421
Psychic Signatures in Java
The long-running BBC sci-fi show Doctor Who has a recurring plot device where the Doctor manages to get out of trouble by showing an identity card which is actually completely blank. Of course, thi…
New
The latest blog posts to take off on Hacker News. 642 posts.
422
Universal's Audible Watermark (2012)
This is my personal blog. The views expressed on this page are mine alone. Update, April 8, 2013: Can you hear it? Take the watermark listening test. Update, January 14, 2015: Check out the results of the listening test. A while ago, I wrote about my confusion regarding Weird Spotify Compression Artifacts. It turns…
423
424
UK Government Officials Infected with Pegasus
We confirm that in 2020 and 2021 we observed and notified the government of the United Kingdom of multiple suspected instances of Pegasus spyware infections within official UK networks, including the Prime Minister’s Office and the Foreign and Commonwealth Office.
425
CatalanGate: Spyware operation against Catalans using Pegasus and Candiru
The Citizen Lab, in collaboration with Catalan civil society groups, has identified at least 65 individuals targeted or infected with mercenary spyware, including members of the European Parliament, Catalan Presidents, legislators, jurists, and members of civil society organisations.
426
Security experts declare all Proton apps secure after security audit
All our apps (Proton Mail, Proton Drive, etc) are open source and independently audited. Anyone can inspect our software and confirm our encryption works.
427
About Emergency Access
The emergency access feature of the Bitwarden password manager enables you to designate trusted emergency contacts to access your vault in an emergency.
428
429
430
Intel deprecates SGX on Core series processors
A newer version of this document is available. Customers should click here to go to the newest version.
431
Attack campaign involving stolen OAuth tokens issued to third-party integrators
On April 12, GitHub Security began an investigation that uncovered evidence that an attacker abused stolen OAuth user tokens issued to two third-party OAuth integrators, Heroku and Travis-CI, to download data from dozens of organizations, including npm. Read on to learn more about the impact to GitHub, npm, and our…
432
Mac App Store Ransomware
This App Store app [My Metronome - Tempo Keeper] immediately asks you for money and then disables the “Quit” option so that you can never close it!
433
Elliptic Curve Cryptography: A Basic Introduction
Elliptic Curve Cryptography (ECC) is a modern public-key encryption technique famous for being smaller, faster, and more efficient than incumbents. Bitcoin, for example, uses ECC as its asymmetric cryptosystem because it is so lightweight. The mathematical entity that makes all of this possible is the elliptic curve…
434
435
Let’s Encrypt Receives the Levchin Prize for Real-World Cryptography
On April 13, 2022, the Real World Crypto steering committee presented the Max Levchin Prize for Real-World Cryptography to Let’s Encrypt. The following is the speech delivered by our Executive Director, Josh Aas, upon receiving the award. We’d like to thank our community for supporting us and invite you to join us in…
436
You’re muted – or are you? Videoconferencing apps may listen when mic is off
Not only did researchers find that the apps gather audio data while "mute" is activated; they could identify activities picked up when microphones weren't believed to be on, such as eating, playing music, typing and cleaning.
437
Git security vulnerability announced
Upgrade your local installation of Git, especially if you are using Git for Windows, or you use Git on a multi-user machine.
438
RaidForums gets raided, alleged admin arrested
The U.S. Department of Justice (DOJ) said today it seized the website and user database for RaidForums , an extremely popular English-language cybercrime forum that sold access to more than 10 billion consumer records stolen in some of the world’s largest data breaches since 2015. The DOJ also charged the alleged…
439
WireGuard multihop available in the Mullvad app
To further increase your privacy and make your traffic harder to analyze, you can now route all your traffic through two servers instead of just one, directly in our desktop app, version 2022.1 and newer.
440
The complete guide to protecting your APIs with OAuth2
OAuth2 is one of the most popular specifications for API authentication today, though wrapping your head around it can be a challenge.
441
Mullvad Privacy Companion is now open source
Mullvad Privacy Companion, a free Firefox extension helping to improve your online privacy – is now open source.
442
Automate Public Certificates Lifecycle Management via RFC 8555 (ACME)
ACME API lets our users automate their Public Certificate Lifecycle Management.
443
444
Node.js packages don't deserve trust
Another week, another npm supply chain attack . Yikes! People on hacker news are wringing their hands about what should be done. The problem seems dire.
445
An Ode to Apple’s Hide My Email
Apple's Hide My Email feature is one of the most under-rated privacy launches of the past year, and here's why.
446
OpenSSH 9.0
OpenSSH release notes
447
The 0.5 MB of nothing in all Apple Music files (2020)
Six percentage of each music files you’ve bought from Apple Music (iTunes Store) contain, literally, nothing. Why is Apple padding their music with zero-bytes?
448
Apple neglects to patch two zero-day, wild vulnerabilities for Big Sur, Catalina
Apple has chosen to leave Big Sur and Catalina (around 35 to 40 percent of all Macs) in danger of actively exploited vulnerabilities that have only been patched for macOS Monterey.
449
Tailscale’s human-scale networks are still controlled by Google and Microsoft
I’m not sure if they realize it yet, but Tailscale seems to work extremely well for polycules. Each user can have their own single-user Tailnet and explicitly share specific machines with other people. Both parties have to consent to sharing a device; either party can revoke this consent. The device owner can further…
450
Some interesting malware I found
Update 6/28/22: a reader reached out to me and let me know that Malwarebytes now detects and removes this malware as Adware.Choprex and OSX.Generic.Suspicious - so if you're reading this because you are affected, go download Malwarebytes and run a full scan. Thanks Yegor!