1261
Why ProtonMail is more secure than Gmail
Proton Mail is a private email service takes a radically different approach to security. Find out how Proton Mail security compares to Gmail security.
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 1,584 posts.
1262
HTML5 localStorage allows sites to fill up users' hard disks
Use HTML5 localStorage to completely fill up Chrome, Safari, and IE users hard disks. Trololo...
1263
My Lethal Trifecta talk at the Bay Area AI Security Meetup
I gave a talk on Wednesday at the Bay Area AI Security Meetup about prompt injection, the lethal trifecta and the challenges of securing systems that use MCP. It wasn’t …
1264
Standalone Signal Desktop
Signal Desktop is now available in a new, standalone form, and the Chrome App has been deprecated.
1265
Going Dark: The war on encryption is on the rise
After Snowden’s whistleblowing in 2013, large parts of the internet became encrypted, enabling private and secure communication. Not everyone has welcomed this change. Most notably, the FBI and other U.S. government agencies have fought what is often called the “crypto wars”, the war on encryption. In recent years…
1266
Branch Privilege Injection: Exploiting branch predictor race conditions
Branch Privilege Injection ( CVE-2024-45332 ) brings back the full might of branch target injection attacks (Spectre-BTI) on Intel. Intel’s hardware mitigations against these types of attacks have held their ground for almost 6 years. In our work, we demonstrate how these mitigations can be broken due to a race…
1267
Tor at the Heart: Firefox
During the month of December, we're highlighting other organizations and projects that rely on...
1268
The Web Is Broken – Botnet Part 2
I guess you have all heard about the growing problem of AI companies trying to aggressively collect whatever data they can get their hands on to train their models. This has caused an explosive surge in web crawlers relentlessly hitting servers big and small. But who runs these crawlers? Turns out — it could be you!
1269
Let's Encrypt: Looking Forward to 2019
Let’s Encrypt had a great year in 2018. We’re now serving more than 150 million websites while maintaining a stellar security and compliance track record. Most importantly though, the Web went from 67% encrypted page loads to 77% in 2018, according to statistics from Mozilla. This is an incredible rate of change! We’d…
1270
Flipping Pages: New Linux vulnerability in nf_tables and exploitation techniques
A tale about exploiting KernelCTF Mitigation, Debian, and Ubuntu instances with a double-free in nf_tables in the Linux kernel, using novel techniques like Dirty Pagedirectory. All without even having to recompile the exploit for different kernel targets once.
1271
Retrieving your browsing history through a CAPTCHA
Web developer and cybersecurity researcher
1272
A closer look at a BGP anomaly in Venezuela
There has been speculation about the cause of a BGP anomaly observed in Venezuela on January 2. We take a look at BGP route leaks, and dive into what the data suggests caused the anomaly in question.
1273
1274
Removing Coordinated Inauthentic Behavior from China
We removed seven Pages, three Groups and five Facebook accounts as part of a small network that originated in China and focused on Hong Kong.
1275
The SaaS CTO Security Checklist Redux
Learn how to protect your SaaS applications with the SaaS CTO security checklist. Doing the basics goes a long way in keeping your company and product secure.
1276
How to win at CORS
The 'how' and 'why' of CORS, from start to finish.
1277
LoJax: First UEFI rootkit found in the wild, courtesy of the Sednit group
ESET researchers have discovered the first in-the-wild UEFI rootkit. Dubbed LoJax, the research team has shown that the Sednit operators used different components of the LoJax malware to target a few government organizations in the Balkans as well as in Central and Eastern Europe.
1278
“Why Using WhatsApp Is Dangerous“
telegra.ph/why-using-whatsapp-is-dangerous-01-30-42020381 points234 commentscited by 3Security & Privacy details
A few months ago I wrote about a WhatsApp backdoor that allowed hackers to access all data on any phone running WhatsApp [1]. Facebook, its parent company, claimed at the time that they had no proof the flaw had ever been used by attackers [2]. Last week it became clear that this backdoor had been exploited to extract…
1279
An analysis of the Nomx secure communications device
With slick marketing, catchy taglines and some pretty bold claims about their security, nomx claim to have cracked email security. Let's see if they have.
1280
Playing around with the Fuchsia operating system
A look at the new Fuchsia Operating System.
1281
Recovering secret keys from devices using video footage of their power LED
Exploiting a Video Camera's Rolling Shutter to Recover Secret Keys from Devices Using Video Footage of Their Power LED
1282
EFF’s concerns about the UN Cybercrime Convention
Update: This post has been updated to clarify the scope of the compelled assistance provisions and the broad nature of criminalization and electronic evidence gathering. The final version of the draft convention can still be used to expand the reach of repression under the pretext of combating...
1283
Tailscale state file encryption no longer enabled by default
View changes to the Tailscale client and service.
1284
The Microsoft MFA system almost brought me to a nervous breakdown
Update 12/10/21, 10:15 UTC: I never imagined this post would reach the front page on Hacker News and gather so much support. Thank you all…
1285
Images that fool computer vision raise security concerns
Computers are learning to recognize objects with near-human ability. But Cornell researchers have found that computers, like humans, can be fooled by optical illusions, which raises security concerns.
1286
How to Find Hidden Cameras in Your Airbnb
How to Find Hidden Cameras in your AirBNB, Author: Johannes Ullrich
1287
An update on AirTag and unwanted tracking
Apple announced it has identified even more ways to update AirTag safety warnings and help guard against unwanted tracking of people and property.
1288
1289
Lessons in website security anti-patterns by Tesco
Update, 14 Feb 2014: A year and a half on from writing this, Tesco has indeed suffered a serious security incident almost certainly as a result of some of the risks originally detailed here. Read more about it in The Tesco hack – here’s how it (probably) happened [https://www.
1290
Hacker in Snowflake extortions may be a U.S. soldier
Two men have been arrested for allegedly stealing data from and extorting dozens of companies that used the cloud data storage company Snowflake , but a third suspect — a prolific hacker known as Kiberphant0m — remains at large and continues to publicly extort victims. However, this person’s identity may not remain a…