1471
GitHub: Private Profiles beta
Users now have the ability to turn their GitHub profile “private”, which gives users controls over features that share user data across the GitHub platform. To enable this setting, visit…
New
The latest blog posts to take off on Hacker News. 4,440 posts.
1472
UK Government Officials Infected with Pegasus
We confirm that in 2020 and 2021 we observed and notified the government of the United Kingdom of multiple suspected instances of Pegasus spyware infections within official UK networks, including the Prime Minister’s Office and the Foreign and Commonwealth Office.
1473
CatalanGate: Spyware operation against Catalans using Pegasus and Candiru
The Citizen Lab, in collaboration with Catalan civil society groups, has identified at least 65 individuals targeted or infected with mercenary spyware, including members of the European Parliament, Catalan Presidents, legislators, jurists, and members of civil society organisations.
1474
Security experts declare all Proton apps secure after security audit
All our apps (Proton Mail, Proton Drive, etc) are open source and independently audited. Anyone can inspect our software and confirm our encryption works.
1475
About Emergency Access
The emergency access feature of the Bitwarden password manager enables you to designate trusted emergency contacts to access your vault in an emergency.
1476
Intel deprecates SGX on Core series processors
A newer version of this document is available. Customers should click here to go to the newest version.
1477
Attack campaign involving stolen OAuth tokens issued to third-party integrators
On April 12, GitHub Security began an investigation that uncovered evidence that an attacker abused stolen OAuth user tokens issued to two third-party OAuth integrators, Heroku and Travis-CI, to download data from dozens of organizations, including npm. Read on to learn more about the impact to GitHub, npm, and our…
1478
Elliptic Curve Cryptography: A Basic Introduction
Elliptic Curve Cryptography (ECC) is a modern public-key encryption technique famous for being smaller, faster, and more efficient than incumbents. Bitcoin, for example, uses ECC as its asymmetric cryptosystem because it is so lightweight. The mathematical entity that makes all of this possible is the elliptic curve…
1479
Let’s Encrypt Receives the Levchin Prize for Real-World Cryptography
On April 13, 2022, the Real World Crypto steering committee presented the Max Levchin Prize for Real-World Cryptography to Let’s Encrypt. The following is the speech delivered by our Executive Director, Josh Aas, upon receiving the award. We’d like to thank our community for supporting us and invite you to join us in…
1480
You’re muted – or are you? Videoconferencing apps may listen when mic is off
Not only did researchers find that the apps gather audio data while "mute" is activated; they could identify activities picked up when microphones weren't believed to be on, such as eating, playing music, typing and cleaning.
1481
Git security vulnerability announced
Upgrade your local installation of Git, especially if you are using Git for Windows, or you use Git on a multi-user machine.
1482
WireGuard multihop available in the Mullvad app
To further increase your privacy and make your traffic harder to analyze, you can now route all your traffic through two servers instead of just one, directly in our desktop app, version 2022.1 and newer.
1483
The complete guide to protecting your APIs with OAuth2
OAuth2 is one of the most popular specifications for API authentication today, though wrapping your head around it can be a challenge.
1484
Mullvad Privacy Companion is now open source
Mullvad Privacy Companion, a free Firefox extension helping to improve your online privacy – is now open source.
1485
Automate Public Certificates Lifecycle Management via RFC 8555 (ACME)
ACME API lets our users automate their Public Certificate Lifecycle Management.
1486
1487
OpenSSH 9.0
OpenSSH release notes
1488
Apple neglects to patch two zero-day, wild vulnerabilities for Big Sur, Catalina
Apple has chosen to leave Big Sur and Catalina (around 35 to 40 percent of all Macs) in danger of actively exploited vulnerabilities that have only been patched for macOS Monterey.
1489
1490
How we secure Monzo's banking platform
Our Security Infrastructure team introduces the principles we follow to build security in Monzo’s fast-moving engineering environment and how they work with other engineering teams to keep our customers and platform safe.
1491
How Go mitigates supply chain attacks
Go tooling and design help mitigate supply chain attacks at various stages.
1492
FORCEDENTRY: Sandbox Escape
Posted by Ian Beer & Samuel Groß of Google Project Zero We want to thank Citizen...
1493
Spring Core on JDK9 is vulnerable to remote code execution
Update: March 31, 2022 A patch has officially been released. https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement https://tanzu.vmware.com/security/cve-2022-22965 Overview Spring Core on JDK9+ is vulnerable to remote code execution due to a bypass for CVE-2010-1622. At the time of writing, this…
1494
Stage win: FinFisher is bankrupt
FinFisher, the Munich-based state Trojan exporter, is bankrupt. For over a decade, a wide variety of international groups, including the CCC, have worked toward its end.
1495
1496
Today Google is turning on tracking for many users that previously turned it off
Workspace admins can no longer deactivate Google activity tracking for their users, Google says this is helping people.
1497
Mystery GPS Tracker on a Supporter’s Car
Being able to accurately determine your location anywhere on the planet is a useful technological trick. But when tracking isn’t done by you, but to you—without your knowledge or consent—it’s a violation of your privacy. That’s why at EFF we’ve long fought against dragnet surveillance, mobile...
1498
Countering threats from North Korea
On February 10, Threat Analysis Group discovered two distinct North Korean government-backed attacker groups exploiting a remote code execution vulnerability in Chrome, …
1499
Gaining security and privacy by partitioning the cache | Blog
Chrome's HTTP cache partitioning helps with better security and privacy.
1500
Interoperability without sacrificing privacy: Matrix and the DMA
Matrix, the open protocol for secure decentralised communications