The latest blog posts to take off on Hacker News. 8,770 posts.
Europe's top court rules that IAB Europe is responsible under the GDPR for the "TCF" consent system, which authorities have already found to be in violation of the GDPR.
Bard IDOR, a GraphQL directive-overloading DoS that hung Google's backend for 109 seconds, and Workspace data exfiltration via markdown images.
While investigating an incident, we detected uncommon malicious activity inside one of the systems. We ran an analysis on the artifacts, only to find that the adversary had deployed and launched the QEMU hardware emulator.
There are indications that U.S. healthcare giant Change Healthcare has made a $22 million extortion payment to the infamous BlackCat ransomware group (a.k.a. “ ALPHV “) as the company struggles to bring services back online amid a cyberattack that has disrupted prescription drug services nationwide for weeks. However…
Copyleft trolls, robosigning, and Pixsy.
Bypassing certificate pinning in Meta’s Messenger application on macOS.
We’re making updates to show less unoriginal, low-quality content on Search.
Cloudflare is one of the first providers to safeguard LLM models and users in the era of AI
Last week, someone leaked a spreadsheet of SoundThinking sensors to Wired . You are probably asking "What is SoundThinking," because the company rebranded last year. They used to be called ShotSpotter, and their outdoor acoustic gunfire detection system still goes by the ShotSpotter name.
Near the end of 2022, Trail of Bits was hired by the Open Source Technology Improvement Fund (OSTIF) to perform a security assessment of the cURL file transfer command-line utility and its library, libcurl. The scope of our engagement included a code review, a threat model, and the subject of this blog […]
Secure everything coding agents build, use, and ship - prevent risk before code exists, AutoFix the backlog, and protect the coding agents and supply chain.
I’m interested in HTML, CSS, and making the web less annoying
The /unblock API clears away bot fingerprints at the CDP level, to truly humanize your Puppeteer automations.
The demise of Authy desktop has brought about a number of changes, probably the one of which I most appreciate is a mobile app which lets me edit codes: with 2FAS I can edit labels on codes, and I’...
Welcome! The fact that you’re reading this means that you probably care deeply about the issue of privacy, which warms our hearts. Unfortunately, even though you care about privacy, or perhaps because you care so much about it, you may feel that there's not much you (or anyone) can really do to...
I've been getting a lot of those "your parcel couldn't be delivered" phishing attacks lately and if you're a human with a phone, you probably have been too. Just as a brief reminder, they look like this: These get through all the technical controls that exist at
We are introducing PQ3, a groundbreaking cryptographic protocol for iMessage that advances the state of the art of end-to-end secure messaging. With compromise-resilient encryption and extensive defenses against even highly sophisticated quantum attacks, PQ3 provides protocol protections that surpass those in all…
For programmers new to cryptography, there are plenty of “known unknowns” – unfamiliar terms like “elliptic curves” and “random oracles”, and unnecessarily long acronyms (“RSASSA-PKCS-v1_5”, like really?). But what really gives cryptography its reputation is the unknown unknowns. The things that catch even experienced…
Edit: There’s a short follow-up to this post: Exodus Bitcoin Wallet: Follow up. tl;dr: A Bitcoin investor was recently scammed out of 9 Bitcoin (worth around $490K) in a fake “Exodus wallet” desktop application for Linux, published in the Canonical Snap Store. This isn’t the first time, and if nothing changes, it…
The authors of the dangerous Kids Online Safety Act (KOSA) unveiled an amended version this week, but it’s still an unconstitutional censorship bill that continues to empower state officials to target services and online content they do not like.
Signal’s mission and sole focus is private communication. For years, Signal has kept your messages private, your profile information (like your name and profile photo) private, your contacts private, and your groups private – among much else. Now we’re taking that one step further, by making your...
Microsoft announced that it caught Chinese, Russian, and Iranian hackers using its AI tools—presumably coding tools—to improve their hacking abilities. From their report: In collaboration with OpenAI, we are sharing threat intelligence showing detected state affiliated adversaries—tracked as Forest Blizzard, Emerald…
Study of an Android runtime (ART) hijacking mechanism for bytecode injection through a step-by-step analysis of the packer used to protect the DJI Pilot Android application.
A cryptographic tag developed at MIT uses terahertz waves to authenticate items by recognizing the unique pattern of microscopic metal particles that are mixed into the glue that sticks the tag to the item’s surface.
There’s an enormous and largely invisible campaign to use fraudulent notices under the US Digital Millennium Copyright Act to remove critical articles from the internet. We don’t know who is running…
The comapny uses manipulative designs to prevent people from obtaining a free copy of their data in accordance with law
