91
Security Guidelines for Congressional Campaigns
Thank you for attending a training session! We covered a lot of ground, so these notes are meant to serve as a reference and reminder of the advice we gave you.
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 124 posts.
92
93
There is no WhatsApp 'backdoor'
Today, The Guardian published a story falsely claiming that WhatsApp’s end-to-end encryption contains a “backdoor.”
94
The New York Times Is Now Available as a Tor Onion Service
Updated: March 4, 2025
95
Password Rules Are Bullshit
Of the many, many, many bad things about passwords, you know what the worst is? Password rules. Let this pledge be duly noted on the permanent record of the Internet. I don’t know if there’s an afterlife, but I’ll be finding out soon enough, and I plan
96
Defending a website with Zip bombs
Personal Blog of Christian Haschek
97
Face ID, Touch ID, No ID, PINs and Pragmatic Security
I was wondering recently after poring through yet another data breach how many people actually use multi-step verification. I mean here we have a construct where even if the attacker has the victim's credentials, they're rendered useless once challenged for the authenticator code or SMS which is
98
There are over a billion outdated Android devices in use
It's common knowledge that Android device tend to be more out of date than iOS devices, but what does this actually mean? Let’s look at android marketshare data to see how old devices in the wild are. The x axis of the plot below is date, and the y axis is Android marketshare. The share of all devices sums to 100%…
99
A Case of Stolen Source Code
Last week, for about three days, the macOS video transcoding app HandBrake was compromised . One of the two download servers for HandBrake was serving up a special malware-infested version of the app, that, when launched, would essentially give hackers remote control of your computer.
100
iOS 11 Horror Story: The Rise and Fall of iOS Security
We loved what Apple used to do about security. During the past years, the company managed to build a complete, multi-layer system to secure its hardware and sof
101
Why ProtonMail is more secure than Gmail
Proton Mail is a private email service takes a radically different approach to security. Find out how Proton Mail security compares to Gmail security.
102
Standalone Signal Desktop
Signal Desktop is now available in a new, standalone form, and the Chrome App has been deprecated.
103
Tor at the Heart: Firefox
During the month of December, we're highlighting other organizations and projects that rely on...
104
An analysis of the Nomx secure communications device
With slick marketing, catchy taglines and some pretty bold claims about their security, nomx claim to have cracked email security. Let's see if they have.
105
Exploiting the Wi-Fi Stack on Apple Devices
Posted by Gal Beniamini, Project ZeroIn this blog post we’ll complete our goal of achieving...
106
Quantifying the Impact of “Cloudbleed”
Last Thursday we released details on a bug in Cloudflare's parser impacting our customers. It was an extremely serious bug that caused data flowing through Cloudflare's network to be leaked onto the Internet.
107
The MongoDB hack and the importance of secure defaults
There’s a widespread attack on insecure MongoDB installs that has resulted in over 28,000 databases being held ransom. This post explains the hack, how to protect yourself and what can we learn from it.
108
Container Isolation Gone Wrong
A detailed troubleshooting story that covers both simple and complex tales of container isolation. Read this terrific guide for insight from A-Z.
109
110
Maybe Skip SHA-3
In 2005 and 2006, a series of significant results were published against SHA-1 [ 1 ][ 2 ][ 3 ]. These repeated break-throughs caused something of a crisis of faith as cryptographers questioned whether we knew how to build hash functions at all. After all, many hash functions from the 1990's had not aged well [ 1 ][ 2…
111
We will no longer use the phrase “zero knowledge” to describe our software
Space Cybersecurity has become a prominent topic in the news, particularly when it comes to protecting space-related assets and technologies.
112
Tor's Fall Harvest: The Next Generation of Onion Services
We are hyped to present the next generation of onion services! We've been working on this project non-stop for the past 4 years and we officially launched it two weeks ago by publishing our first alpha releases. All in all, the new system is a well needed improvement that fixes many shortcomings of the old design, and…
113
Dutch Data Protection Authority: Microsoft breaches law with Windows 10
Met deze test controleren we of u een mens bent. Hiermee voorkomen we ongeoorloofd gebruik van deze dienst.
114
How Etsy Manages HTTPS and SSL Certificates for Custom Domains on Pattern
In April of 2016 Etsy launched Pattern, a new product that gives Etsy sellers the ability to create their own hosted e-commerce...
115
The strange story of “Extended Random”
Yesterday, David Benjamin posted a pretty esoteric note on the IETF’s TLS mailing list. At a superficial level, the post describes some seizure-inducingly boring flaws in older Canon printers…
116
Disqus Security Alert: User Info Breach
More publishers trust us to engage, grow, and understand their audiences than any other. Build your on-site community with Disqus.
117
Security Through Transparency
Posted by Ryan Hurst and Gary Belvin, Security and Privacy Engineering Encryption is a foundational technology for the web. We’ve spent a l...
118
MIT Media Lab's concerns about the cryptocurrency IOTA
On Friday, MIT Technology Review published an article on the cryptocurrency IOTA. However, we at the Media Lab have issues with the story
119
The Ethics of Running a Data Breach Search Service
No matter how much anyone tries to sugar coat it, a service like Have I been pwned [https://haveibeenpwned.com/] (HIBP) which deals with billions of records hacked out of other peoples' systems is always going to sit in a grey area. There are degrees, of course; at one end
120
Rediscovering the Intel AMT Vulnerability
On May 1, 2017 Intel disclosed the AMT vulnerability (INTEL-SA-00075), but details of that vulnerability were not made public. However, Tenable researchers were able to overcome this challenge and make Tenable the first to deliver Intel AMT vulnerability detection capabilities to customers, just minutes after Intel’s…