91
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 120 posts.
92
Macs with T2, M1 chips cannot be restored to factory state without Apple
Modern Apple computers can no longer be fully used and maintained in 100% offline environments, or in ways that will reasonably ensure that the computer is…
93
Wacom tablets track every app you open
I have a Wacom drawing tablet. I use it to draw cover illustrations for my blog posts, such as this one.
94
Firefox 83 introduces HTTPS-Only Mode
Security on the web matters. Whenever you connect to a web page and enter a password, a credit card number, or other sensitive information, you want to be sure ...
95
WebKit will delete all local storage after 7 days
Apple will delete your data if you don’t use an app for seven days. This effectively kills offline web apps.
96
SolarWinds hackers were able to access Microsoft source code
Microsoft Security Response Center Blog2020676 points384 commentscited by 3Security & Privacy details
As we said in our recent blog , we believe the Solorigate incident is an opportunity to work together in important ways, to share information, strengthen defenses and respond to attacks. Like other SolarWinds customers, we have been actively looking for indicators of the Solorigate actor and want to share an update…
97
No, Cellebrite Cannot “Break Signal Encryption”
Yesterday, the BBC ran a story with the factually untrue headline, “Cellebrite claimed to have cracked chat app’s encryption.” This is false. Not only can Cellebrite not break Signal encryption, but Cellebrite never even claimed to be able to. Since we weren’t actually given the opportunity to co...
98
macOS has checked app signatures online for over 2 years
Why does it take 2 years to realise that macOS has been checking signing certificate validity online?
99
100
Running your own secure communication service with Matrix and Jitsi
Matrix, the open protocol for secure decentralised communications
101
New study: The advertising industry is systematically breaking EU law
The online advertising industry is behind comprehensive illegal collection and indiscriminate use of personal data, research from the Norwegian Consumer Council shows.
102
Let's Encrypt's New Root and Intermediate Certificates
On Thursday, September 3rd, 2020, Let’s Encrypt issued six new certificates: one root, four intermediates, and one cross-sign. These new certificates are part of our larger plan to improve privacy on the web, by making ECDSA end-entity certificates widely available, and by making certificates smaller. Given that we…
103
“Why Using WhatsApp Is Dangerous“
telegra.ph/why-using-whatsapp-is-dangerous-01-30-42020381 points234 commentscited by 3Security & Privacy details
A few months ago I wrote about a WhatsApp backdoor that allowed hackers to access all data on any phone running WhatsApp [1]. Facebook, its parent company, claimed at the time that they had no proof the flaw had ever been used by attackers [2]. Last week it became clear that this backdoor had been exploited to extract…
104
Playing around with the Fuchsia operating system
A look at the new Fuchsia Operating System.
105
Double Blind Passwords a.k.a. Horcruxing
Before we get into Horcruxing, here's a quick prologue on online security hygiene. You can skip to the Horcruxing section if it seems redundant. 1. Longer…
106
BusKill: A kill cord for your laptop
BusKill is a Kill Cord for your laptop implementing a Dead Man Switch using $20 in USB hardware + udev rule to trigger your laptop self-destruct if stolen.
107
Let's Reverse Engineer Discord
How we reverse engineered Discord’s call protocol and found it being MITM-ed by Discord.
108
Twitter Direct Message Caching and Firefox
Distinguished engineer Martin Thomson explains how this problem occurred, the implications for people who might be affected, and how problems of this nature might be avoided in future. To get ...
109
230, or not 230? That is the EARN IT question
Over the past several weeks, Signal traffic has gone through the roof. New users are signing up at unprecedented rates, and we’ve expanded our server capacity faster than we ever anticipated. It means a lot to us that so many people are relying on Signal during this difficult time. When users che...
110
Firefox turns on DoH as default for US users
Today, Firefox began the rollout of encrypted DNS over HTTPS (DoH) by default for US-based users. The rollout will continue over the next few weeks to conf
111
Someone attacked our company
At the start of November, someone decided that they would try to attack and destroy our company. Here’s how we stopped them.
112
ProtonDrive Security Model
Learn how Proton Drive uses end-to-end encryption to protect your photos, documents, and other sensitive data.
113
Confidential VMs
Google Cloud will now offer the ability to encrypt data in use, while it’s being processed in a Google data center
114
Jailed Just-in-Time Compilation on iOS
Saagar Jha's website.
115
DOMPurify bypass: XSS via HTML namespace confusion
Securitum is a pure pentesting company specialising in the security of IT systems. We have experience in performing security audits (including penetration tests) - mainly for financial/e-commerce/industrial sectors. We have performed penetration tests and cyber security services for leading European banks (see…
116
Multi-account containers add-on sync feature
The Multi-Account Containers Add-on will now sync your container configuration and site assignments. Firefox Multi-Account Containers allows users to separate their online identities into different tab types called Containers. Each ...
117
New Federal Court Rulings Find Geofence Warrants Unconstitutional
Update December 14, 2021: After this post was published, on June 4, 2021, a federal magistrate judge in Kansas issued another opinion denying the government's application for a geofence warrant.Update May 17, 2021: Since this post was published, the court unsealed its July 24, 2020 opinion denying...
118
Reimagining the Browser: Introducing Cloudflare Browser Isolation Beta
Today, we’re excited to open up a beta of a third approach to keeping web browsing safe with Cloudflare Browser Isolation.
119
Github: Token authentication requirements for Git operations
Beginning August 13th, 2021, we will no longer accept account passwords when authenticating Git operations on GitHub.com.
120
Huawei HKSP Introduces Trivially Exploitable Vulnerability in the Linux Kernel
Huawei has seemingly stepped its foot into the kernel self-protection game with the release of HKSP. Absent any threat model and riddled with weaknesses, it also introduces a trivially exploitable local root vulnerability due to a complete lack of defensive programming.