511
Mullvad VPN | Privacy is a universal right
Free the internet from mass surveillance and censorship. Fight for privacy with Mullvad VPN and Mullvad Browser.
New
The latest blog posts to take off on Hacker News. 678 posts.
512
Latest Mozilla VPN features
It’s been less than a year since we launched Mozilla VPN, our fast and easy-to-use Virtual Private Network service brought to you by a trusted name in on
513
Google is testing its new ad targeting tech in millions of browsers
Update, April 9, 2021 : We've launched Am I FLoCed, a new site that will tell you whether your Chrome browser has been turned into a guinea pig for Federated Learning of Cohorts or FLoC, Google’s latest targeted advertising experiment. Today, Google launched an “origin trial” of Federated Learning...
514
What does a PGP signature on a Git commit prove?
With git, a cryptographic signature on a commit provides strong integrity guarantees of the entire history of that branch going backwards...
515
Whistleblower: Ubiquiti Breach “Catastrophic”
Last year, I posted a series of articles about a purported “breach” at Ubiquiti. My sole source for that reporting was the person who has since been indicted by federal prosecutors for his alleged wrongdoing – which includes providing false information to the press.
516
VPN over SSH? The Socks Proxy
Some resources on the internet might be only accessible from clients with particular IP addresses. For example, suppose you want to…
517
A new Cloudflare Web Application Firewall
Today we are announcing a new Cloudflare Web Application Firewall for all Cloudflare paid zone customers.
518
Netmask NPM package, used by 270k+ projects, vulnerable to octal input data
The following research outlines a vulnerability discovered in netmask npm package that is currently used by 278,722+ other projects. The vulnerability has been present for 9 years. Since this package is so incredibly widespread, I would suggest every nodejs developer to check their package.jsons to see if they use…
519
520
No, I did not hack your MS Exchange server
New data suggests someone has compromised more than 21,000 Microsoft Exchange Server email systems worldwide and infected them with malware that invokes both KrebsOnSecurity and Yours Truly by name.
521
OAuth 2.0 Authentication Vulnerabilities
While browsing the web, you've almost certainly come across sites that let you log in using your social media account. The chances are that this feature is ...
522
Apt Encounters of the Third Kind
A few weeks ago an ordinary security assessment turned into an incident response whirlwind. It was definitely a first for me, and I was kindly granted permission to outline the events in this blog post. This investigation started scary but turned out be quite fun, and I hope reading it will be informative to you too…
523
524
OAuth Attack Vectors
Intro The OAuth2 authorization protocol has been under fire for the past ten years. You've probably already heard about plenty of "return_uri" tricks, token leakages, CSRF-style attacks on clients, an
525
The Python Package Index is now a GitHub secret scanning integrator
GitHub and the Python Package Index (PyPI) are collaborating to help protect you from leaked PyPI API tokens. From today, GitHub will scan every commit to a public repository for…
526
Firefox 87 introduces SmartBlock for Private Browsing
Today, with the launch of Firefox 87, we are excited to introduce SmartBlock, a new intelligent tracker blocking mechanism for Firefox Private Browsing and Strict Mode. SmartBlock ensures that strong ...
527
When Myanmar needs ProtonVPN the most, Apple stands in the way of human rights
Myanmar citizens have used Proton tools to communicate securely and access the truth. But Apple has blocked us from sending out important app updates.
528
Pasco County’s Sheriff Must End Its Targeted Child Harassment Program
In September 2020, the Tampa Bay Times revealed a destructive “data-driven” policing program run by the Pasco County, Florida Sheriff's Office. The program is misleadingly called “Intelligence-Led Policing” (ILP), but in reality, it's nothing more than targeted child harassment by police. Young...
529
Chrome’s address bar will use https:// by default
Starting in version 90, Chrome’s address bar will use https:// by default, improving privacy and even loading speed for users visiting webs...
530
64-Bit Linux Return-Oriented Programming
Update : Dongli Zhang reports that newer Linux versions organize the stack differently . The code below will need to be modified accordingly.
531
Backblaze Privacy Update: Third-Party Tracking
Read this post for a privacy update regarding third-party tracking code on our website.
532
The S in IoT is for Security
Purism makes premium phones, laptops, mini PCs and servers running free software on PureOS. Purism products respect people's privacy and freedom while protecting their security.
533
Firefox 87 trims HTTP Referrers by default to protect user privacy
We are pleased to announce that Firefox 87 will introduce a stricter, more privacy-preserving default Referrer Policy. From now on, by default, Firefox will trim path and query string ...
534
The world needs a software bill of materials
“Sunburst” was the most sophisticated hack the world has ever seen. One of the most urgent lessons so far learned from the attack: we need…
535
Cryptography behind the top cryptocurrencies
This table is based on research at Nash for work expanding our MPC protocol to secure wallets on new blockchains. We took a snapshot of rankings by market cap in early February 2021. In summary, 74 coins use ECDSA and the secp256k1 curve, including Bitcoin, Ethereum, and 48 ERC20 tokens. 10 coins use EdDSA and…
536
Safari is now probably the influential wild card browser for user privacy
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
537
We found and fixed a rare race condition in our session handling
On March 8, out of an abundance of caution, we logged all users out of GitHub.com. In this post we share technical details of the vulnerability and steps we're taking to ensure it doesn't happen again.
538
Reverse Engineering a Docker Image
This started with a consulting snafu: Government organisation A got government organisation B to develop a web application. Government organisation B subcontracted part of the work to somebody. Hosting and maintenance of the project was later contracted out to a private-sector company C. Company C discovered that the…
539
Do not use redirection characters in your shell prompt
Over the years of troubleshooting performance problems in the Unix/Linux world, I have seen multiple cases where a regularly used command line tool in a customer server just stops working for some reason. The tool just returns immediately, doing absolutely nothing. No output printed, no coredumps and the exit code is…
540
Fintech Giant Fiserv Used Unclaimed Domain
If you sell Web-based software for a living and ship code that references an unregistered domain name, you are asking for trouble. But when the same mistake is made by a Fortune 500 company, the results can range from costly to disastrous. Here’s the story of one such goof committed by Fiserv [ NASDAQ:FISV ], a $15…