361
Typed Programs Don't Leak Data
Mistral Contrastin's thought bubble, blog, and personal revelations.
New
The latest blog posts to take off on Hacker News. 678 posts.
362
Privacy for Students: Surveillance Self-Defense
Schools are increasingly adopting surveillance technology to spy on students while they’re at school, at home, or even on their social media. The companies that make these surveillance products and services advertise them to schools as a way to keep students safe–but there’s no evidence so far that they actually...
363
Mimicking a device is becoming almost impossible
From User-Agent tricks to canvas hashes, see how modern device detection—Picasso, fonts, emojis, touch—makes spoofing fail. Learn how to blend in safely.
364
AWS acquires Wickr
We’re excited to share that AWS has acquired Wickr, an innovative company that has developed the industry’s most secure, end-to-end encrypted, communication technology. With Wickr, customers and partners benefit from advanced security features not available with traditional communications services – across messaging…
365
Rally, a novel privacy-first data sharing platform
Mozilla teams up with Princeton University researchers to enable crowdsourced science for public good; collaborates with research groups at Princeton, Stan
366
367
International coalition calls for action against surveillance-based advertising
Groups in Europe and U.S. ask for action to end practices that threaten citizens’ rights.
368
I made 50k calls to explore the telephone network
Post describing my research wardialing Finnish freephones.
369
The Most Dangerous Censorship
Invisible but present, and far from the eyes of the public
370
What's Inside the EU Green Pass QR Code?
Here in Austria, you need to be either vaccinated against, tested negative for, or have recovered from COVID-19 to go to the pub (or pretty much everywhere) right now. If you don't want to carry around your paperwork proving one of those, you can alternatively show your Green Pass QR code to be let in.
371
A reference counting bug which leads to local privilege escalation in io_uring
Hello, I’m Shiga( @Ga_ryo_ ), a security engineer at Flatt Security Inc.
372
AuthZ: Scalable permissions system
How we built an authorization system based on Google Zanzibar
373
SLSA, an End-to-End Framework for Supply Chain Integrity
Posted Kim Lewandowski, Google Open Source Security Team & Mark Lodato, Binary Authorization for Borg Team Supply chain integrity attacks—u...
374
How I Found a Vulnerability to Hack iCloud Accounts and How Apple Reacted to It
This article is about how I found a vulnerability on Apple forgot password endpoint that allowed me to takeover an iCloud account. The vulnerability is completely patched by Apple security team and it no longer works. Apple Security Team rewarded me $18,000 USD as a part of their bounty program but I refused to…
375
An unwanted update to your Google Account
Google sent me an email informing me that they will change the country associated with my account in 30 days. I wanted to know why.
376
Spectre mitigations murder userspace performance
Robert O'Callahan. Christian. Kiwi. Software guy. All content human-authored unless otherwise noted.
377
Brave, the false sensation of privacy
ebin.city is a short 4-character .city domain available for buy. Listed at $100 — secure it before someone else does.
378
Representing SHA-256 Hashes as Avatars
How to turn 256 bits of entropy into a beautiful, avatar-friendly circular SVG: the Hashvatar.
379
How does one get hired by a top cybercrime gang?
The U.S. Department of Justice (DOJ) last week announced the arrest of a 55-year-old Latvian woman who’s alleged to have worked as a programmer for Trickbot , a malware-as-a-service platform responsible for infecting millions of computers and seeding many of those systems with ransomware.
380
I Read the Entire Cybersecurity Executive Order; Here's What You Need to Know
Cybersecurity is hard enough. Doing it across federal agencies is a mammoth task.
381
DraftKings: a $21B SPAC betting it can hide its black market operations
Initial Disclosure: After extensive research, we have taken a short position in shares of DraftKings, Inc. This report represents our opinion, and we encourage every reader to do their own due diligence. Please see our full disclaimer at the bottom of the report.
382
Supporting Let’s Encrypt, the nonprofit making HTTPS free for all
Today, we’re thrilled to be partnering with Let’s Encrypt, the world’s largest certificate authority.
383
Building a WebAuthn Click Farm
How I built a click farm to “bypass” Cloudflare’s CAPTCHA killer with some cheap USB security keys, an Arduino, and a bit of python.
384
Infosec Core Competencies
An incomplete list of (technical) things just about anybody working in Information Security would benefit from knowing.
385
How to handle secrets on the command line
How to keep secret credentials safe on the command line.
386
A few thoughts on Fuchsia security
I want to say a few words about my current adventure. I joined the Fuchsia project at its inception and worked on the daunting task of buil...
387
388
Privacy Analysis of FLoC
In a previous post, I wrote about a new set of technologies “Privacy Preserving Advertising”, which are intended to allow for advertising without compr
389
Privilege escalation with polkit: How to get root on Linux with a seven-year-ol
polkit is a system service installed by default on many Linux distributions. It’s used by systemd, so any Linux distribution that uses systemd also uses polkit.
390
No general method to detect fraud
The parts of a convincing deception