301
The All-Seeing “i”: Apple Just Declared War on Your Privacy
“Under His Eye,” she says. The right farewell. “Under His Eye,” I reply, and she gives a little nod.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,768 posts.
302
ImageNet contains naturally occurring Apple NeuralHash collisions
Apple’s NeuralHash: real-world collisions, false positives, and implications for CSAM detection. See what this means for system reliability.
303
Avoid Non-Microsoft Antivirus Software
Robert O'Callahan. Christian. Kiwi. Software guy. All content human-authored unless otherwise noted.
304
Defeating a 40-year-old copy protection dongle
That’s right — this little device is what stood between me and the ability to run an even older piece of software that I recently unearthed during an expedition of software archaeology.
305
Changing Our Approach to Anti-Tracking
In the near future, Firefox will -- by default -- protect users by blocking tracking while also offering a clear set of controls to give our users more choice over what information they share with sites.
306
307
Wildcard Certificates Coming January 2018
Update, March 13, 2018 Wildcard certificate support is live. Let’s Encrypt will begin issuing wildcard certificates in January of 2018. Wildcard certificates are a commonly requested feature and we understand that there are some use cases where they make HTTPS deployment easier. Our hope is that offering wildcards…
308
309
Facebook Container Extension: Take control of how you’re being tracked
Our Multi-Account Containers extension has been a game changer for many users, letting them manage various parts of their online life without intermingling
310
I don't like passkeys
Why passkeys are a step back for personal security: examining account lockout risks, platform lock-in, hardware key limits, and fragile recovery flows.
311
Firefox Multi-Account Containers
Our new Multi-Account Containers extension for Firefox means you can finally wrangle multiple email/social accounts. Maybe you’ve got two Gmail or Instag
312
Let's build a Chrome extension that steals as much data as possible
Today's adventure: DIY whole hog data exfiltration
313
Supabase MCP can leak your entire SQL database
Indirect prompt injection through support-ticket data lets an MCP-enabled assistant cross trust boundaries and query private tables with Supabase’s privileged service role.
314
Breaking GitHub Private Pages for $35k
Abusing CRLF, cache poisoning, and other misconfigurations for a no-interaction XSS against GitHub Private Pages.
315
Samsung embeds IronSource spyware app on phones across WANA
In recent months, we have received numerous reports from users across West Asia and North Africa (WANA) expressing alarm over a little-known but deeply intrusive bloatware application—AppCloud—pre-installed on Samsung’s A and M series smartphones. Without users’ knowledge or consent, this bloatware collects sensitive…
316
Zoom to bring end-to-end encryption to all users, including non-paying
Learn more about how to use each Zoom product to connect with coworkers, customers, businesses, and more with insights and best practices.
317
Our audit of Homebrew
This is a joint post with the Homebrew maintainers; read their announcement here! Last summer, we performed an audit of Homebrew. Our audit’s scope included Homebrew/brew itself (home of the brew CLI), and three adjacent repositories responsible for various security-relevant aspects of Homebrew’s operation…
318
The Bitcoin whitepaper is hidden in every copy of macOS
I just discovered that every copy of macOS ships with a hidden PDF of Satoshi Nakamoto's Bitcoin whitepaper. But why?
319
Don't use third party auth to sign in
If a website offers you to sign-in using Google (or any third-party service, say Facebook, Github, etc.), don’t use that feature.
320
"Pwned Passwords" V2 With Half a Billion Passwords
Last August, I launched a little feature within Have I Been Pwned [https://haveibeenpwned.com/] (HIBP) I called Pwned Passwords [https://www.troyhunt.com/introducing-306-million-freely-downloadable-pwned-passwords/]. This was a list of 320 million passwords from a range of different data breaches which organisations…
321
Root shell on a credit card terminal
In this project, I started to reverse engineer payment card terminals because they seemed to be an interesting target for security research, given the high stakes involved. Although I initially didn’t know much about this industry, I did expect a ton of security features and a very security-hardened device. And to…
322
Why are anime catgirls blocking my access to the Linux kernel?
Hey… quick question, why are anime catgirls blocking my access to the Linux kernel?
323
Do Not Turn Child Protection into Internet Access Control
Age verification turns the open internet into a permission system and pushes control away from families, schools, and users.
324
Jailbreaking the Switch 2
ns2jb is a software-only, tethered jailbreak for the Switch 2. It allows running arbitrary native code as any ordinary sysmodule, and as the built-in fs sysmodule. This lets us run homebrew, reverse engineer and mod Switch 2 games, back up save files off the Switch, and access most of the Switch 2’s peripherals…
325
We are under attack
Fighting censorship with technology since 2011. We use AI to monitor censorship and expand free speech worldwide.
326
327
Delve – Fake Compliance as a Service
How Delve managed to falsely convince hundreds of customers they were compliant and then lied about it when exposed and called out
328
Multiple Russia-aligned threat actors actively targeting Signal Messenger
Russia state-aligned threat actors target Signal Messenger accounts used by individuals of interest to Russia's intelligence services.
329
FCC: TikTok is unacceptable security risk and should be removed from app stores
According to the FCC commissioner, TikTok is a video app in "sheep's clothing", suggesting a wolf hides underneath those funny videos.
330
DNS traffic can leak outside the VPN tunnel on Android
We were recently made aware of multiple potential DNS leaks on Android. They stem from bugs in Android itself, and only affect certain apps.