451
Twitter Direct Message Caching and Firefox
Distinguished engineer Martin Thomson explains how this problem occurred, the implications for people who might be affected, and how problems of this nature might be avoided in future. To get ...
New
The latest blog posts to take off on Hacker News. 612 posts.
452
How we recovered $300k of Bitcoin
Story time! Around twenty years ago, I was working as a reverse-engineer and cryptanalyst for AccessData while getting my Physics degree at BYU. It was the late 90s and early 2000s. The US governme…
453
Temporarily rolling back SameSite Cookie Changes
UPDATE 5/28: We are going to resume the rollout with the stable release of Chrome M84. More details . With the stable release of Chrome 8...
454
Does Zoom use end-to-end encryption?
TL;DR: It’s complicated. Yesterday Zoom (the videoconferencing company, not the defunct telecom) put out a clarification post describing their encryption practices. This is a nice example of …
455
Zoom rolled their own encryption scheme, transmit keys through servers in China
This report examines the encryption that protects meetings in Zoom and finds that they have made their own encryption scheme and has significant weaknesses.
456
Unauthorized access to cameras in Safari on macOS and iOS
A vulnerability in Safari allowed hackers to access the iPhone and Macbook cameras. (CVE-2020-3852, CVE-2020-3864, CVE-2020-3865, CVE-2020-3885, CVE-2020-3887 & CVE-2020-9784)
457
‘War Dialing’ tool exposes Zoom’s password problems
As the Coronavirus pandemic continues to force people to work from home, countless companies are now holding daily meetings using videoconferencing services from Zoom . But without the protection of a password, there’s a decent chance your next Zoom meeting could be “Zoom bombed” — attended or disrupted by someone who…
458
The facts around Zoom and encryption for meetings/webinars
Learn more about how to use each Zoom product to connect with coworkers, customers, businesses, and more with insights and best practices.
459
460
The EARN IT Act Violates the US Constitution
Since senators introduced the EARN IT Act (S. 3398) in early March, EFF has called attention to the many ways in which the bill would be a disaster for Internet users’ free speech and security. We’ve explained how the EARN IT Act could be used to drastically undermine encryption. Although the bill...
461
How to SSH Properly
This post explains security best practices to use SSH properly and securely
462
1.1.1.1 for Families
Introducing 1.1.1.1 for Families — the easiest way to add a layer of protection to your home network and protect it from malware and adult content.
463
464
465
The EARN IT Bill Is the Government’s Plan to Scan Every Message Online
Update 10/1/2020: The EARN IT bill has been amended since this blog post was published. We still oppose the bill.Imagine an Internet where the law required every message sent to be read by government-approved scanning software. Companies that handle such messages wouldn’t be allowed to securely...
466
Zoom’s Use of Facebook’s SDK in iOS Client
Learn more about how to use each Zoom product to connect with coworkers, customers, businesses, and more with insights and best practices.
467
Zoom needs to clean up its privacy act
[21 April 2020—Hundreds of people are arriving here from this tweet, which calls me a “Harvard researcher” and suggests that this post and the three that follow are about “the ful…
468
Exceptional failure: breaking the STM32F1 read-out protection
The firmware of microcontrollers usually contains valuable data such as intellectual property and, in some cases, even cryptographic material. In order to protect the confidentiality of these assets,
469
Speeding up Linux disk encryption
Encrypting data at rest is vital for Cloudflare with more than 200 data centres across the world. In this post, we will investigate the performance of disk encryption on Linux and explain how we made it at least two times faster for ourselves and our customers!
470
WebKit will delete all local storage after 7 days
Apple will delete your data if you don’t use an app for seven days. This effectively kills offline web apps.
471
Little Snitch and the deprecation of kernel extensions
You probably came here because your Mac showed a message telling you that software from “Objective Development Software GmbH” (Little Snitch) loaded a system extension that will no longer be compatible with a future version of macOS and that you…
472
Full third-party cookie blocking and more
This blog post covers several enhancements to Intelligent Tracking Prevention (ITP) in iOS and iPadOS 13.4 and Safari 13.1 on macOS to address our latest discoveries in the industry around tracking.
473
Using Zoom? Here are the privacy issues you need to be aware of
If you’re using Zoom while working from home, you should be aware of Zoom's privacy policies, including its “attention tracking” tool.
474
End-to-end encryption in the browser
Excalidraw introduces browser-based end-to-end encryption using Web Cryptography APIs for secure, private drawing storage.
475
Secure by Design
I really like Secure by Design. The key idea is that there is a big overlap between secure code and good software design. Code that is strict, clear and focused will be easier to reason about, and …
476
477
478
479
Google Shares, Monetizes, and Exploits Your Data Without 'Selling' It
"Google will never sell any personal information to third parties; and you get to decide how your information is used." - Sundar Pichai Sound familiar? Although big tech companies like Google keep the lights on by harvesting and monetizing your personal data, they can be quick to mince words and deny the strawman…
480
Building a backdoor with Node.js
A backdoor in our code that can perform OS injection is a considerable threat.