Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 1,584 posts.
Researchers have exploited bit-errors before in amazing ways . But bit-errors can be detected and exploited in new ways on an Internet-wide scale. One of these means is by bitsquatting, or registering domain names one bit different than frequently resolved domains.
Site Isolation is a security feature in Chrome that offers additional protection against some types of security bugs. It uses Chrome's sandbox to make it harder for untrustworthy websites to access or steal information from your accounts on other websites.
Mozilla has acquired Anonym, a trailblazer in privacy-preserving digital advertising. This strategic acquisition enables Mozilla to help raise the bar for
At Open Whisper Systems, we’ve been working on improving our encrypted asynchronous chat protocol for TextSecure. The TextSecure protocol was originally a derivative of OTR, with minor changes to accommodate it for transports with constraints like SMS or Push. Some of the recent changes we’ve ...
Today we announced support for encrypted SNI, an extension to the TLS 1.3 protocol that improves privacy of Internet users.
In Firefox 95, we're shipping a sandboxing technology called RLBox — developed with researchers at UC San Diego and the University of Texas
I have held back on writing anything about AI or how we (not) use AI for development in the curl factory. Now I can't hold back anymore. Let me show you the most significant effect of AI on curl as of today - with examples. Bug Bounty Having a bug bounty means that we offer … Continue reading The I in LLM stands for…
Basic security precautions for non-profits and journalists in the United States, early 2019.
Note: Read about improvements to this technology in recent blog posts about Intelligent Tracking Prevention, and the Storage Access API.
Microsoft Security Response Center Blog2019132 points28 commentscited by 17Security & Privacy details
What if we could eliminate an entire class of vulnerabilities before they ever happened?
Way back in 1974, Paul Karger and Roger Schell discovered a devastating attack against computer systems. Ken Thompson described it in his classic 1984 speech, “Reflections on Trusting Trust.” Basically, an attacker changes a compiler binary to produce malicious versions of some programs, INCLUDING ITSELF. Once this is…
Google has not had any of its 85,000+ employees successfully phished on their work-related accounts since early 2017, when it began requiring all employees to use physical Security Keys in place of passwords and one-time codes, the company told KrebsOnSecurity.
Chrome's HTTP cache partitioning helps with better security and privacy.
Today we're excited to announce what we began to plan more than two years ago: the 1.1.1.1 App with WARP performance and security technology. We built Warp from the ground up to thrive in the harsh conditions of the modern mobile Internet.
Here at Trail of Bits we review a lot of code. From major open source projects to exciting new proprietary software, we’ve seen it all. But one common denominator in all of these systems is that for some inexplicable reason people still seem to think RSA is a good cryptosystem to use. Let me save […]
On Wednesday we shared that we’re introducing a new terms of use (TOU) and privacy notice for Firefox. Since then, we’ve been listening to some of our
As one of the maintainers of eCryptfs , and a long time Thinkpad owner, I have been asked many times to add support to eCryptfs for Th...
Posted By Samuel Groß, Project Zero On December 20, Citizenlab published “The Great...
Several recently-published research articles have demonstrated a new class of timing attacks (Meltdown and Spectre) that work on modern CPUs. Our internal experiments confirm that it is possible to use ...
Last year, we wrote about why a memory safety strategy that focuses on vulnerability prevention in new code quickly yields durable and compounding gains. This year we lo…
Apple products, including Apple Intelligence, are designed to protect your privacy, because privacy is a fundamental human right.
The AMD Product Security Incident Response Team (PSIRT) is the focal point for reporting potential product security issues to AMD. AMD PSIRT works with both the AMD internal product security team and the external product security ecosystem, including security researchers, industry peers, government organizations…
Quick summary of my recommendations on compare-by-hash: If you are using compare-by-hash to generate addresses for data that can be supplied by malicious users, you should have a plan to migrate to a new hash every few years. For example, BitTorrent falls into this category, but rsync doesn't. Keep in mind that new…
There certainly is one thing that most Linux users don't realize about their Linux systems... this is the lack of GUI-level isolation, and ...
I'm going to talk today about signify, a tool I wrote for the OpenBSD project that cryptographically signs and verifies. This allows us to ensure that the releases we ship arrive on your computer in their original, intended form, without tampering.
