTP encryption. It explains how TLS certificate verification in SMTP is useless even if you force it.
The Sophos Blog
Josh wrote recently about a serious security bug that appeared in Debian Linux back in 2006, and whether it was really a backdoor inserted by the NSA. (He concluded that it probably was not.) Today I want to write about another incident, in 2003, in which someone tried to backdoor the Linux kernel. This one […]
Privacy Badger was created to protect users from pervasive non-consensual tracking, and to do so automatically, without relying on human-edited lists of known trackers. While our goals remain the same, our approach is changing. It is time for Privacy Badger to evolve.Thanks to disclosures from...
Any website can use a simple API to replace CAPTCHAs with our invisible alternative, whether they’re on the Cloudflare network or not.
The patch that implements a prefix-based way to mitigate vulnerabilities in bash function exports has been out since last week and has been...
Last time I reviewed various security keys at a fairly superficial level: basic function, physical characteristics etc. This post considers lower-level behaviour.
Co-authored by Rainey Reitman and Marcia Hofmann The First Amendment to the Constitution guarantees freedom of expression against government encroachment — but that doesn't help if the censorship doesn't come from the government. The controversial whistle-blower website WikiLeaks, which has begun...
Anonymity in the real world is very hard In late 2011 Hezbollah rolled up a CIA spy ring in Lebanon. This provides an interesting lesson in CIA …
