5791
OWASP Non-Human Identities Top 10
A list of OWASP's Non-Human Identities Top 10 risks for 2025
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,771 posts.
5792
Session recording for Tailscale SSH in beta
This guide shows you how to set up session recordings for Tailscale SSH. Learn how to record the terminal output whenever someone on your tailnet initiates a Tailscale SSH connection. Use these recordings to detect threats, investigate security incidents, and remain compliant with your network security policies.
5793
House Schedules Vote on Eliminating Consumer Online Privacy Rights Next Week
Majority Leader McCarthy Confirms House to Immediately Act on Behalf of the Cable and Telephone Industry Following the Senate Vote Yesterday, the U.S. Senate by a razor thin margin of 50 to 48 voted to take away the privacy rights of Internet users as a favor to the cable and telephone industry....
5794
ProtonCalendar beta
The Proton Calendar uses an innovative encryption model to deliver the high level of security Proton users expect.
5795
A statement on the Tor Project's relationship with Mullvad
Recent concerns about a political donation by a Mullvad co-founder have raised questions about the Tor Project's funding relationship with the company. We are not terminating the relationship but are setting clear boundaries on our relationship with Mullvad.
5796
Passkeys are just passwords that require a password manager
You reset your passkey the same way you reset your password. But you’ll find that passkeys make it harder to switch between password…
5797
Brave New Trusted Boot World
Posts and writings by Lennart Poettering
5798
5799
The Naz.API Credential Stuffing List
It feels like not a week goes by without someone sending me yet another credential stuffing list. It's usually something to the effect of "hey, have you seen the Spotify breach", to which I politely reply with a link to my old No, Spotify Wasn't Hacked blog post
5800
A planned EU regulation about website certificates is causing concern
Feisty Duck’s Cryptography & Security Newsletter is a periodic dispatch bringing you commentary and news surrounding cryptography, security, privacy, SSL/TLS, and PKI. It's designed to keep you informed about the latest developments in this space. Enjoyed every month by more than 50,000 subscribers. Written by Hanno…
5801
Daily Driving GrapheneOS
I've been running GrapheneOS on my Pixel Fold for over half a year now and can finally provide some experience on what it's like. Also, the official hardware partnership was announced!
5802
Firefox tracks you with “privacy preserving” feature
noyb filed a complaint against Mozilla for quietly enabling a supposed “privacy feature” (called Privacy Preserving Attribution) in its Firefox browser which tracks user behaviour on websites.
5803
How you can get banned from Facebook permanently
Contact Facebook customer service for your customer service needs. Reach out via phone, email, or social media.
5804
Apple has just released the first Rapid Security Response for Ventura
Apple has just released the first of its new Rapid Security Responses (RSRs) for macOS 13.3.1 Ventura. This is indicated as macOS Rapid Security Response 13.3.1 (a), and is just just over 300 MB to…
5805
Rolling-PWN vulnerability affects all Honda vehicles
Modern vehicles are often equipped with a remote keyless entry system. These RKE systems allow unlocking or starting the vehicle remotely. The goal of our research was to evaluate the resistance of a modern-day RKE system. Our research disclosed a Rolling-PWN attack vulnerability affecting all Honda vehicles currently…
5806
Don't publicly expose .git (2015)
Sebastian participated in a CTF (capture the flag) a couple of months ago. One challenge he faced was the task of restoring a git repository from a …
5807
No-fly list trial: Court awards fees on government attorneys’ bad faith
Fourteen years to the day after she discovered she was on the no-fly list when she was arrested at SFO, and five years after her legal victory in the first trial of a challenge to a government no-fly order (a Pyrrhic victory as she has still been denied a visa to return to the US), Dr. Rahinah Ibrahim won a third…
5808
Bluetooth signals can be used to identify and track smartphones
A team of engineers at the University of California San Diego has demonstrated for the first time that the Bluetooth signals emitted constantly by our mobile phones have a unique fingerprint that can be used to track individuals’ movements.
5809
Virgin Mobile leaves six million subscriber accounts wide open
Update: Virgin fixed the issue Tuesday night after taking their login page down for four hours. Please see my update at the bottom of this post.
5810
Turnstile: privacy-preserving alternative to CAPTCHA by Cloudflare
Any website can use a simple API to replace CAPTCHAs with our invisible alternative, whether they’re on the Cloudflare network or not.
5811
What's an SPF Record?
SPF records are DNS records that help prevent SPAM and forged emails
5812
Crates.io phishing attempt
Earlier this week, an npm supply chain attack. It’s turn for crates.io, the main public repository for Rust crates (packages). The phishing e-mail looks like this: And it leads to a GitHub login pa...
5813
5814
New serious vulnerabilities spiked around release of Claude Mythos Preview
Notable organizations disclosed ~1,300 high- and critical-severity CVEs in June 2026, roughly 3.5× the pre-Mythos monthly record. Epoch AI's breakdown of vulnerability disclosures following Anthropic's Project Glasswing.
5815
5816
Malvertising on Microsoft Edge's news feed pushes tech support scams
While Google Chrome still dominates as the top browser, Microsoft Edge, which is based on the Chromium source code, is gradually gaining more...
5817
Malicious Use of the HTML5 Vibrate API
There is a new API in town! HTML5 will (soon) let you make the user's device vibrate. What fun! Obviously, it's useful for triggering alerts, improved immersivness during gameplay, and all sorts of other fun things like sending Morse Code messages via vibration. At the moment, Chrome (and other Android browsers) ask…
5818
Fake ad blockers in Chrome Web Store
People searching for a Google Chrome ad blocking extension have to choose from dozens of similarly named extensions. Only few of these are legitimate, most are forks of open source ad blockers trying to attract users with misleading extension names and descriptions. What are these up to? Thanks to Andrey Meshkov we…
5819
The Trouble with Politicians Sharing Passwords
Yesterday I had a bunch of people point me at a tweet from a politician in the UK named Nadine Dorries [https://twitter.com/NadineDorries]. As it turns out, some folks were rather alarmed about her position on sharing what we would normally consider to be a secret. In this
5820