The latest blog posts to take off on Hacker News. 536 posts.
Analysts at Zone.eu, one the leading domain registrars and web hosting providers in Europe, have observed a vulnerability affecting the global e-mail ecosystem, stemming from unaddressed warnings in the DomainKeys Identified Mail (DKIM) standard that puts billions of users in risk. This is not an issue in a particular…
Slack's Terms and Policies, including privacy, Terms of Service, API terms, security, and more.
Android rolls out theft protection features to safeguard your data before, during and after a theft incident.
Apple and Google have teamed up to deliver support for unwanted Bluetooth tracking alerts in iOS and Android.
Last week, the United States joined the U.K. and Australia in sanctioning and charging a Russian man named Dmitry Yuryevich Khoroshev as the leader of the infamous LockBit ransomware group. LockBit’s leader “ LockBitSupp ” claims the feds named the wrong guy, saying the charges don’t explain how they connected him to…
Conventionally, email addresses published on webpages may be protected from email-harvesting spambots via various HTML, CSS & JS-based techniques. This alternative technique is SVG-based.
This blog post is a part of a series about our research toward the next generation of the SecureDrop whistleblowing …
Even if you have encrypted your traffic with a VPN (or the Tor Network), advanced traffic analysis is a growing threat against your privacy. Therefore, we now introduce DAITA.
We discovered a fundamental design problem in VPNs and we're calling it TunnelVision. This problem lets someone see what you're doing online, even if you think you're safely using a VPN.
A simple XSS in Google application
With this blog post, we'll introduce the PiFex, a basic companion board for the Raspberry Pi designed to teach users the basics of hardware hacking and embedded protocols. We will then demonstrate how to use the PiFex to access a JTAG tap on an undocumented SSD, allowing memory reads and GDB access to the SSD CPU.
ChaCha8Rand is a new cryptographically secure pseudorandom number generator used in Go 1.22.
This post guides through decompiling Hyper-V Manager to rebuild it from source, aiming to assess its value for potential open-sourcing. It explores manual and automated decompilation processes, including troubleshooting and enhancing the tool, advocating for community-led improvements to this widely-used but neglected…
By Robin Bender Ginn, Executive Director, OpenJS Foundation; and Omkhar Arasaratnam, General Manager, Open Source Security Foundation
LLMs have the potential to revolutionise our field of healthcare, but the fear and reality of hallucinations prevent adoption in most applications.
About two years ago, I switched teams at Google to focus on fully homomorphic encryption (abbreviated FHE, or sometimes HE). Since then I’ve got to work on a lot of interesting projects, learning along the way about post-quantum cryptography, compiler design, and the ins and outs of fully homomorphic encryption. If…
On the one hand they are easy to explain, they are just numbers that have no factors other than one and themselves, but on the other hand they contain endless complexity. They show up in numerous places, ranging from mathematical concepts and conjectures to interesting looking visualizations and cryptography…
We were recently made aware of multiple potential DNS leaks on Android. They stem from bugs in Android itself, and only affect certain apps.
Information on a security incident involving Dropbox Sign.
If you publicly host large data files on AWS S3 & pay for transfer costs, you may be vulnerable to a “Denial of Wallet” amplification…
Read about the challenges, pitfalls and misconceptions we faced while developing our passkey-first authentication solution and passkey intelligence.
Teenagers' hands are the devil's playthings.
Imagine you create an empty, private AWS S3 bucket in a region of your preference. What will your AWS bill be the next morning?
A USPS smishing attempt prompts the Akamai SIG to unearth shocking statistics: Illegitimate USPS domains see as much traffic as the legitimate USPS domain.
I had another instance of my Apple ID mysteriously being locked. First, my iPhone wanted me to enter the password again, which I thought was the “normal” thing it has done every few months, almost since I got it. But after doing so it said that my account was locked.
Illegal drug transactions facilitated through Georgia's employee portal
Firstyear's blog
The amazingly scary xz sshd backdoor, Author: Bojan Zdrnja
Privacy Not Included was launched in 2017 to help you understand the privacy risks of tech products that connect to the internet. We are continuing that work in the form of Product Reviews at our magazine Nothing Personal, where our privacy experts do hours of hands-on testing and research on the most popular consumer…
