1
GrapheneOS attestation compatibility guide
Guide on using remote attestation in a way that's compatible with GrapheneOS.
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 94 posts.
2
Memory Safe Languages in Android 13
Posted by Jeff Vander Stoep For more than a decade, memory safety vulnerabilities have consistently represented more than 65% of vulnerab...
3
Google has most of my email because it has all of yours (2014)
Republished by Slate. Translations available in French (Français), Spanish (Español), Chinese (中文) For almost 15 years, I have run my own email server which I use for all of my non-work corresponde…
4
Private Access Tokens: eliminating CAPTCHAs on iPhones and Macs with open standards
Today we’re announcing Private Access Tokens, a completely invisible, private way to validate that real users are visiting your site
5
OpenSSH 9.0
OpenSSH release notes
6
Ssss: Shamir's Secret Sharing Scheme (2006)
Shamir's Secret Sharing Scheme
7
Gaining security and privacy by partitioning the cache | Blog
Chrome's HTTP cache partitioning helps with better security and privacy.
8
9
Europe: The end of the privacy of digital correspondence
The End of the Privacy of Digital Correspondence The EU wants to oblige providers to search all private chats, messages, and emails automatically for suspicious content - generally and indiscriminately. The stated aim: To prosecute child pornography. The result: Mass surveillance by means of full
10
Blocking Kiwifarms
We have blocked Kiwifarms. Visitors to any of the Kiwifarms sites that use any of Cloudflare's services will see a Cloudflare block page and a link to this post.
11
About Emergency Access
The emergency access feature of the Bitwarden password manager enables you to designate trusted emergency contacts to access your vault in an emergency.
12
Removing SMS support from Signal Android (soon)
For many years, the Signal app on Android has supported sending and receiving plaintext SMS and MMS messages in addition to Signal messages. SMS and MMS are standardized communication protocols that allow mobile devices to send and transmit messages, and most people picking up their phone to text...
13
If you’re not using SSH certificates you’re doing SSH wrong (2019)
SSH has some pretty gnarly issues when it comes to usability, operability, and security. The good news is this is all easy to fix. SSH is ubiquitous. It’s the de-facto solution for remote administration of *nix systems. SSH certificate authentication makes SSH easier to use, easier to operate, and more secure.
14
Reverse Engineering TikTok's VM Obfuscation
TikTok has a reputation for its aggressive data collection. The platform has implemented various methods to make it difficult for reverse-engineers to understand exactly what data is being collected and how it is being used.
15
LastPass user vaults stolen in recent hack
Please refer to the latest article for updated information.nbs[..]
16
Mullvad: Diskless infrastructure using stboot in beta
Diskless infrastructure using stboot (in beta) is now available on a pair of WireGuard servers in Sweden.
17
Austrian DSB: EU-US Data Transfers to Google Analytics Illegal
In a groundbreaking decision, the Austrian Data Protection Authority has decided on a model case by noyb that the continuous use of Google Analytics violates the GDPR.
18
The most backdoor-looking bug I’ve ever seen (2021)
This is the story of a bug that was discovered and fixed in Telegram’s self-rolled cryptographic protocol about seven years ago. The bug didn’t get any press, and no one seems to know about it, probably because it was only published in Russian.
19
iCloud Private Relay: What Cloudflare Customers Need to Know
iCloud Private Relay is an Apple service for browsing more privately and securely. Learn how to ensure the best user experience using iCloud Private Relay.
20
A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution
Posted by Ian Beer & Samuel Groß of Google Project Zero We want to thank Citizen Lab ...
21
Security of Passkeys in the Google Password Manager
Posted by Arnar Birgisson, Software Engineer We are excited to announce passkey support on Android and Chrome for developers to test today, ...
22
Apple previews Lockdown Mode
Apple today detailed two initiatives to help protect users who may be personally targeted by sophisticated digital threats.
23
Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard
Faster, easier and more secure sign-ins will be available to consumers across leading devices and platforms
24
CatalanGate: Spyware operation against Catalans using Pegasus and Candiru
The Citizen Lab, in collaboration with Catalan civil society groups, has identified at least 65 individuals targeted or infected with mercenary spyware, including members of the European Parliament, Catalan Presidents, legislators, jurists, and members of civil society organisations.
25
Attack campaign involving stolen OAuth tokens issued to third-party integrators
On April 12, GitHub Security began an investigation that uncovered evidence that an attacker abused stolen OAuth user tokens issued to two third-party OAuth integrators, Heroku and Travis-CI, to download data from dozens of organizations, including npm. Read on to learn more about the impact to GitHub, npm, and our…
26
Towards the next generation of XNU memory safety: kalloc_type
Improving software memory safety is a key security objective for engineering teams across the industry. Here we begin a journey into the XNU kernel at the core of iOS and explore the intricate work our engineering teams have done to harden the memory allocator and make our software much more difficult to exploit.
27
Brave New Trusted Boot World
Posts and writings by Lennart Poettering
28
NSA, NIST, and post-quantum crypto: my second lawsuit against the US government
The Black Chamber was founded by the U.S. Army and the U.S. State Department in 1919. The Secretary of State terminated funding in 1929, famously writing that "Gentlemen do not read each other's mail."
29
I've locked myself out of my digital life
Imagine… Last night, lightning struck our house and burned it down. I escaped wearing only my nightclothes. In an instant, everything was vaporised. Laptop? Cinders. Phone? Ashes. Home server? A smouldering wreck. Yubikey? A charred chunk of gristle. This presents something of a problem. In order to recover my digital…
30
Fine-grained personal access tokens for GitHub
Fine-grained personal access tokens offer enhanced security to developers and organization owners, to reduce the risk to your data of compromised tokens.