Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,440 posts.
The Chaos Computer Club is publishing an analysis of software used for tabulating the German parliamentary elections (Bundestagswahl). The analysis shows a host of problems and security holes, to...
A test that hijacked the Chrome back button to send visitors to a fake Google results page, then to mirrored competitor pages where heatmaps, sessions and typing were recorded. Google de-indexed the whole domain.
Starting in version 1.81 for Windows users, Brave browser will block Microsoft Recall from automatically taking screenshots of your browsing activity.
From User-Agent tricks to canvas hashes, see how modern device detection—Picasso, fonts, emojis, touch—makes spoofing fail. Learn how to blend in safely.
The latest Signal release for iPhone, Android, and Desktop now includes support for disappearing messages. The timer has come With this update, any conversation can be configured to delete sent and received messages after a specified interval. The configuration applies to all parties of a convers...
When strikes hit Yandex data centers, many assumed Russian bot operations went dark. Cloudflare data reveals that while search crawling stopped, malicious bots simply migrated to other networks.
Our investigation of the security incident disclosed by Microsoft and CISA and attributed to Chinese threat actor Storm-0558, found that this incident seems to have a broader scope than originally assumed. Organizations using Microsoft and Azure services should take steps to assess potential impact.
Yesterday afternoon, Ars Technica published a story reporting two possible logs of Heartbleed attacks occurring in the wild, months before Monday's public disclosure of the vulnerability. It would be very bad news if these stories were true, indicating that blackhats and/or intelligence agencies...
We are beginning to upgrade people’s personal conversations on Messenger to use end-to-end encryption (E2EE) by default. Meta is publishing two technical white papers on end-to-end encryption: Our …
depthfirst's production autonomous security agent discovered 21 zero-day vulnerabilities in FFmpeg, after intensive security analysis by Google and Anthropic. Moving beyond theoretical analysis, our agent produces concrete, reproducible PoC inputs to confirm its findings at a fraction of the costs ($1k vs. $10k)…
For our 2023 holiday project, we're setting up an WPA3 Enterprise certificate-authenticated Wi-Fi network at home! And when your family from out of town asks to "jump on the Wi-Fi real quick," you'll learn why this type of network is such a hassle to manage.
Cloudflare is one of the first providers to safeguard LLM models and users in the era of AI
Check Point's AI Security Solutions deliver AI-driven threat prevention and unified security management for advanced protection across enterprise networks.
Introducing a novel technique for e-mail spoofing
OAuth2 is one of the most popular specifications for API authentication today, though wrapping your head around it can be a challenge.
Dutch Personal Data Authority raised concerns about Google's GDPR compliance.
Today, Mozilla Monitor (previously called Firefox Monitor), a free service that notifies you when your email has been part of a breach, announced its new p
Certificate transparency is superb improvement to HTTPS certificate security on the web that's great for users and businesses, but on Android it creates a huge...
In a previous post, I wrote about a new set of technologies “Privacy Preserving Advertising”, which are intended to allow for advertising without compr
Firecracker is supposed to keep untrusted code inside a microVM. We escaped it and achieved code execution as root on the host.
VeraCrypt 1.18 and its bootloaders were evaluated. This release included a number of new features including non-western developed encryption options, a boot loader that supports UEFI (modern BIOSes), and more.
UPDATE: Enigmail and GPG Tools have been patched for EFAIL. For more up-to-date information, please see EFF's Surveillance Self-Defense guides.UPDATE (5/14/18): More information has been released. See EFF's more detailed explanation and analysis here.A group of European security researchers have...
In August, we announced a new initiative (known as Privacy Sandbox) to develop a set of open standards to fundamentally enhance privacy on...
Last Thursday we released details on a bug in Cloudflare's parser impacting our customers. It was an extremely serious bug that caused data flowing through Cloudflare's network to be leaked onto the Internet.
Distinguished engineer Martin Thomson explains how this problem occurred, the implications for people who might be affected, and how problems of this nature might be avoided in future. To get ...
