241
New
The latest blog posts to take off on Hacker News. 617 posts.
242
243
The Yandex leak: How a Russian search giant uses consumer data
In late January 2023, almost 45 GB of source code from the Russian search giant Yandex was leaked on BreachForums by a former Yandex employee.
244
“Please do not make it public” (Tencent’s Sogou Input Method)
In this report, we analyze the Windows, Android, and iOS versions of Tencent’s Sogou Input Method, the most popular Chinese-language input method in China. Our analysis found serious vulnerabilities in the app’s custom encryption system and how it encrypts sensitive data. These vulnerabilities could allow a network…
245
Infrastructure audit completed by Radically Open Security
We tasked the Netherlands based security firm Radically Open Security (RoS) with performing the third audit towards our VPN infrastructure.
246
Android 14 introduces cellular connectivity security features
Posted by Roger Piqueras Jover, Yomna Nasser, and Sudhi Herle Android is the first mobile operating system to introduce advanced cellular...
247
PyPI Requires 2FA for New User Registrations
PyPI requires new users to enable 2FA before performing management actions.
248
Kubernetes Exposed: One YAML Away from Disaster
We found two main misconfigurations in Kubernetes clusters belonging to more than 350 organizations openly accessible and largely unprotected.
249
250
Reverse Engineering the Apple Multipeer Connectivity Framework (2022)
Some time ago I was using Logic Pro to record some of my music and I needed a way to start and stop the recording from an iPhone, so I found about Logic Remote…
251
Inception: A simple XOR can cause a Microarchitectural Stack Overflow
Over the past one and a half years, we have studied two phenomena that enable an unprivileged attacker to leak arbitrary information on all modern AMD CPUs:
252
Blocked by Cloudflare
Well, it finally happened to me. I was blocked out of a website I use for work because of Cloudflare. And I have no idea if or when I'll be...
253
Blueprint for a distributed multi-region IAM with Go and CockroachDB
Learn how to scale IAM globally. Ory provides secure multi-region identity solutions.
254
255
Teach a man to phish and he’s set for life
One frustrating aspect of email phishing is the frequency with which scammers fall back on tried-and-true methods that really have no business working these days. Like attaching a phishing email to a traditional, clean email message, or leveraging link redirects on LinkedIn , or abusing an encoding method that makes…
256
Google AMP – The Newest of Evasive Phishing Tactic
Author: Dylan DuncanA new phishing tactic utilizing Google...
257
Adtech is built on a privacy fault line
The IAPP's Cobun Zweifel-Keegan rounds up the latest privacy developments from Washington, D.C., and elsewhere in the U.S. for the week of 24 July 2023.
258
The underground world of credit card network exploitation
SaaS companies face rising card testing attacks, with similar card parameters hinting at a possible bank leak. Stripe's Radar and custom rul
259
Does Cloudflare’s 1.1.1.1 DNS Block Archive.is? (2019)
Short answer: no. Quite the opposite, actually — Archive.is is intentionally blocking 1.1.1.1 users. Here's why.
260
Help I accidently enabled HSTS on localhost
I ran into an issue after accidently enabling HSTS for a website on localhost. This was not an issue for the original website that was runni...
261
Evading JavaScript anti-debugging techniques
Debuggers serve as invaluable tools that empower developers to halt code execution and thoroughly analyze its behavior at any given moment. By utilizing debuggers, developers can efficiently identify and resolve issues within their code, making it an indispensable part of their toolkit.
262
“Web Environment Integrity”: Locking Down the Web
Brave strongly opposes Google's "Web Environment Integrity" proposal, the latest in Google's efforts to prevent users from being in control of how they use the Web.
263
264
CloudFlare’s last Warrant Canary was published over a year ago
A warrant canary is a method by which a communications service provider informs users that it has NOT been served with a secret government subpoena.
265
A Year in Review of 0-days Exploited In-the-Wild in 2022
Maddie Stone, Security Researcher, Threat Analysis Group (TAG) This is Google’s fourth annual year-in-review of 0-days exploited in-the-wild...
266
The Right to Lie and Google’s “Web Environment Integrity”
This is a fundamental principle of free and open source software. The World Wide Web abides by this principle, although we don’t often think of it that way. The Web is just an agreed-on set of programmatic interfaces: if you send me this, I’ll send you that. Your computer can construct the “this” by whatever means it…
267
The Reluctant Sysadmin's Guide to Securing a Linux Server
I wrote a follow-up to this guide, which you should probably consider along with this article.
268
The U.K. government is close to eroding encryption worldwide
The U.K. Parliament is pushing ahead with a sprawling internet regulation bill that will, among other things, undermine the privacy of people around the world. The Online Safety Bill, now at the final stage before passage in the House of Lords, gives the British government the ability to force backdoors into messaging…
269
270