Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 1,584 posts.
The End of the Privacy of Digital Correspondence The EU wants to oblige providers to search all private chats, messages, and emails automatically for suspicious content - generally and indiscriminately. The stated aim: To prosecute child pornography. The result: Mass surveillance by means of full
To help preserve a safe Internet for content creators, we’ve just launched a brand new “easy button” to block all AI bots. It’s available for all customers, including those on our free tier
We’ve trained a large-scale unsupervised language model which generates coherent paragraphs of text, achieves state-of-the-art performance on many language modeling benchmarks, and performs rudimentary reading comprehension, machine translation, question answering, and summarization—all without task-specific training.
Last week, Debian announced that in September 2006 they accidentally broke the OpenSSL pseudo-random number generator while trying to silence a Valgrind warning. One effect this had is that the ssh-keygen program installed on recent Debian systems (and Debian-derived systems like Ubuntu) could only generate 32,767…
The Software Freedom Law Center provides legal representation and other law related services to protect and advance Free and Open Source Software.
Back in 1998, I wrote: Anyone, from the most clueless amateur to the best cryptographer, can create an algorithm that he himself can’t break. In 2004, Cory Doctorow called this Schneier’s law: …what I think of as Schneier’s Law: “any person can invent a security system so clever that she or he can’t think of how to…
Which libraries are vulnerable to attacks and how to prevent them.
We have blocked Kiwifarms. Visitors to any of the Kiwifarms sites that use any of Cloudflare's services will see a Cloudflare block page and a link to this post.
The biometrics hacking team of the Chaos Computer Club (CCC) has successfully bypassed the biometric security of Apple's TouchID using easy everyday means. A fingerprint of the phone user,...
Details of the Manifest V2 phase-out and end of life.
OpenAI shares findings from the Hugging Face security incident and the steps we’re taking to strengthen AI model security, monitoring, and alignment.
How Cloudflare uses generative AI to slow down, confuse, and waste the resources of AI Crawlers and other bots that don’t respect “no crawl” directives.
Encrypting data: Use AES in CTR (Counter) mode, and append an HMAC . AES is about as standard as you can get, and has done a good job of resisting cryptologic attacks over the past decade. Using CTR mode avoids the weakness of ECB mode, the complex (and bug-prone) process of padding and unpadding of partial blocks (or…
Extracting BitLocker keys sealed with a TPM by sniffing the LPC bus
New research on simulated blackmail, industrial espionage, and other misaligned behaviors in LLMs.
Linux being secure is a common misconception in the security and privacy realm. Linux is thought to be secure primarily because of its source model, popular usage in servers, small userbase and confusion about its security features. This article is intended to debunk these misunderstandings by demonstrating the lack…
Future Claude models will generate text that contains a watermark to comply with the EU AI Act. We answer questions about how it works and whether it affects outputs.
XTS is the de-facto standard disk encryption mode, which makes it look like a good general-purpose one. It isn't. What disk encryption actually promises, and why XTS's guarantees don't travel.
A tale of two PHP remote vulnerabilities
As some of you may know, there's a wall of lava lamps in the lobby of our San Francisco office that we use for cryptography. In this post, we’re going to explore how that works.
By default, Android has a strong security model and incorporates full system SELinux policies , strong app sandboxing , full verified boot , modern exploit mitigations like fine-grained, forward-edge Control Flow Integrity and ShadowCallStack , widespread use of memory-safe languages (Java / Kotlin) and more. As such…
In the “first half of 2016” (the most specific we’re permitted to be), we received a subpoena from the Eastern District of Virginia. The subpoena required us to provide information about two Signal users for a federal grand jury investigation. We’ve designed the Signal service to minimize the dat...
Posted by Troy Kensinger, Technical Program Manager, Android Security and Privacy Android is all about choice. As such, Android strives to...
From the very beginning of VALORANT development, we made it a priority to build out cheating resistance to ensure competitive integrity. In this article, I’ll walk you through one of these anti-cheat systems - Fog of War. This…
Since we announced Let’s Encrypt we’ve often been asked how we’ll ensure that we don’t issue certificates for phishing and malware sites. The concern most commonly expressed is that having valid HTTPS certificates helps these sites look more legitimate, making people more likely to trust them. Deciding what to do here…
At Apple, we believe privacy is a fundamental human right. Our work to protect user privacy is informed by a set of privacy principles, and…
