3511
The new ProtonMail has passed its independent security audit
Before we released the new Proton Mail, security experts conducted an independent audit of its open source code. You can read their report.
New
The latest blog posts to take off on Hacker News. 8,771 posts.
3512
Hooking Candiru: Another mercenary spyware vendor comes into focus
Candiru is a secretive Israel-based company that sells spyware exclusively to governments. Using Internet scanning, we identified more than 750 websites linked to Candiru’s spyware infrastructure. We found many domains masquerading as advocacy organizations such as Amnesty International, the Black Lives Matter…
3513
Mitmproxy 7.0
We’re delighted to announce the release of mitmproxy 7, a free and open source interactive HTTPS proxy. This release is all about our new proxy core, which bring substantial improvements across the board and represents a massive milestone for the project.
3514
Remote code execution in cdnjs of Cloudflare
Preface (日本語版も公開されています。) Cloudflare, which runs cdnjs, is running a “Vulnerability Disclosure Program” on HackerOne, which allows hackers to perform vulnerability assessments. This article describes vulnerabilities reported through this program and published with the permission of the Cloudflare security team. So this…
3515
Online ID / age verification: the death of online search
Neil note: I’ve published this with the hope that others familiar with what this could entail will give feedback. As such, what you read now might not be the final version. If I make material changes, I’ll indicate them.
3516
Analyzing the legal implications of GitHub Copilot
Explore the potential legal challenges GitHub Copilot faces regarding copyright infringement and license compliance of its code suggestions.
3517
Building a Curve25519 Hardware Accelerator
Note: this post uses a $\LaTeX$ plugin to render math symbols. It may require a desktop browser for the full experience…
3518
CVE-2021-22555: Turning \x00\x00 into 10000$
This project hosts security advisories and their accompanying proof-of-concepts related to research conducted at Google which impact non-Google owned code.
3519
Increasing HTTPS Adoption
When a browser connects to websites over HTTPS (vs. HTTP), eavesdroppers and attackers on the network can't intercept or alter the data that...
3520
EU legislation allows emails, messages and other communications to be scanned
On 6 July, the European Parliament adopted in a final vote the derogation to the main piece of EU legislation protecting privacy, the ePrivacy Directive, to allow Big Tech to scan your emails, messages and other online communications.
3521
Firefox 90 supports Fetch Metadata Request Headers
We are pleased to announce that Firefox 90 will support Fetch Metadata Request Headers which allows web applications to protect themselves and their users against various cross-origin threats like ...
3522
Cybersecurity and the curse of binary thinking
Working in information/cybersecurity and technology risk is a fascinating and challenging career, as I’ve covered here. There is, mostly, a great spirit of sharing and collaboration among security professionals. However, I’ve observed one disturbing and growing trend in the past few years that might be characterized…
3523
3524
How I accidentally took down GitHub Actions (2019)
Last December, I was invited to a private bug bounty program to test a beta version of GitHub Actions. GitHub Actions is a workflow automation tool integrated with GitHub. One common use case of GitHub Actions is for CI builds – a project can fairly easily start up a Docker container every time they push a commit…
3525
Arti, a pure-Rust Tor implementation
Greetings! Today I'm happy to announce a new era in Tor implementation. Over the past year or so, we've been working on "Arti", a project to rewrite Tor in Rust. Thanks to funding from Zcash Open Major Grants (ZOMG), we can finally put the Arti project up in our priorities list, and devote more time to it. Below I'll…
3526
3527
Mozilla rolls out DoH to Canadian users of Firefox
CIRA Joins Firefox’s Trusted Recursive Resolver Program In a few weeks, Firefox will start the by-default rollout of DNS over HTTPS (or DoH for short) to
3528
The cost of the “new way to message on instagram” (2020)
If you are on Instagram, you have been probably bombarded by Instagram Stories and notifications about new features like emojis, chat themes, selfie stickers, and “cross-platform messaging” that will allow you to exchange direct messages with, and search for, friends who are on Facebook. But the...
3529
Microsoft Issues Emergency Patch for Windows Flaw
Microsoft on Tuesday issued an emergency software update to quash a security bug that’s been dubbed “ PrintNightmare ,” a critical vulnerability in all supported versions of Windows that is actively being exploited. The fix comes a week ahead of Microsoft’s normal monthly Patch Tuesday release, and follows the…
3530
Npm Audit: broken by design?
Found 99 vulnerabilities (84 moderately irrelevant, 15 highly irrelevant)
3531
Apple's “iCloud Private Relay” broke risk based authentication
ZITADEL is the identity infrastructure platform that is built for developers and works for all users and applications.
3532
macOS extensions are moving away from the kernel
Management of kernel extensions has changed significantly in Big Sur and later. This overview for users contrasts kexts with user-level extensions which are replacing them.
3533
European Parliament approves mass surveillance of private communication
Today, the European Parliament approved the ePrivacy Derogation, allowing providers of e-mail and messaging services to automatically search all personal messages of each citizen for presumed suspect content and report suspected cases to the police. The European Pirates Delegation in the Greens/EFA
3534
Defeating Cookie Banners
How Transcend solved the core technical problem of user tracking consent and built an alternative to pop-up cookie banners.
3535
Dumping and extracting the SpaceX Starlink user terminal firmware
COSIC - Dumping and extracting the SpaceX Starlink User Terminal firmware ( )
3536
3537
Writing a firmware-only keylogger
In the previous blog post, I looked at the EC firmware in my laptop. This time I will look into the WiFi firmware of the same laptop.
3538
3539
3540
Bypassing macOS TCC user privacy protections by accident and design
TCC is meant to protect user data from unauthorized access, but design flaws mean users and malware can bypass TCC, even by accident.