3391
Tracing SSL/TLS connections using eBPF
Pixie Blog
New
The latest blog posts to take off on Hacker News. 8,771 posts.
3392
The ownership and future of Mullvad VPN
This article is by our founders and sole shareholders, Daniel Berntsson and Fredrik Strömberg. Mullvad VPN is here to stay, and we are not interested in ever selling it.
3393
Weaponizing Middleboxes for TCP Reflected Amplification
Censors pose a threat to the entire Internet.
3394
Why Authorization Is Hard
There's a fundamental tension in authorization. Is it business logic or authorization logic? Should it be in the app, or separate? Let’s talk about what makes a
3395
Automatic cipher suite ordering in Go’s crypto/tls
Go 1.17 is making TLS configuration easier and safer by automating TLS cipher suite preference ordering.
3396
OpenBSD's Pledge and Unveil from Python
Years ago, OpenBSD gained two new security system calls, pledge(2) (originally tame(2) ) and unveil . In both, an application surrenders capabilities at run-time. The idea is to perform initialization like usual, then drop capabilities before handling untrusted input, limiting unwanted side effects. This feature is…
3397
3398
"Secret" Agent Exposes Azure Customers to Unauthorized Code Execution
Wiz Research recently discovered a series of alarming vulnerabilities that highlight the supply chain risk of open source code, particularly for customers of cloud computing services.
3399
(L)Awful Interception
One of democracy's foundations is the fact that all human beings have certain inalienable rights and freedoms. Suspended by trust and shared values. Today, trust and shared values are being replaced by “control and surveillance”.
3400
NSO Group iMessage Zero-Click Exploit Captured in the Wild
While analyzing the phone of a Saudi activist infected with NSO Group’s Pegasus spyware, we discovered a zero-day zero-click exploit against iMessage. The exploit, which we call FORCEDENTRY, targets Apple’s image rendering library, and was effective against Apple iOS, MacOS and WatchOS devices.
3401
Disclosing E2EE vulnerability in multiple Matrix clients
Matrix, the open protocol for secure decentralised communications
3402
We found a phone with pre-installed malware via the Lifeline Assistance program
We discovered yet another phone model with pre-installed malware provided from the Lifeline Assistance program via Assurance Wireless by Virgin Mobile.
3403
Cross-Account Container Takeover in Azure Container Instances
Affecting Azure Container Instances, Azurescape is the first known cross-account container takeover in the public cloud.
3404
How We Proved the Eth2 Deposit Contract Is Free of Runtime Errors
Consensys is a blockchain software company building the tools, infrastructure and research that power the new Era of Decentralized Finance, for a more secure and open economy
3405
The Privacy Lesson of 9/11: Mass Surveillance Is Not the Way Forward
Congress must ensure that the next generation of Americans is able to speak and associate freely, without fear of surveillance.
3406
HAProxy vulnerability enables HTTP request smuggling attacks
We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.
3407
Disinformation-for-hire in Kenya
Mozilla Fellows Odanga Madung and Brian Obilo reveal that Kenyan journalists, judges, and other members of civil society are facing coordinated disinformation campaigns on Twitter — and the site is doing very little to stop it.
3408
Nevada cops use civil forfeiture to steal a veterans life savings
Last February, while driving down a Nevada highway on the way to visit his daughters, Stephen Lara was robbed in plain sight. But his assailants […]
3409
Abusing the Chromium Devtools Scope Pane
tl;dr — Abusing the Chromium Devtools Scope Pane to track debugging of specific javascript functions
3410
Delays aren’t good enough – Apple must abandon its surveillance plans
Apple announced today that it would “take additional time over the coming months to collect input and make improvements” to a program that will weaken privacy and security on iPhones and other products. EFF is pleased Apple is now listening to the concerns of customers, researchers, civil liberties...
3411
Google Chrome to remove detailed cookie and site data controls
A month ago I ran into an obscure Google Chrome bug on macOS that caused the "All cookies and site data" page in Chrome settings ( chrome://settings/siteData ) to load very slowly. You can see this page if you open Preferences, select "Privacy and security", "Cookies and other site data", and then "See all cookies and…
3412
RSA chief believed cryptographers’ warnings on Dual EC DRBG lacked merit (2014)
"When, last September, it became possible that concerns raised in 2007 might have merit as part of a strategy of exploitation, NIST as the...
3413
3414
3415
Gift card gang extracts cash from 100k inboxes daily
Some of the most successful and lucrative online scams employ a “low-and-slow” approach — avoiding detection or interference from researchers and law enforcement agencies by stealing small bits of cash from many people over an extended period. Here’s the story of a cybercrime group that compromises up to 100,000 email…
3416
NitroPhone – Pixel 4a phone with GrapheneOS
Nitrokey launches the NitroPhone, the most secure Android smartphone on the planet. Based on Pixel 6 and GrapheneOS with no Google, no backdoors and hardware security.
3417
Mozilla VPN Completes Independent Security Audit by Cure53
Today, Mozilla published an independent security audit of its Mozilla VPN, which provides encryption and device-level protection of your connection and inf
3418
Improving Git protocol security on GitHub
We’re changing which keys are supported in SSH and removing unencrypted Git protocol. If you’re an SSH user, read on for the details and timeline.
3419
YouTube starts to require a credit card or ID to verify the age in EU (2020)
We’ve taken important steps to make YouTube a safer place for families. We’re announcing a continuation of these efforts.
3420
How I re–over-engineered my home network for privacy and security
How I used Docker Compose, Ansible, and Caddy to re-over-engineer my network setup for easier maintenance, treating my Raspberry Pi like cattle, not a pet.