271
Security issue related to the NPM registry
We're sharing details of recent incidents on the npm registry, our investigations, and how we’re continuing to invest in the security of npm.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,439 posts.
272
Blacksmith – Rowhammer bit flips on all DRAM devices today despite mitigations
We demonstrate that it is possible to trigger Rowhammer bit flips on all DRAM devices today despite deployed mitigations on commodity off-the-shelf systems with little effort. This result has a significant impact on the system’s security as DRAM devices in the wild cannot easily be fixed, and previous work showed…
273
EasyList is in trouble and so are many ad blockers
One of the world’s most popular ad blocking filter lists, EasyList, has run into a serious issue that threatens to tank it, as well as many open-source projects that rely on it. See if this affects you personally, and how you can help.
274
China's New Cybersecurity Program: No Place to Hide
Chinese distributors can help foreign companies reach customers without setting up a business in China. The wrong agreement can leave a supplier locked into years of poor sales, trademark disputes, or regulatory problems. Here are ten issues we address before a client signs.
275
Age Verification Laws: A Backdoor to Surveillance
I’m old enough to remember when age verification bills were pitched as a way to ‘save the kids from porn’ and shield them from other vague dangers lurking in the digital world (like…“the transgender”). We have long cautioned about the dangers of these laws, and pointed out why they are likely to...
276
Chrome’s address bar will use https:// by default
Starting in version 90, Chrome’s address bar will use https:// by default, improving privacy and even loading speed for users visiting webs...
277
Latest Firefox Brings Privacy Protections Front and Center
Our push this year has been building privacy-centric features in our products that are on by default. With this move, we’re taking the guesswork out of h
278
279
WARP is here
Today, after a longer than expected wait, we're opening WARP and WARP+ to the general public. If you haven’t heard about it yet, WARP is a mobile app designed for everyone which uses our global network to secure all of your phone’s Internet traffic.
280
Gas Pump Skimmers
What’s the first thing that should scare you? There’s three. And the next? The label ‘46’. They’ve got so many in the field criminals need to number them just to keep track.
281
I read the federal government’s Zero-Trust Memo so you don’t have to
Yesterday, the Office and Management and Budget (OMB) released a memo:“Moving the U.S. Government Towards Zero Trust Cybersecurity Principles”. The memo…
282
You can change your number
Millions of people worldwide rely on Signal every day for secure and private communication. Some of these people change their phone number, but want to continue using Signal without registering for a new account. We now provide the ability to change the phone number on your Signal account, while ...
283
The KIDS Act would require age checks to get online
Buried inside the KIDS Act are provisions that will push online services to verify all users’ ages, require government-directed moderation policies for online speech, and even create new rules about private and encrypted communications. While supporters continue to claim this bill protects minors online, its…
284
Mozilla’s DNS over HTTPs
The current insecure DNS system leaves billions of people around the world vulnerable because the data about where they go on the internet is unencrypted. We’ve set out to change ...
285
EU Commission is planning automatic CSAM scanning of private communications
This would be the worst surveillance apparatus outside of China, and completely disproportionate.
286
Camera and microphone require HTTPS in Firefox 68
As of Firefox 68—releasing next week—camera and microphone will require an https connection to work. Access from insecure http will cease to work, matching how Chrome works. Camera and microhone are powerful features, and Firefox will now only expose them in secure contexts, a security and privacy improvement. Largely…
287
An iOS zero-click radio proximity exploit odyssey
Posted by Ian Beer, Project ZeroNOTE: This specific issue was fixed before the launch of Privacy-...
288
Companies must stop using Google Analytics
Vi arbetar för att skydda alla dina personuppgifter, till exempel om hälsa och ekonomi, så att de hanteras korrekt och inte hamnar i orätta händer.
289
No, Cellebrite Cannot “Break Signal Encryption”
Yesterday, the BBC ran a story with the factually untrue headline, “Cellebrite claimed to have cracked chat app’s encryption.” This is false. Not only can Cellebrite not break Signal encryption, but Cellebrite never even claimed to be able to. Since we weren’t actually given the opportunity to co...
290
The EARN IT Act Violates the US Constitution
Since senators introduced the EARN IT Act (S. 3398) in early March, EFF has called attention to the many ways in which the bill would be a disaster for Internet users’ free speech and security. We’ve explained how the EARN IT Act could be used to drastically undermine encryption. Although the bill...
291
Facebook tracking is illegal in Europe
Meta must pay 1.2 billion euros for violating the EU regulation GDPR.
292
Thanksgiving 2023 security incident
On Thanksgiving Day, November 23, 2023, Cloudflare detected a threat actor on our self-hosted Atlassian server. Our security team immediately began an investigation, cut off the threat actor’s access, and no Cloudflare customer data or systems were impacted by this event
293
Why is OAuth still hard in 2023?
We implemented OAuth for the 50 most popular APIs. TL;DR: It is still a mess.
294
Detecting unauthorized physical access with beans, lentils and colored rice (2021)
strengthening digital self-defense | research and development | providing privacy-focused goods and services
295
Researchers Could Have Uncovered Volkswagen’s Emissions Cheat If Not for DMCA
Automakers argue that it’s unlawful for independent researchers to look at the code that controls vehicles without the manufacturer’s permission. We’ve explained before how this allows manufacturers to prevent competition in the markets for add-on technologies and repair tools. It also makes it harder for watchdogs to…
296
Court finds Fourth Amendment doesn’t support broad search of protesters’ devices
In a big win for protesters’ rights, the U.S. Court of Appeals for the Tenth Circuit overturned a lower court’s dismissal of a challenge to sweeping warrants to search a protester’s devices and digital data and a nonprofit’s social media data.The case, Armendariz v. City of Colorado Springs, arose...
297
Massachusetts Court Blocks Warrantless Access to Real-Time Location Data
There's heartening news for our location privacy out of Massachusetts this week. The Supreme Judicial Court, the state's highest court, ruled that police access to real-time cell phone location data—whether it comes from a phone company or from technology like a cell site simulator—intrudes on a...
298
The U.K. government is close to eroding encryption worldwide
The U.K. Parliament is pushing ahead with a sprawling internet regulation bill that will, among other things, undermine the privacy of people around the world. The Online Safety Bill, now at the final stage before passage in the House of Lords, gives the British government the ability to force backdoors into messaging…
299
Keyhole – Forge own Windows Store licenses
By WitherOrNot
300
New documents reveal scale of US Government’s cell phone location data tracking
Thousands of previously unreleased records illustrate how government agencies sidestep our Fourth Amendment rights.