Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,770 posts.
On August 4, 2022, Twilio identified accounts of employees who were compromised by a social engineering attack. The attacker then gained access to data for a limited number of customers.
Introduction I have had this article planned since the end of 2009 and have had it as a skeleton since then. I wanted to point out the many problems with OS X security and debunk the baseless myth …
If you haven’t been living under a rock, you probably already know what ChatGPT is. I am an operator of high bandwidth Tor exit relays, and with that, I get a lot of abuse complaints. Combined with the fact that I have ai lease on a “/24” of IPv4 space, basically a block of 256 IP addresses, I have the IP space’s…
A vulnerability in PDF.js found by Codean Labs. PDF.js is a JavaScript-based PDF viewer maintained by Mozilla. This bug allows an attacker to execute arbitrary JavaScript code as soon as a malicious PDF file is opened. This affects all Firefox users (
We’re announcing the closed beta of a self-serve Cloudflare OHTTP Gateway. We’re also renaming our Privacy Gateway to Cloudflare OHTTP Relay to better distinguish the two products.
A few years after HTTP appeared, around when W3C was founded in 1994, it was clear that an unencrypted and unauthenticated connection was too much of a liability for a lot of serious stuff, such as e-commerce, which everyone wanted to do on the web. (In those days, mass Deep Packet Inspection was not technically…
On Tuesday, KrebsOnSecurity warned that hackers increasingly are using compromised government and police department email accounts to obtain sensitive customer data from mobile providers, ISPs and social media companies. Today, one of the U.S. Senate’s most tech-savvy lawmakers said he was troubled by the report and…
Flock's 'licence plate readers' read much more than license plates. A judge says what they record must be released.
It’s been a while since I wrote an “attack of the week” post, and the fault for this is entirely mine. I’ve been much too busy writing boring posts about Schnorr signatures!…
Research By: Eyal Itkin, Yannay Livneh and Yaniv Balmas Fax, the brilliant technology that lifted mankind out the dark ages of mail delivery when only the postal service and carrier pigeons were used to deliver a physical message from a sender to a receiver. Technology wise, however, that was a long time ago. Today […]
The Senate passed the USA Freedom Act today by 67-32, marking the first time in over thirty years that both houses of Congress have approved a bill placing real restrictions and oversight on the National Security Agency’s surveillance powers. The weakening amendments to the legislation proposed by...
It’s not actually banned in the EU yet—the legislative process is much more complicated than that—but it’s a step: a total ban on biometric mass surveillance. To respect “privacy and human dignity,” MEPs said that EU lawmakers should pass a permanent ban on the automated recognition of individuals in public spaces…
We study subliminal learning , a surprising phenomenon where language models learn traits from model-generated data that is semantically unrelated to those traits. For example, a "student" model learns to prefer owls when trained on sequences of numbers generated by a "teacher" model that prefers owls. This same…
OAuth provides third party applications limited access to user resources without compromising the user's data. Find out exactly how in this blog.
Modern websites are browsed through a lens of transparent systems built to enhance performance, extract analytics and supply numerous additional services. This almost invisible attack surface has been
OpenAI is sharing preliminary cybersecurity evaluations for Astra and the steps we’re taking to strengthen safeguards and security controls.
Fake hardware cryptowallet, and how bitcoins were stolen from it.
Big Brother Watch and other human rights, civil liberties, digital rights, and racial justice organisations have written to the Prime Minister urging him to abandon plans for a mandatory digital ID. The letter comes just days before an expected statement from Keir Starmer announcing the rollout of a mandatory digital…
Browser extensions claiming to protect against fingerprinting will typically result in more data available for fingerprinting.
ARLINGTON, Va.—On Thursday, a federal judge ruled that a lawsuit filed by a Texas woman whose home was destroyed by a SWAT team may move […]
If you follow security on the Internet, you may have seen articles warning you to “beware of public Wi-Fi networks" in cafes, airports, hotels, and other public places. But now, due to the widespread deployment of HTTPS encryption on most popular websites, advice to avoid public Wi-Fi is mostly out...
or why Twitter disabled SMS 2FA 💬
Tamás Koczka, Security Engineer In 2020 , we integrated kCTF into Google's Vulnerability Rewards Program (VRP) to support researchers evalu...
freeOTP is a soft token authenticator that can be used for two-factor authentication, and is available as a free Android app or iOS app. Two-factor authentication — requiring a user to have “something you have”, as well as “something you know” i.e. a password — is being supported on many more services these days…
One of the more curious behaviors of Apple’s new iPhone 11 Pro is that it intermittently seeks the user’s location information even when all applications and system services on the phone are individually set to never request this data. Apple says this is by design, but that response seems at odds with the company’s…
