2371
Google, Mozilla Close to Finalizing Sanitizer API for Chrome and Firefox Browse
We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,441 posts.
2372
2373
How the NSA obtains and uses airline reservations (2013)
A front-page report in today’s New York Times based on documents leaked by NSA whistleblower Edward Snowden confirms that the NSA, like the DHS, uses airline reservation data as part of its profiling and social network analysis of US citizens and foreigners. Today’s report also raises new questions, and suggests some…
2374
Keybase's New Key Model
You're reading the Keybase blog. There are more posts . When you're done, you can install Keybase .
2375
New details on commercial spyware vendor Variston
The Threat Analysis Group shares new information on the commercial spyware vendor Variston.
2376
How a Political Engineering Firm Exposed Their Code Base
Political data firm AggregateIQ exposed IT assets that raise questions for society about how technology is being used in recent US political history.
2377
2378
The Whitehouse’s New Executive Order on Cyber Crime Is (Unfortunately) No Joke
On the morning of April 1st, the White House issued a new executive order (EO) that asserts that malicious “cyber-enabled activities” are a national threat, declares a national emergency, and establishes sanctions and other consequences for individuals and entities. While computer and information...
2379
Reverse Engineer’s Perspective on the Boeing 787 ‘51 days’ Directive
Uncover the implications of hacking a Boeing 787 as we analyze recent FAA directives and aviation technology concepts.
2380
Network Tunneling with QEMU
While investigating an incident, we detected uncommon malicious activity inside one of the systems. We ran an analysis on the artifacts, only to find that the adversary had deployed and launched the QEMU hardware emulator.
2381
2382
Tor Browser 4.5 is released
The Tor Browser Team is proud to announce the first stable release in the 4.5 series. This...
2383
LastPass owner GoTo has been hacked
We recently concluded our investigation into the security incident first shared with customers in November of 2022 regarding unauthorized activity in a third-party cloud storage environment. We eliminated the threat actor’s access to the environment and found no evidence of additional compromise or threat actor…
2384
2385
Finding Pwned Passwords with 1Password
1Password integrates with Pwned Passwords, a feature of Have I Been Pwned that allows you to check if your passwords have been leaked on the Internet.
2386
2387
2388
Fake VS Code Extension on NPM Spreads Multi-Stage Malware
The Mend research team uncovered a fake VS-code extension—truffelvscode—typosquatting the popular truffle for VS-code extension. Read the post for more details.
2389
Counter-Strike Global Offsets: reliable remote code execution
One of the factors contributing to Counter-Strike Global Offensive’s (herein “CS:GO”) massive popularity is the ability for anyone to host their own community server. These community servers are free to download and install and allow for a high grade of customization. Server administrators can create and utilize…
2390
Give Me the Green Light Part 1: Hacking Traffic Control Systems
Adventures in Responsible Disclosure
2391
What's next for Tor and privacy online?
Ten years ago, Edward Snowden shared documents with the press that exposed the extent of the U.S. government’s mass surveillance program – and used Tor to protect himself while doing so. How has the perception of privacy changed since then, and what are the Tor Project’s challenges for the year to come?
2392
TP240PhoneHome Reflection/Amplification DDoS Attack Vector
A new reflection/amplification distributed denial of service (DDoS) vector with a record-breaking potential amplification ratio of 4,294,967,296:1 has been abused by attackers in the wild to launch multiple high-impact DDoS attacks.
2393
Secret scanning is now available for free on public repositories
Previously, only organizations with GitHub Advanced Security could enable secret scanning's user experience on their repositories. Now, any admin of a public repository on GitHub.com can detect leaked secrets in…
2394
California agency blocks release of police use of force, surveillance training
Under a California law that went into effect on January 1, 2020, all law enforcement training materials must be “conspicuously” published on the California Commission on Peace Officer Standards and Training (POST) website. However, if you visit POST’s Open Data hub and try to download the officer...
2395
Multiple Russian Threat Actors Targeting Microsoft Device Code Authentication
Starting in mid-January 2025, Volexity identified several social-engineering and spear-phishing campaigns by Russian threat actors aimed at compromising Microsoft 365 (M365) accounts. These attack campaigns were highly targeted and carried out in a variety of ways. The majority of these attacks originated via…
2396
Sealed Rust: A plan to bring Rust to safety critical software domains
Part 1 - The Pitch
2397
Chrome is warning users about insecure pages
First transition in Google's HTTPS-everywhere plans is done
2398
Appeals court denies judicial immunity to judge who personally searched home
FOR IMMEDIATE RELEASE: 10/30/2023 CONTACT: Phillip Suderman, psuderman@ij.org, (850) 376-4110 ARLINGTON, VA.—Today, the 4th U.S. Circuit Court of Appeals unanimously ruled in favor of Matthew Gibson […]
2399
Why Single Sign on Sucks
A deep dive into the UX of current single sign-on and an overview of possible solutions.
2400
Rebranding FLoC Without Addressing Key Privacy Issues
The Topics API does not address the core harmfulness of FLoC: that it’s arrogant and dangerous for Google to be the arbiter of what users consider “sensitive” data.