2341
Passkeys: The beginning of the end of the password
We’ve begun rolling out support for passkeys across Google Accounts on all major platforms as an additional option that people can use to sign in.
New
The latest blog posts to take off on Hacker News. 8,770 posts.
2342
An Update on the Lock Icon
Editor’s note: based on industry research (from Chrome and others), and the ubiquity of HTTPS, we will be replacing the lock icon in Chrome’...
2343
Anonymous Tor Phone
I was always curious about all that bad guys (criminals, drug dealers, hitman’s, thief’s etc.) using not very good and secure communication channels. Forgetting about whole OPSEC stuff. There is a lo
2344
Are mental health apps better or worse at privacy in 2023?
Privacy Not Included was launched in 2017 to help you understand the privacy risks of tech products that connect to the internet. We are continuing that work in the form of Product Reviews at our magazine Nothing Personal, where our privacy experts do hours of hands-on testing and research on the most popular consumer…
2345
Update: The Swedish authorities answered our protocol request
Since the events of the search warrant by the Swedish police at Mullvad’s office in Gothenburg, we have tried to get hold of documents and protocols tied to the operation. This is what the authorities came back with.
2346
2347
Apple has just released the first Rapid Security Response for Ventura
Apple has just released the first of its new Rapid Security Responses (RSRs) for macOS 13.3.1 Ventura. This is indicated as macOS Rapid Security Response 13.3.1 (a), and is just just over 300 MB to…
2348
Funds of every Trust Wallet browser extension could have been stolen
Seed generation of Trust Wallet was flawed, the total entropy was only 32 bits. We have created a file containing all possible seeds. Fortunately, the Ledger Donjon discovered the vulnerability very quickly and likely avoided one of the biggest hack in the crypto ecosystem.
2349
Maybe you should store passwords in plaintext
“Never, ever, think about something else when you should be thinking about the power of incentives.” – Charlie Munger, American billionaire investor.
2350
F-Droid Security Issues
F-Droid is a popular alternative app repository for Android, especially known for its main repository dedicated to free and open-source software. F-Droid is often recommended among security and privacy enthusiasts, but how does it stack up against Play Store in practice? This write-up will attempt to emphasize major…
2351
Is Gmail killing independent email?
People report that self-hosted emails always end up in Gmail spam. Is there anything Google can do about it?
2352
Many public Salesforce sites are leaking private data
A shocking number of organizations — including banks and healthcare providers — are leaking private and sensitive information from their public Salesforce Community websites, KrebsOnSecurity has learned. The data exposures all stem from a misconfiguration in Salesforce Community that allows an unauthenticated user to…
2353
California Court of Appeal finds geofence warrant unconstitutional
The California Court of Appeal has held that a geofence warrant seeking information on all devices located within several densely-populated areas in Los Angeles violated the Fourth Amendment. This is the first time an appellate court in the United States has reviewed a geofence warrant. The case is...
2354
Why is OAuth still hard in 2023?
We implemented OAuth for the 50 most popular APIs. TL;DR: It is still a mess.
2355
Smartphones with Qualcomm chip secretly send personal data to Qualcomm
Nitrokey security research reveals that smartphones with Qualcomm chips secretly send device data to Qualcomm without user consent. NitroPhone is not affected.
2356
2357
Google Authenticator now supports Google Account synchronization
Christiaan Brand, Group Product Manager We are excited to announce an update to Google Authenticator , across both iOS and Android, which a...
2358
Statement on EU-US Cooperation on Turning Public Opinion Against Encryption
The members of the Global Encryption Coalition’s Steering Committee issued a statement on the EU-US collaboration against encryption.
2359
UK Threatens End-to-End Encryption
In an open letter, seven secure messaging apps—including Signal and WhatsApp—point out that the UK’s Online Safety Bill could destroy end-to-end encryption: As currently drafted, the Bill could break end-to-end encryption,opening the door to routine, general and indiscriminate surveillance of personal messages of…
2360
Deleting System32\curl.exe
Let me tell you a story about how Windows users are deleting files from their installation and as a consequence end up in tears. Background The real and actual curl tool has been shipped as part of Windows 10 and Windows 11 for many years already. It is called curl.exe and is located in the … Continue reading deleting…
2361
The i.MX8 cannot be deblobbed
Devices based on the i.MX8 or i.MX8M (such as the Librem phone or MNT Reform) have received popular coverage recently. The number of firmware blobs involved in the bringup of these devices is often a point of discussion. At times, people have considered whether some of these blobs could be replaced with libre…
2362
Capturing the Flag with GPT-4
This weekend I went to BSides SF 2023 and had a blast. I went to some really interesting talks (including an excellent one about adversarial machine learning), but mostly I spent my time solving CTF hacking challenges. And this time, I did it with the help of GPT-4, the
2363
The dark side of the Mac App Store
In the last 30 days, I have been closely monitoring the Mac App Store and have made a disturbing discovery. In the midst of the OpenAI…
2364
Cloudflare launches easy to set up consent manager that respects users
Cloudflare Zaraz now can also help you with gathering and managing consent. With this new tool, you can easily collect user’s consent preferences on your website, using a consent modal, and apply your consent policy on third-party tools you load via Cloudflare Zaraz
2365
WTF is a KDF?
Earlier this week a letter from an activist imprisoned in France was posted to the internet. Contained within Ivan Alococo’s dispatch from the Villepinte prison
2366
Compromising Garmin Sport Watches: A Deep Dive into GarminOS and Its MonkeyC VM
13 vulnerabilities in GarminOS and the MonkeyC VM, 9 with CVEs, that let Connect IQ apps escape the VM and bypass permissions on 100+ Garmin watches.
2367
The EARN IT bill is back, seeking to scan our messages and photos
In a free society, people should not have their private correspondence constantly examined. U.S. lawmakers, we would hope, understand that individuals have the right to a private conversation without the government looking over their shoulder. So it’s dismaying to see a group of U.S. Senators...
2368
Introducing 'Trusted Publishers'
Announcing a new, more secure way to publish to PyPI
2369
Mullvad VPN was subject to a search warrant – customer data not compromised
On April 18 at least six police officers from the National Operations Department (NOA) of the Swedish Police visited the Mullvad VPN office in Gothenburg with a search warrant. They intended to seize computers with customer data.
2370
