601
Reviewing the cryptography used by Signal
Last year, I urged furries to stop using Telegram because it doesn’t actually provide them with any of the privacy guarantees they think it gives them. Instead of improving Telegram’s c…
New
The latest blog posts to take off on Hacker News. 679 posts.
602
Setting up a trusted, self-signed SSL/TLS certificate authority in Linux
With OpenSSL, it’s pretty easy to generate a simple self-signed TLS certificate . Just run the following command:
603
Privacy Is Not Dead: Beware the All-or-Nothing Mindset
Privacy is only dead if we let it die. Be careful about the all-or-nothing mindset in data privacy, it can do more damage than good to the cause. While striving for improvements, do not forget to cheer and celebrate each small win.
604
Open source projects could sell SBOM fragments
Musings on SBOMs and licensing woes.
605
Multiple Russian Threat Actors Targeting Microsoft Device Code Authentication
Starting in mid-January 2025, Volexity identified several social-engineering and spear-phishing campaigns by Russian threat actors aimed at compromising Microsoft 365 (M365) accounts. These attack campaigns were highly targeted and carried out in a variety of ways. The majority of these attacks originated via…
606
Did Semgrep Just Get a Lot More Interesting?
Documentation and guides from the team at Fly.io.
607
Detecting AI agent use and abuse
The key question is: Can you detect AI agent traffic on your application today? We tested multiple AI agent toolkits across high-traffic consumer sites, and the results were clear—legacy detection techniques (CAPTCHAs, IP blocking, user-agent filtering) are largely ineffective. Here’s what we found.
608
Privacy Pass Authentication for Kagi Search
Today we are announcing a new privacy feature coming to Kagi Search. Privacy Pass is an authentication protocol first introduced by Davidson et al., in [1], and recently standardized by the IETF as RFCs [2—4]. Our...
609
Court Documents Shed New Light on DOGE Activity at Treasury Department
New court documents shed light on what a 25-year-old DOGE worker named Marko Elez did inside Treasury Department payment systems, including what Treasury staff did to limit his access. The documents indicate that the situation is more nuanced than previously reported.
610
DOGE as a National Cyberattack
In the span of just weeks, the US government has experienced what may be the most consequential security breach in its history—not through a sophisticated cyberattack or an act of foreign espionage, but through official orders by a billionaire with a poorly defined government role. And the implications for national…
611
Why cryptography is not based on NP-complete problems
Cryptographic schemes are based on the computational difficulty of solving some ‘hard’ problem. For example, RSA (specifically, RSA-2048) is based on the difficulty of a problem like this:
612
Leaking the email of any YouTube user for $10k
What could've been the largest data breach in the world - an attack chain on Google services to leak the email address of any YouTube channel
613
Smuggling arbitrary data through an emoji
With ZWJ (Zero Width Joiner) sequences you could in theory encode an unlimited amount of data in a single emoji.
614
Apple software update “bug” enables Apple Intelligence
Some people who had previously disabled Apple Intelligence in macOS 15.3 and iOS 18.3 saw it re-enabled after updating to macOS 15.3.1 and iOS 18.3.1 today. In fact I personally have two different Apple silicon Macs running macOS Sequoia, and after I updated both Macs to 15.3.1, Apple Intelligence was re-enabled on my…
615
Nvidia Security Team: “What if we just stopped using C?” (2022)
Today I want to share a great story about why many NVIDIA products are now running formally verified SPARK code. This blog post is in part a teaser for…
616
How does Ada's memory safety compare against Rust?
A comparison of how well Rust and Ada prevent the most common memory-related software errors.
617
Bad Smart Watch Authentication
IDO based smart watches are a security nightmare, and there's likely millions of them out there
618
Dear Mr. Vice President, Please Take Off Your Apple Watch
An Open Letter To JD Vance From A Former CIA Officer On The Counterintelligence Risks Of Smartwatches Mr. Vice President, Congratulations on your ascendancy to the Vice President of the United States of America. While we are an apolitical platform, we wish you nothing but success, the country depends on you. In a rec
619
Teen on Musk's DOGE team graduated from 'The Com'
Wired reported this week that a 19-year-old working for Elon Musk ‘s so-called Department of Government Efficiency (DOGE) was given access to sensitive US government systems even though his past association with cybercrime communities should have precluded him from gaining the necessary security clearances to do so…
620
A brief history of code signing at Mozilla
Shipping large software to end-user devices is a complicated process. Shipping large software securely to end-user devices is even more complicated. Signing the things that ship to end-user devices is
621
Fake VS Code Extension on NPM Spreads Multi-Stage Malware
The Mend research team uncovered a fake VS-code extension—truffelvscode—typosquatting the popular truffle for VS-code extension. Read the post for more details.
622
Mad at Meta? Don't Let Them Collect and Monetize Your Personal Data
If you’re fed up with Meta right now, you’re not alone. Meta tracks you across millions of websites and apps and its business model relies on your data. If you want to limit Meta’s ability to collect and profit from your personal data, here’s what you need to know.
623
U.S. Government Disclosed 39 Zero-Day Vulnerabilities in 2023, First-Ever Report
What the government didn't reveal is how many zero days it discovered in 2023 that it kept to exploit rather than disclose. Whatever that number, it likely will increase under the Trump administration, which has vowed to ramp up government hacking operations. In a first-of-its-kind report,
624
US Cloud soon illegal in EU? US punches first hole in EU-US Data Deal
Trump paralysed the "Privacy and Civil Liberties Oversight Board" (PCLOB), a key element of the EU-US data transfer deal that allows EU-US data flows.
625
Okta Bcrypt incident lessons for designing better APIs
Hello there! If you follow tech news, you might have heard about the Okta security incident that was reported on 1st of November. The TLDR of the incident was …
626
OWASP Non-Human Identities Top 10
A list of OWASP's Non-Human Identities Top 10 risks for 2025
627
Remote Code Execution in Marvel Rivals Game
Reverse Engineering: I discovered a serious Remote Code Execution (RCE) vulnerability in a popular game that could let attackers run code on your PC. Watch how I found it, reported it, and what you can do to stay safe.
628
Reverse Engineering Apple's typedstream Format
imessage-exporter ’s goal is to provide the most comprehensive representation of iMessage data available. Message data is stored in a legacy format that appears to be a stream that represents objects.
629
Everyone knows your location: tracking myself down through in-app ads
How I tracked myself down using leaked location data in the in-app ads, and what I found along the way.
630
Reverse-engineering and analysis of SanDisk High Endurance microSDXC card (2020)
As seen on Hackaday! TL;DR – The SanDisk High Endurance cards use SanDisk/Toshiba 3D TLC Flash. It took way, way more work than it should have to figure this out (thanks for nothing, SanDisk!…