331
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,768 posts.
332
Chat Control: Incompatible with Fundamental Rights (2022)
The EU Commission's draft regulation on chat control is currently being negotiated in the European Parliament and the Council of Ministers. With the fight against sexual violence against children, the draft pursues an objective that is essential for the protection of children and their rights and can justify…
333
8M users' AI conversations sold for profit by "privacy" extensions
Secure the modern software stack with Koi. Gain visibility, context, and real-time protection over extensions, MCPs, and autonomous AI agent endpoints.
334
Pay up or we’ll make Google ban your ads
A new email-based extortion scheme apparently is making the rounds, targeting Web site owners serving banner ads through Google’s AdSense program. In this scam, the fraudsters demand bitcoin in exchange for a promise not to flood the publisher’s ads with so much bot and junk traffic that Google’s automated anti-fraud…
335
336
The DDoS that almost broke the Internet
The New York Times this morning published a story about the Spamhaus DDoS attack and how CloudFlare helped mitigate it and keep the site online. The Times calls the attack the largest known DDoS attack ever on the Internet.
337
338
Tracking friends and strangers using WhatsApp
You and your good buddy, Steve Steveington, are in training for an arduous charity walk. You signed up together on the spur of the moment and pledged to hold each other accountable whilst you got in shape for the big day. However, you have developed reason to suspect that Steve Steveington is losing his commitment to…
339
Grand jury subpoena for Signal user data
In the “first half of 2016” (the most specific we’re permitted to be), we received a subpoena from the Eastern District of Virginia. The subpoena required us to provide information about two Signal users for a federal grand jury investigation. We’ve designed the Signal service to minimize the dat...
340
Social engineering takeovers of open source projects
By Robin Bender Ginn, Executive Director, OpenJS Foundation; and Omkhar Arasaratnam, General Manager, Open Source Security Foundation
341
Copilot broke audit logs, but Microsoft won't tell customers
We discoverd a vulnerability in Microsoft 365 Copilot that allows users to access files without getting detected or appearing in the audit log.
342
Reverse engineering a $1B Legal AI tool exposed 100k+ confidential files
Update: This post received a large amount of attention on Hacker News — see the discussion thread.
343
Barcode scanner app on Google Play infects 10M users with one update
In a single update, a popular barcode scanner app that had been on Google Play for years turned into malware.
344
Read this before you buy that TV streaming stick
Security experts have been sounding the alarm for years about the risks of using generic TV boxes that promise unlimited content streaming for a one-time fee, warning that they secretly rent the user’s Internet connection out to strangers. But a groundbreaking new analysis finds these devices also routinely spoof…
345
Whistleblower: DOGE Siphoned NLRB Case Data
A security architect with the National Labor Relations Board (NLRB) alleges that employees from Elon Musk ‘s Department of Government Efficiency (DOGE) transferred gigabytes of sensitive data from agency case files in early March, using short-lived accounts configured to leave few traces of network activity. The NLRB…
346
10 Years of Let's Encrypt
On September 14, 2015, our first publicly-trusted certificate went live. We were proud that we had issued a certificate that a significant majority of clients could accept, and had done it using automated software. Of course, in retrospect this was just the first of billions of certificates. Today, Let’s Encrypt is…
347
Today's PHP security release, and how we're strengthening security
Describing the story behind how critical security vulnerabilities were found and fixed.
348
The chat control proposal does not belong in democratic societies
The European Commission is working on a legislative proposal called chat control. If the law goes into effect, all EU citizens will have their communications monitored and audited. Now is the time to stop it.
349
RFC 35140: HTTP Do-Not-Stab (2023)
Date: March 7, 2111
350
Court agrees with EFF: Utah's VPN law demands a technical impossibility
In a win for digital rights, a federal judge has issued a preliminary injunction blocking Utah’s SB 73, the state’s draconian anti-VPN age verification law. The decision comes as EFF submitted our comments to the Utah Department of Commerce, detailing how forcing platforms to detect and block privacy-preserving tools…
351
Is Tor still safe to use?
This blog post is a response to an investigative news report about a large-scale law-enforcement attack that managed to de-anonymize a user of an old version of the long-retired app Ricochet. This blog post aims to provide insight into what we know so far. Nothing that the Tor Project has learned about this incident…
352
Firefox 66.0 Aims to Reduce Online Annoyances
Almost a hundred years ago, John Maynard Keynes suggested that the industrial revolution would effectively end work for humans within a couple of generatio
353
A German ISP changed their DNS to block my website
One of Germany's biggest ISPs changed how their DNS works, right after I exposed an organization that they’re part of.
354
Mozilla to UK regulators: VPNs are essential privacy and security tools
In the context of concerns around young people’s interactions with digital technologies, the UK’s Department for Science, Innovation and Technology is consulting on additional measures to prepare young people for ...
355
Hacking my “smart” toothbrush
After buying a new Philips Sonicare toothbrush I was surprised to see that it reacts to the insertion of a brush head by blinking an LED. A quick online search reveals that the head communicates with the toothbrush handle to remind you when it’s time to buy a new one. From the Philips product page: seems to be REALLY…
356
EFF in Court to Argue NSA Collection from Internet Backbone Is Unconstitutional
Oakland - The Electronic Frontier Foundation (EFF) will argue on Friday before a federal court that the National Security Agency (NSA) is violating the Fourth Amendment by copying and searching data that it collects by tapping into the Internet backbone. The hearing on a motion for partial summary...
357
358
Technical analysis of the Signal clone used by Trump officials
💡Update May 3, 2025: I have posted a follow-up, Here's the source code for the unofficial Signal app used by Trump officials. Update May 4, 2025: Another followup, and a big one: The Signal Clone the Trump Admin Uses Was Hacked Update May 6, 2025: I've written
359
Chrome 68 will mark all HTTP sites as “not secure”
Posted by Emily Schechter, Chrome Security Product Manager For the past several years, we’ve moved toward a more secure web by strongly adv...
360
A deep dive into iOS Exploit chains found in the wild
Posted by Ian Beer, Project ZeroProject Zero’s mission is to make 0-day hard. We often work...