Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,440 posts.
Browsers are changing the default value of the SameSite attribute for cookies from None to Lax. This will greatly improve security for users. However, some web sites may depend (even ...
We have released the Proton Mail iOS app as open source software as part of our commitment to transparency and supporting the developer community.
Explore thought leadership, industry insights, and other resources related to cybercrime detection, disruption, and takedowns.
Civil society across Europe launches the “Reclaim Your Face” campaign, demanding that local and national authorities listen to their communities about the serious risks of using facial recognition and other biometric technologies in public spaces. The newly formed coalition calls to ban biometric mass surveillance, in…
Posted by Chris Evans, Exploit Writer Underling to Tavis OrmandyBack in this 1998 post to the Bug...
A discussion about IP blocking: why we see it, what it is, what it does, who it affects, and why it’s such a problematic way to address content online.
It’s time for the Internet to move on to more secure software, and that’s why our Memory Safety Initiative is coordinating work to make further improvements to the Rustls TLS library.
As agents grow more capable, so does their potential blast radius. Here's what we learned building containment for claude.ai, Claude Code, and Cowork.
Tor Browser 10.0 for Desktop is now available from the Tor Browser download page and also from our distribution directory.
This investigation was surprising to me so I thought it would be interesting to share my findings and I hope you'll like it.
So why do we know so little about it?The U.S. Department of Homeland Security (DHS) is quietly building what will likely become the largest database of biometric and biographic data on citizens and foreigners in the United States. The agency’s new Homeland Advanced Recognition Technology (HART)...
The government hacking into phones and seizing computers remotely? It’s not the plot of a dystopian blockbuster summer movie. It’s a proposal from an obscure committee that proposes changes to court procedures—and if we do nothing, it will go into effect in December. The proposal comes from the...
We’re excited that support for getting and managing TLS certificates via the ACME protocol is coming to the Apache HTTP Server Project (httpd). ACME is the protocol used by Let’s Encrypt, and hopefully other Certificate Authorities in the future. We anticipate this feature will significantly aid the adoption of HTTPS…
In early February 2022, notably just ahead of the Russian invasion of Ukraine, Volexity made a discovery that led to one of the most fascinating and complex incident investigations Volexity had ever worked. The investigation began when an alert from a custom detection signature Volexity had deployed at a customer site…
For the past two years we've been tinkering with a proof-of-concept decryptor for the Phobos family ransomware. It works, but is impractical to use for reasons we'll explain here. Consequently, we've been unable to use it to help a real-world victim so far. We've decided to publish our findings and tools, in hope that…
eff_ltr_to_rico_mgmt_re_krazam_llc.pdf
The Trail of Bits Assurance practice has received an influx of Go projects, following the success of our Kubernetes assessment this summer. As a result, we’ve been adapting for Go projects some of the security assessment techniques and tactics we’ve used with other compiled languages. We started by understanding the…
Let's make a tiny, standalone CA! We'll use a Raspberry Pi 4, YubiKey 5 NFC, and Infinite Noise TRNG.
Our client, Chris Roberts, a founder of the security intelligence firm One World Labs, found himself detained by the FBI earlier this week after tweeting about airplane network security during a United Airlines flight. When Roberts landed in Syracuse, he was questioned by the FBI, which ultimately...
On May 13, 2026, the website SecurityBaseline.eu was launched. It is a spin-off from the Dutch “Basisbeveiliging”, which has monitored baseline security for over a decade and is part of governmental policy. Three months ago we sent tens of thousands of e-mails to European governments indicating the new site would…
AWS WAF is a managed cloud web application firewall (WAF) service that protects websites, APIs, and applications from bots, exploits, and layer 7 events. Deploy scalable, enterprise-grade WAF solutions with global protection.
On Wednesday of last week, details of the Shellshock bash bug emerged. This bug started a scramble to patch computers, servers, routers, firewalls, and other computing appliances using vulnerable versions of bash.
