1741
The NPM registry is deprecating TLS 1.0 and TLS 1.1
Beginning October 4, 2021, all connections to npm websites and the npm registry, including for package installation, must use TLS 1.2 or higher.
New
The latest blog posts to take off on Hacker News. 4,440 posts.
1742
Bahraini Government Hacks Activists with NSO Group Zero-Click iPhone Exploits
We identified nine Bahraini activists whose iPhones were successfully hacked with NSO Group’s Pegasus spyware between June 2020 and February 2021. The hacked activists included three members of Waad (a secular Bahraini political society), three members of the Bahrain Center for Human Rights, two exiled Bahraini…
1743
EFF Joins Global Coalition Asking Apple CEO Tim Cook to Stop Phone-Scanning
EFF has joined the Center for Democracy and Technology (CDT) and more than 90 other organizations to send a letter urging Apple CEO Tim Cook to stop the company’s plans to weaken privacy and security on Apple’s iPhones and other products. Have you signed the petition?
1744
macOS 11’s hidden security improvements
A deep dive into macOS 11's internals reveals some security surprises that deserve to be more widely known.
1745
ImageNet contains naturally occurring Apple NeuralHash collisions
Apple’s NeuralHash: real-world collisions, false positives, and implications for CSAM detection. See what this means for system reliability.
1746
Google introducing tool for under-18s to remove images of them from search
Today we’re announcing a variety of new policies and updates to help keep kids and teens safe as they spend more time online.
1747
Apple’s device surveillance plan is a threat to user privacy – and press freedom
The backlash from privacy and human rights advocates to Apple's new plan this month for scanning photos on user devices to detect known child sexual abuse images has been loud and nearly unanimous. The tech raises press freedom problems, too.
1748
1749
AWS Identity service handles 400M API calls every second
Amazon S3 turned 15 earlier this year, and Amazon EC2 will do the same in a couple of months. Today we are celebrating the tenth birthday of AWS Identity and Access Management (IAM). The First Decade Let’s take a walk through the last decade and revisit some of the most significant IAM launches: May 2011 […]
1750
AlgorithmWatch shuts down Instagram monitoring after threats from Facebook
Digital platforms play an ever-increasing role in structuring and influencing public debate. Civil society watchdogs, researchers and journalists need to be able to hold them to account. But Facebook is increasingly fighting those who try. It shut down New York University’s Ad Observatory last week, and went after…
1751
Git password authentication is shutting down
As previously announced, starting on August 13, 2021, at 09:00 PST, we will no longer accept account passwords when authenticating Git operations on GitHub.com. Instead, token-based authentication (for example, personal…
1752
Internet of Snitches
Purism makes premium phones, laptops, mini PCs and servers running free software on PureOS. Purism products respect people's privacy and freedom while protecting their security.
1753
Who Is Being Monitored?
Politicians regularly claim that they need to ban encryption to protect the children. But who is actually being monitored?
1754
NodeJS security cheat sheet
Website with the collection of all the cheat sheets of the project.
1755
Apple Has Opened the Backdoor to Increased Surveillance and Censorship
UPDATE: Apple announced it will provide fully encrypted iCloud backups, meeting a longstanding demand by EFF and other privacy-focused organizations, and it has officially dropped its plans to install photo-scanning software on its devices, which would have inspected users’ private photos in iCloud...
1756
Default disappearing messages
As the norms for how people connect have changed, much of the communication that once took place through the medium of coffee shops, bars, and parks now takes place through the medium of digital devices. One side effect of this shift from analog to digital is the conjoined shift from the ephemera...
1757
Noyb.eu files 422 formal GDPR complaints on nerve-wrecking “Cookie Banners”
Today we filed 422 + 36 complaints on "cookie banners" with ten European Data Protection Authorities.
1758
Firefox 91 introduces enhanced cookie clearing
We are pleased to announce a new, major privacy enhancement to Firefox’s cookie handling that lets you fully erase your browser history for any website. Today’s new version of Firefox ...
1759
How to Hack APIs in 2021
Detectify Crowdsource is not your average bug bounty platform. It’s an invite-only community of the best ethical hackers who are passionate about securing modern technologies ...
1760
Kernel Pwning with eBPF: A Love Story
How are low-level vulnerabilities exploited and detected in the modern age? This expert guide walks you through the ins and outs of eBPF and Kernel security.
1761
HTTP/2-exclusive threats caused by implementation flaws and RFC imperfections
In this research paper James Kettle introduces multiple new classes of HTTP/2-exclusive attacks, demonstrated on popular websites and servers.
1762
Ethereum is a Dark Forest
It’s no secret that the Ethereum blockchain is a highly adversarial environment. If a smart contract can be exploited for profit, it eventually will be. But this unforgiving environment pales in comparison to the mempool. If the chain itself is a battleground, the mempool is something worse: a dark forest.
1763
Apple's plan to “think different” about encryption opens a backdoor to your life
Apple has announced impending changes to its operating systems that include new “protections for children” features in iCloud and iMessage. If you’ve spent any time following the Crypto Wars, you know what this means: Apple is planning to build a backdoor into its data storage system and its messaging system.
1764
1765
Malicious PyPI packages stealing credit cards and injecting code
JFrog finds a new supply chain attack targeting python developers using the PyPI repository
1766
Infrastructure bill cryptocurrency surveillance provision is a privacy disaster
The forthcoming Senate draft of Biden's infrastructure bill—a 2,000+ page bill designed to update the United States’ roads, highways, and digital infrastructure—contains a poorly crafted provision that could create new surveillance requirements for many within the blockchain ecosystem. This could...
1767
Docker container security cheat sheet
Discover essential Docker Security Best Practices for DevOps engineers and security professionals. Cheat sheet included for quick implementation!
1768
A wiper attack paralyzed the Iranian train system
In the midst of an epic troll on a country-wide railway system, we discovered a new threat actor and their reusable wiper called Meteor.
1769
1770
Google launches new vulnerability reward platform
Posted by Jan Keller, Technical Program Manager, Google VRP A little over 10 years ago , we launched our Vulnerability Rewards Program (VR...