451
TOTP Codes in the Terminal
The demise of Authy desktop has brought about a number of changes, probably the one of which I most appreciate is a mobile app which lets me edit codes: with 2FAS I can edit labels on codes, and I’...
New
The latest blog posts to take off on Hacker News. 536 posts.
452
Privacy Isn't Dead. Far from It
Welcome! The fact that you’re reading this means that you probably care deeply about the issue of privacy, which warms our hearts. Unfortunately, even though you care about privacy, or perhaps because you care so much about it, you may feel that there's not much you (or anyone) can really do to...
453
Thanks FedEx, this is why we keep getting phished
I've been getting a lot of those "your parcel couldn't be delivered" phishing attacks lately and if you're a human with a phone, you probably have been too. Just as a brief reminder, they look like this: These get through all the technical controls that exist at
454
iMessage with PQ3 Cryptographic Protocol
We are introducing PQ3, a groundbreaking cryptographic protocol for iMessage that advances the state of the art of end-to-end secure messaging. With compromise-resilient encryption and extensive defenses against even highly sophisticated quantum attacks, PQ3 provides protocol protections that surpass those in all…
455
A beginner's guide to constant-time cryptography (2017)
For programmers new to cryptography, there are plenty of “known unknowns” – unfamiliar terms like “elliptic curves” and “random oracles”, and unnecessarily long acronyms (“RSASSA-PKCS-v1_5”, like really?). But what really gives cryptography its reputation is the unknown unknowns. The things that catch even experienced…
456
Exodus Bitcoin Wallet: $490k swindle
Edit: There’s a short follow-up to this post: Exodus Bitcoin Wallet: Follow up. tl;dr: A Bitcoin investor was recently scammed out of 9 Bitcoin (worth around $490K) in a fake “Exodus wallet” desktop application for Linux, published in the Canonical Snap Store. This isn’t the first time, and if nothing changes, it…
457
Don't fall for the latest changes to the dangerous Kids Online Safety Act
The authors of the dangerous Kids Online Safety Act (KOSA) unveiled an amended version this week, but it’s still an unconstitutional censorship bill that continues to empower state officials to target services and online content they do not like.
458
Keep your phone number private with Signal usernames
Signal’s mission and sole focus is private communication. For years, Signal has kept your messages private, your profile information (like your name and profile photo) private, your contacts private, and your groups private – among much else. Now we’re taking that one step further, by making your...
459
Microsoft is spying on users of its AI tools
Microsoft announced that it caught Chinese, Russian, and Iranian hackers using its AI tools—presumably coding tools—to improve their hacking abilities. From their report: In collaboration with OpenAI, we are sharing threat intelligence showing detected state affiliated adversaries—tracked as Forest Blizzard, Emerald…
460
DJI – The ART of obfuscation
Study of an Android runtime (ART) hijacking mechanism for bytecode injection through a step-by-step analysis of the packer used to protect the DJI Pilot Android application.
461
462
Tiny, tamper-proof ID tag can authenticate almost anything
A cryptographic tag developed at MIT uses terahertz waves to authenticate items by recognizing the unique pattern of microscopic metal particles that are mixed into the glue that sticks the tag to the item’s surface.
463
The epidemic of fraudulent DMCA takedowns
There’s an enormous and largely invisible campaign to use fraudulent notices under the US Digital Millennium Copyright Act to remove critical articles from the internet. We don’t know who is running…
464
465
German credit agency earns millions through unlawful customer manipulation
The comapny uses manipulative designs to prevent people from obtaining a free copy of their data in accordance with law
466
Magika: AI powered fast and efficient file type identification
Magika code and model are freely available starting today in Github under the Apache2 License.
467
How deceptive design is used to compromise your privacy and how to fight back
Today, we’re releasing a new guide explaining how to compel companies employing deceptive design to dodge data protection requests—like those for data deletion or access—to comply. It encapsulates five years...
468
U.S. Internet leaked years of internal, customer emails
The Minnesota-based Internet provider U.S. Internet Corp. has a business unit called Securence , which specializes in providing filtered, secure email services to businesses, educational institutions and government agencies worldwide. But until it was notified last week, U.S. Internet was publishing more than a…
469
Reverse-engineering an encrypted IoT protocol
Extract metrics from your GoodWe solar PV system, and improve its security too
470
471
Security flaws in an SSO plugin for Caddy (2023)
We identified 10 security vulnerabilities within the caddy-security plugin for the Caddy web server that could enable a variety of high-severity attacks in web applications, including client-side code execution, OAuth replay attacks, and unauthorized access to resources. During our evaluation, Caddy was deployed as a…
472
Cloudflare defeats patent troll Sable at trial
Last Thursday, on a clear, sunny morning in Waco, Texas, a jury returned a verdict after less than two hours of deliberation. The jury found that Cloudflare did not infringe the patent asserted against Cloudflare by patent trolls Sable IP and Sable Networks.
473
Nextdoor's Heisensubscribe (and Other Dark Patterns)
Nextdoor's notification settings are hostile. This is not an isolated incident.
474
Privacy focused platform Skiff is joining Notion, Skiff to be sunset
Our co-founder Akshay talks to Skiff co-founders Andrew Milich and Jason Ginsberg about their startup's vision and journey to Notion.
475
Final Decision on Chromebook Case in Denmark
The Danish DPA issues an injunction in the Chromebook case
476
Mozilla Monitor Plus: automatically remove your personal info from data brokers
Today, Mozilla Monitor (previously called Firefox Monitor), a free service that notifies you when your email has been part of a breach, announced its new p
477
Companies embracing SMS for account logins should be blamed for SIM-swap attacks
[UPDATE Since this was posted in 2024 : Major US telcos like AT&T, T-Mobile, and Verizon have suffered a months-long breach (the ongoing Salt Typhoon attack). These companies, of course, pass along the unencrypted SMSes vital to countless log in flows, account re-activations, and password resets. They are now known to…
478
479
Over the edge: The use of design tactics to undermine browser choice
In order to be able to choose their own browser, people must be free to download it, easily set it to default and to continue using it - all without ...
480
I also hacked my car
Gonçalo MB. My personal website, projects, contacts and stuff.