3841
Combating abuse in Matrix – without backdoors
Matrix, the open protocol for secure decentralised communications
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,770 posts.
3842
Australian PM Calls for End-To-End Encryption Ban
"The laws of mathematics are very commendable but the only law that applies in Australia is the law of Australia", said Australian Prime Minister Malcolm Turnbull today. He has been rightly mocked for this nonsense claim, that foreshadows moves to require online messaging providers to provide law...
3843
3844
3845
3846
Why can't Apple decrypt your iPhone?
Last week I wrote about Apple’s new default encryption policy for iOS 8. Since that piece was intended for general audiences I mostly avoided technical detail. But since some folks (and appar…
3847
How to Delete Your 23andMe Data
This week, the genetic testing company 23andMe filed for bankruptcy, which means the genetic data the company collected on millions of users is now up for sale. If you don't want your data included in any potential sale, it’s a good time to ask the company to delete it.
3848
Tracking the WhatsApp habits of random smartphones
Scaling the WhatsApp online-status hack from a single contact to 5000 random phone numbers — what the data says about phone usage habits.
3849
Formal Verification: The Gap Between Perfect Code and Reality
Thanks to Vlad Brown and Drawings Team for Russian and Uzbek translations. In Fall 2017, I took MIT’s 6.826, Principles of Computer Systems, taught by Turing Award-winner Butler Lampson, Nickolai Z
3850
Internet of Crappy Things
There is a flood of appliances which could be connected - and some are connected - without a second thought as to whether or not it’s necessary or secure.
3851
Whose code am I running in GitHub Actions?
I wanted to know what third-party code I was using in my GitHub Actions. I was able to use standard text processing tools and shell pipelines to get a quick tally.
3852
Handshake: Decentralizing DNS to Improve the Security of the Internet
News and announcements from Namebase.
3853
Estonian Electronic Identity Card: Security Flaws in Key Management
Arnis Parsovs, Software Technology and Applications Competence Center and University of Tartu
3854
Over 30% of Official Images in Docker Hub Contain Security Vulnerabilities
Docker Hub is a central repository for Docker developers to pull and push container images. We performed a detailed study on Docker Hub images to understand how vulnerable they are to security threats. Surprisingly, we found that more than 30% of images in official repositories are highly susceptible to a variety of…
3855
Multi-modal prompt injection image attacks against GPT-4V
GPT4-V is the new mode of GPT-4 that allows you to upload images as part of your conversations. It’s absolutely brilliant. It also provides a whole new set of vectors …
3856
More on the NSA Commandeering the Internet
If there’s any confirmation that the U.S. government has commandeered the Internet for worldwide surveillance, it is what happened with Lavabit earlier this month. Lavabit is—well, was—an e-mail service that offered more privacy than the typical large-Internet-corporation services that most of us use. It was a small…
3857
Tarsnap: No heartbleed here
There's a few reasons for this. First, the Tarsnap client-server protocol does not use TLS; instead, it uses a protocol which is about 100x simpler (in terms of the number of pages of documentation required to define it). This means there's less code and far fewer edge cases where bugs can lurk without being triggered…
3858
What web developers should know about SSL
The most common questions we get from developers who already know their stuff
3859
3860
macOS Zero-Day Used Against Hong-Kong Activists
Google researchers discovered a MacOS zero-day exploit being used against Hong Kong activists. It was a “watering hole” attack, which means the malware was hidden in a legitimate website. Users visiting that website would get infected. From an article: Google’s researchers were able to trigger the exploits and study…
3861
FISA Court Rejects Catch-22 Secrecy Argument in FOIA Case
In the first publicly known victory by a non-government party before the Foreign Intelligence Surveillance Court (FISC), the secret court today granted a motion filed by EFF related to an ongoing Freedom of Information Act lawsuit. The FISC gave its OK to the public disclosure of an earlier opinion...
3862
How to Spoof PDF Signatures
One year ago, we received a contract as a PDF file. It was digitally signed. We looked at the document - ignoring the "certificate is not tr...
3863
(Very) Basic Intro to Elliptic Curve Cryptography
Learn cryptography in Go by building ciphers, hashes, password security, and encryption tools. Understand security beneath the library call.
3864
Welcoming the Nepalese Government to Have I Been Pwned
Today, we welcome the 47th government onboarded to Have I Been Pwned’s free gov service: Nepal. Their National Cyber Security Centre now has access to monitor Nepalese government domains against the data in HIBP. This gives the NCSC the ability to identify exposure across government email addresses and respond
3865
3866
3867
Data-at-Rest Encryption in DuckDB
DuckDB 1.4 ships database encryption capabilities. In this blog post, we dive into the implementation details of the encryption, show how to use it, and demonstrate its performance implications.
3868
3869
Inside the failed attempt to backdoor SSH globally that got caught by chance
Why the threat actor rushed deployment.
3870
OpenAI DayBreak – GPT-5.5-Cyber
OpenAI introduces new Daybreak tools, including Codex Security and GPT-5.5-Cyber, to help organizations find, validate, and patch vulnerabilities at scale.