The latest blog posts to take off on Hacker News. 678 posts.
UPDATE: Apple announced it will provide fully encrypted iCloud backups, meeting a longstanding demand by EFF and other privacy-focused organizations, and it has officially dropped its plans to install photo-scanning software on its devices, which would have inspected users’ private photos in iCloud...
As the norms for how people connect have changed, much of the communication that once took place through the medium of coffee shops, bars, and parks now takes place through the medium of digital devices. One side effect of this shift from analog to digital is the conjoined shift from the ephemera...
Today we filed 422 + 36 complaints on "cookie banners" with ten European Data Protection Authorities.
We are pleased to announce a new, major privacy enhancement to Firefox’s cookie handling that lets you fully erase your browser history for any website. Today’s new version of Firefox ...
Detectify Crowdsource is not your average bug bounty platform. It’s an invite-only community of the best ethical hackers who are passionate about securing modern technologies ...
Violation of privacy by proxy is still violation of privacy.
How are low-level vulnerabilities exploited and detected in the modern age? This expert guide walks you through the ins and outs of eBPF and Kernel security.
This is an introductory article about shell injection, a security vulnerability allowing an attacker to execute arbitrary code on the user's machine. This is a well-studied problem, and there are simple and efficient solutions to it. It's relatively easy to design library API in such a way as to shield the application…
"Whatever you do will be insignificant, but it is very important that you do it." -Mahatma Gandhi
The stakes are incredibly high, and Apple knows it. Whatever you think of Apple’s decision to implement these features, they’re not doing so lightly.
Apple just announced that they will use “perceptual hashing” to detect illegal photos on iPhones. I have some experience to share on this technology.
These efforts will evolve and expand over time. – Apple on their “Expanded Protections for Children” I am broke “non-liquid” right now. Normally, that sentence doesn&#…
In this research paper James Kettle introduces multiple new classes of HTTP/2-exclusive attacks, demonstrated on popular websites and servers.
It’s no secret that the Ethereum blockchain is a highly adversarial environment. If a smart contract can be exploited for profit, it eventually will be. But this unforgiving environment pales in comparison to the mempool. If the chain itself is a battleground, the mempool is something worse: a dark forest.
Apple has announced impending changes to its operating systems that include new “protections for children” features in iCloud and iMessage. If you’ve spent any time following the Crypto Wars, you know what this means: Apple is planning to build a backdoor into its data storage system and its messaging system.
There’s a tradition in my family that everyone takes a turn stirring a secret wish into the yearly christmas pudding . It’s important that the wishes remain secret to the wisher or the pudding magics wont work so since moving to America I’ve implemented a new way of hashing my wish so it can be stirred in via text…
What is SAML? Security Assertion Markup Language (SAML) is an open standard for exchanging authentication and authorization data between parties. Source: Wikipedia SAML is often used for single-sign on (“Sign in with Google”, “Sign in with Twitter” etc.). It means when you want to log in to example.com, example.com…
I’ll be taking some time in the next months to talk about the newly hostile-by-default nature of technology, and how I deal with it.
JFrog finds a new supply chain attack targeting python developers using the PyPI repository
The forthcoming Senate draft of Biden's infrastructure bill—a 2,000+ page bill designed to update the United States’ roads, highways, and digital infrastructure—contains a poorly crafted provision that could create new surveillance requirements for many within the blockchain ecosystem. This could...
Discover essential Docker Security Best Practices for DevOps engineers and security professionals. Cheat sheet included for quick implementation!
This is a quick blog post about a security vulnerability (now fixed) that allowed me to make anyone like or message a profile on okcupid.com simply by getting them to click a link on my website. In doing so, I used one of the most boring web application security issues (CSRF) combined with a somewhat interesting JSON…
In the midst of an epic troll on a country-wide railway system, we discovered a new threat actor and their reusable wiper called Meteor.
Scan your iPhone for NSO Group's Pegasus malware using Mobile Verification Toolkit (MVT) by Amnesty International
About four months ago, Cloudflare launched Browser Isolation during Security Week, without ensuring that the product is accessible to blind people using screen readers. Now, four months later, this problem is still not solved. Cloudflare’s neglect of accessibility in this product raises a new barrier to employment for…
My list of “Probably Are Gonna Need It” security features for your web app – things that you should build up-front, not wait until you need them (when it’s already too late).
