The latest blog posts to take off on Hacker News. 617 posts.
A shocking number of organizations — including banks and healthcare providers — are leaking private and sensitive information from their public Salesforce Community websites, KrebsOnSecurity has learned. The data exposures all stem from a misconfiguration in Salesforce Community that allows an unauthenticated user to…
The California Court of Appeal has held that a geofence warrant seeking information on all devices located within several densely-populated areas in Los Angeles violated the Fourth Amendment. This is the first time an appellate court in the United States has reviewed a geofence warrant. The case is...
We implemented OAuth for the 50 most popular APIs. TL;DR: It is still a mess.
Nitrokey security research reveals that smartphones with Qualcomm chips secretly send device data to Qualcomm without user consent. NitroPhone is not affected.
Christiaan Brand, Group Product Manager We are excited to announce an update to Google Authenticator , across both iOS and Android, which a...
The members of the Global Encryption Coalition’s Steering Committee issued a statement on the EU-US collaboration against encryption.
In an open letter, seven secure messaging apps—including Signal and WhatsApp—point out that the UK’s Online Safety Bill could destroy end-to-end encryption: As currently drafted, the Bill could break end-to-end encryption,opening the door to routine, general and indiscriminate surveillance of personal messages of…
Let me tell you a story about how Windows users are deleting files from their installation and as a consequence end up in tears. Background The real and actual curl tool has been shipped as part of Windows 10 and Windows 11 for many years already. It is called curl.exe and is located in the … Continue reading deleting…
Devices based on the i.MX8 or i.MX8M (such as the Librem phone or MNT Reform) have received popular coverage recently. The number of firmware blobs involved in the bringup of these devices is often a point of discussion. At times, people have considered whether some of these blobs could be replaced with libre…
This weekend I went to BSides SF 2023 and had a blast. I went to some really interesting talks (including an excellent one about adversarial machine learning), but mostly I spent my time solving CTF hacking challenges. And this time, I did it with the help of GPT-4, the
In the last 30 days, I have been closely monitoring the Mac App Store and have made a disturbing discovery. In the midst of the OpenAI…
Cloudflare Zaraz now can also help you with gathering and managing consent. With this new tool, you can easily collect user’s consent preferences on your website, using a consent modal, and apply your consent policy on third-party tools you load via Cloudflare Zaraz
Earlier this week a letter from an activist imprisoned in France was posted to the internet. Contained within Ivan Alococo’s dispatch from the Villepinte prison
13 vulnerabilities in GarminOS and the MonkeyC VM, 9 with CVEs, that let Connect IQ apps escape the VM and bypass permissions on 100+ Garmin watches.
In a free society, people should not have their private correspondence constantly examined. U.S. lawmakers, we would hope, understand that individuals have the right to a private conversation without the government looking over their shoulder. So it’s dismaying to see a group of U.S. Senators...
Announcing a new, more secure way to publish to PyPI
On April 18 at least six police officers from the National Operations Department (NOA) of the Swedish Police visited the Mullvad VPN office in Gothenburg with a search warrant. They intended to seize computers with customer data.
How we know you "have' the invention
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
KeePassXC Password Manager
This is a story about a security vulnerability in Google that allowed me to run arbitrary code on the computers of 50+ Google employees. Although Google initially considered my finding a serious security incident, later on, it changed its mind and stated that my finding is not, in fact, a vulnerability, but the…
ThreatDown detects new macOS malware like MacStealer that targets Keychain databases and steals sensitive user information. Talk to our security team.
Activity around building sophisticated applications on top of LLMs (Large Language Models) such as GPT-3/4/ChatGPT/etc is growing like wildfire right now. Many of these applications are potentially vulnerable to prompt …
Supacharging Supabase Auth with Sign in with Apple on iOS, Single-Sign-On support with SAML 2.0, and PKCE for server-side rendering and mobile auth.
WhatsApp has launched a new cryptographic security feature to automatically verify a secured connection based on key transparency. The feature requires no additional actions or steps from users an…
Updated Aug. 28, 2024. Take back your privacy Firefox is rolling out Total Cookie Protection by default to more Firefox users worldwide, making Firefox the
The FBI is warning people against using public phone-charging stations, worrying that the combination power-data port can be used to inject malware onto the devices: Avoid using free charging stations in airports, hotels, or shopping centers. Bad actors have figured out ways to use public USB ports to introduce…
