901
An update on AirTag and unwanted tracking
Apple announced it has identified even more ways to update AirTag safety warnings and help guard against unwanted tracking of people and property.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,440 posts.
902
903
Improved Process Isolation in Firefox 100
Firefox uses a multi-process model for additional security and stability while browsing. Web Content is rendered in separate processes.
904
SSH Bastion Host Best Practices
Learn 14 best practices to build and deploy a security-hardened SSH bastion host based on OpenSSH server.
905
Google announces Android for Work
Posted by Rajen Sheth, Director of Product Management, Android and Chrome for Work (Cross-posted on the Android Blog .) Over a billi...
906
AWS now supports U2F/Yubikeys
April 25, 2023: We’ve updated this blog post to include more security learning resources. Update on October 8, 2018: After we launched support for security devices manufactured by Yubico on September 25, 2018, we received feedback from customers to support other U2F security key providers, as well. Starting October 8…
907
Fighting spam with Haskell
Visit the post for more.
908
HTML attributes to improve your users' two factor authentication experience
Learn how to use the HTML autocomplete, inputmode and pattern attributes to improve the user experience of logging in.
909
Gmail confidential mode is not secure or private
Privacy experts say Gmail confidential mode is neither secure nor private because it does not use end-to-end encryption.
910
Abusing Entra OAuth for fun and access to internal Microsoft applications
The Eye Security Research team has uncovered a new critical misconfiguration that exposed sensitive data at internal Microsoft applications.
911
Why Everyone Should be Concerned By the Seizure of MyRedBook.com
Last week, an online community for sex workers disappeared from the Internet. Visit SFRedbook.com, MyPinkBook.com, or MyRedBook.com right now, and you’ll only find the seals of the law enforcement agencies—the FBI, the DOJ, and the IRS—that seized the sites as part of a prostitution and money...
912
Congress Is Trying to Roll Back Internet Privacy Protections
Call congress now! Back in 2014 over 3 million Internet users told the U.S. government loudly and clearly: we value our online security, we value our online privacy, and we value net neutrality. Our voices helped convince the FCC to enact smart net neutrality regulations—including long-needed...
913
Flock's gunshot detection microphones will start listening for human voices
Flock Safety, the police technology company most notable for their extensive network of automated license plate readers spread throughout the United States, is rolling out a new and troubling product that may create headaches for the cities that adopt it: detection of “human distress” via audio. As...
914
915
916
SAML: A fractal of bad design
SAML, the XML-based authentication protocol that birthed the SSO industry, is fundamentally flawed due to XML complexity, canonicalization issues, enveloped signatures, and design ossification, making it vulnerable to signature wrapping attacks and parser differentials that persist despite decades of awareness…
917
The EARN IT bill is back. We've killed it twice, let's do it again
EARN IT Act is aiming at scanning our messages and photos, we are calling of Senators to oppose this surveillance bill!
918
Federal Court (Finally) Rules Backdoor Searches of Data Unconstitutional
In a landmark ruling, a federal district court held that backdoor searches of databases full of Americans’ private communications collected under Section 702 ordinarily require a warrant. Congress should uphold its responsibility to protect civil rights and civil liberties by refusing to renew Section 702 absent a…
919
Avast open-sources its machine-code decompiler
After seven years of development, Avast open-sources its machine-code decompiler for platform-independent analysis of executable files.
920
Google to Acquire Mandiant
Transform cyber defense with Mandiant. Engage frontline experts for incident response, threat intelligence services, and cyber risk management.
921
Fast16: High-precision software sabotage 5 years before Stuxnet
A previously unknown 2005 cyber sabotage framework patches high-precision calculation software in memory to silently corrupt results.
922
Why you should not trust emails sent from Google
As you might know, Google is running a vulnerability reward program , where they award researchers monetary awards or a place in their Hall of Fame when they responsibly disclose vulnerabilities. With this in mind, I was scooping around on several Google services, including Google Scholar. As I recently started a PhD…
923
DuckDuckGo email protection beta now open
DuckDuckGo Email Protection is a free email forwarding service that removes multiple kinds of trackers and lets you create unique private email addresses.
924
The first stable release of a memory safe sudo implementation
Prossimo is pleased to announce the first stable release of sudo-rs, our Rust rewrite of the critical sudo utility. The sudo utility is one of the most common ways for engineers to cross the privilege boundary between user and administrative accounts in the ubiquitous Linux operating system. As such, its security is…
925
V8: A Year with Spectre
The V8 team details their analysis and mitigation strategy for Spectre, one of the top computer security issues of 2018.
926
927
Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS
Last month we shared statistics on some popular reflection attacks. Back then the average SSDP attack size was ~12 Gbps.
928
Shai Hulud launches second supply-chain attack
The threat actor behind “Shai Hulud 2.0” launched a new malware campaign compromising the supply chain of Zapier, ENS Domains and more — exposing secrets, injecting malicious code, and enabling widespread developer-environment takeover.
929
Menstrual tracking app data is gold mine for advertisers that risks women safety
Cambridge researchers urge public health bodies like the NHS to provide trustworthy, research-driven alternatives to platforms driven by profit.
930
