571
Web hacking techniques of 2021
Welcome to the Top 10 (new) Web Hacking Techniques of 2021, the latest iteration of our annual community-powered effort to identify the most significant web security research released in the last year
New
The latest blog posts to take off on Hacker News. 642 posts.
572
BeyondCorp is dead, long live BeyondCorp
No organization has fully implemented zero trust architecture. Many advocates, including the US government, overlook devices as a key BeyondCorp component.
573
Breaking 256-Bit Elliptic Curve Encryption with a Quantum Computer
Researchers have calculated the quantum computer size necessary to break 256-bit elliptic curve public-key cryptography: Finally, we calculate the number of physical qubits required to break the 256-bit elliptic curve encryption of keys in the Bitcoin network within the small available time frame in which it would…
574
The Plausibly Deniable DataBase (PDDB)
The problem with building a device that is good at keeping secrets is that it turns users into the weakest link.
575
IRS to ditch biometric requirement for online access
The Internal Revenue Service (IRS) said today it will be transitioning away from requiring biometric data from taxpayers who wish to access their records at the agency’s website. The reversal comes as privacy experts and lawmakers have been pushing the IRS and other federal agencies to find less intrusive methods for…
576
You can change your number
Millions of people worldwide rely on Signal every day for secure and private communication. Some of these people change their phone number, but want to continue using Signal without registering for a new account. We now provide the ability to change the phone number on your Signal account, while ...
577
Europe: The end of the privacy of digital correspondence
The End of the Privacy of Digital Correspondence The EU wants to oblige providers to search all private chats, messages, and emails automatically for suspicious content - generally and indiscriminately. The stated aim: To prosecute child pornography. The result: Mass surveillance by means of full
578
Google Chrome U2F API decommission: What the change means
Understand Chrome's deprecation of U2F API and its effects, while exploring how to migrate to the WebAuthn API for continued YubiKey support.
579
Bitcoin's fungibility graveyard
Where the pipe-dream of Bitcoin’s real-world fungibility goes to die.
580
The EARN IT act is back, and it’s more dangerous than ever
Stanford Center for Internet and Society20221,363 points482 commentsSociety, Policy & Culture details
This is the latest entry in my lengthy archive of writing, talks, and interviews about the EARN IT Act: * Blog posts at the CIS blog: part 1, part 2, part 3, part 4, part 5, part 6, part 7, part 8 * Articles for Brookings TechStream: part 1, part 2 * Talks
581
I hacked SONOS and YouTube the same day
Or how to play YouTube videos on you SONOS, easy and for free.
582
Who keeps an eye on clipboard access?
If there is any feature that “universally” describes the usage of computers, it is the copy/paste pattern. We are used to it, practically all the common graphical user interfaces have support for it, and it magically works.
583
GDPR enforcer rules that IAB Europe’s consent popups are unlawful
EU data protection authorities find that the consent popups that plagued Europeans for years are illegal. All data collected through them must be deleted. This decision impacts Google’s, Amazon’s and Microsoft’s online advertising businesses.
584
Multi-Account Containers Add-on on Mozilla VPN
At Mozilla, online privacy has always been one of our top priorities. Recently we announced Total Cookie Protection on Firefox Focus to combat cross-site t
585
The GNU Name System
This document provides the GNU Name System (GNS) technical specification. GNS is a decentralized and censorship-resistant domain name resolution protocol that provides a privacy-enhancing alternative to the Domain Name System (DNS) protocols. This document defines the normative wire format of resource records…
586
587
A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution
Posted by Ian Beer & Samuel Groß of Google Project Zero We want to thank Citizen Lab ...
588
Malicious app on Google Play drops banking malware on users’ devices
Pradeo’s researchers discovered a malicious mobile application called 2FA Authenticator distributed on Google Play and installed by 10K+ users.
589
Tor Browser: a legacy of advancing private browsing innovation
In this post, we want to share a little bit of Tor Browser history with you, the origins of our features and designs, and how many of our innovative privacy and security features have been adopted by other browsers.
590
Rebranding FLoC Without Addressing Key Privacy Issues
The Topics API does not address the core harmfulness of FLoC: that it’s arrogant and dangerous for Google to be the arbiter of what users consider “sensitive” data.
591
592
Over 20k servers have their iLO interfaces exposed to the internet
Over 20 thousand servers have their iLO interfaces exposed to the internet, many with outdated and vulnerable versions of FW, Author: Jan Kopriva
593
I read the federal government’s Zero-Trust Memo so you don’t have to
Yesterday, the Office and Management and Budget (OMB) released a memo:“Moving the U.S. Government Towards Zero Trust Cybersecurity Principles”. The memo…
594
595
Scary fraud ensues when ID theft and usury collide
What’s worse than finding out that identity thieves took out a 546 percent interest payday loan in your name? How about a 900 percent interest loan? Or how about not learning of the fraudulent loan until it gets handed off to collection agents? One reader’s nightmare experience spotlights what can happen when ID…
596
Hacking the Apple Webcam (Again)
$100,500 Apple Bug Bounty for hacking the webcam via a Safari Universal Cross-Site Scripting (UXSS) bug. CVE-2021-30861, CVE-2021-30975
597
Recovering redacted information from pixelated videos
We explore the history of image unblurring and present a simple yet effective technique to get a high-resolution image from a pixelated video in order to recover redacted information (with no guessing involved).
598
We purchased a machine from China and it came with malware preinstalled
Zhengbang ZB3245 review. We bought a Zhengbang Pick & Place machine and this page tells you all about our experience of setting up and using.
599
Are popular toxicity models simply profanity detectors?
Are popular toxicity models simply profanity detectors? We show how toxicity models overweight profanity, and make mistakes when profanity is used in a positive way.
600
Scam Alert: Fake DMCA Takedown for Link Insertion
There are a lot of scams out there, but one that's been plaguing bloggers like me lately is a novel twist: A fake DMCA takedown notice that's actually a link insertion scam! Beware: The notices I'm getting are very convincing-looking, complete with a fake law firm website!