571
I can see your local web servers
How many web servers are running on your machine right now? Do all of those development web servers have a secure login, and restrictive CORS permissions? You don’t know? Allow me to check for you:
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,768 posts.
572
You can change your number
Millions of people worldwide rely on Signal every day for secure and private communication. Some of these people change their phone number, but want to continue using Signal without registering for a new account. We now provide the ability to change the phone number on your Signal account, while ...
573
Microsoft no longer signs Windows drivers for Process Hacker
[German]Brief information, which is already here with me since August 2021, but which I have not yet addressed in the blog. David Xanatos has pointed out to me that Microsoft is refusing to sign…
574
The KIDS Act would require age checks to get online
Buried inside the KIDS Act are provisions that will push online services to verify all users’ ages, require government-directed moderation policies for online speech, and even create new rules about private and encrypted communications. While supporters continue to claim this bill protects minors online, its…
575
Mozilla’s DNS over HTTPs
The current insecure DNS system leaves billions of people around the world vulnerable because the data about where they go on the internet is unencrypted. We’ve set out to change ...
576
EU Commission is planning automatic CSAM scanning of private communications
This would be the worst surveillance apparatus outside of China, and completely disproportionate.
577
Camera and microphone require HTTPS in Firefox 68
As of Firefox 68—releasing next week—camera and microphone will require an https connection to work. Access from insecure http will cease to work, matching how Chrome works. Camera and microhone are powerful features, and Firefox will now only expose them in secure contexts, a security and privacy improvement. Largely…
578
An iOS zero-click radio proximity exploit odyssey
Posted by Ian Beer, Project ZeroNOTE: This specific issue was fixed before the launch of Privacy-...
579
Turn Dependabot off
I recommend turning Dependabot off and replacing it with a pair of scheduled GitHub Actions, one running govulncheck, and the other running CI against the latest version of your dependencies.
580
Companies must stop using Google Analytics
Vi arbetar för att skydda alla dina personuppgifter, till exempel om hälsa och ekonomi, så att de hanteras korrekt och inte hamnar i orätta händer.
581
My security camera shipped a GitHub admin token in its login page
i dissected some firmware for a Hanwha Wisenet XNP-9300RW and found that it had github admin tokens in it, also miltech is weird
582
No, Cellebrite Cannot “Break Signal Encryption”
Yesterday, the BBC ran a story with the factually untrue headline, “Cellebrite claimed to have cracked chat app’s encryption.” This is false. Not only can Cellebrite not break Signal encryption, but Cellebrite never even claimed to be able to. Since we weren’t actually given the opportunity to co...
583
Dangers of CSV Injection
I’ve been doing the local usergroup circuit with this lately and have been asked to write it up.
584
License plate reader searches should require a warrant
So while I work with police departments regularly, I think it is critically important that technology be used reasonably. While this may be off-putting to some of my clients, I worked with the Inst…
585
The EARN IT Act Violates the US Constitution
Since senators introduced the EARN IT Act (S. 3398) in early March, EFF has called attention to the many ways in which the bill would be a disaster for Internet users’ free speech and security. We’ve explained how the EARN IT Act could be used to drastically undermine encryption. Although the bill...
586
The unexpected Google wide domain check bypass
David Schütz's bug bounty writeups
587
Facebook tracking is illegal in Europe
Meta must pay 1.2 billion euros for violating the EU regulation GDPR.
588
Thanksgiving 2023 security incident
On Thanksgiving Day, November 23, 2023, Cloudflare detected a threat actor on our self-hosted Atlassian server. Our security team immediately began an investigation, cut off the threat actor’s access, and no Cloudflare customer data or systems were impacted by this event
589
590
Why is OAuth still hard in 2023?
We implemented OAuth for the 50 most popular APIs. TL;DR: It is still a mess.
591
Detecting unauthorized physical access with beans, lentils and colored rice (2021)
strengthening digital self-defense | research and development | providing privacy-focused goods and services
592
Get your loved ones off Facebook
I originally wrote this for my friends and family in 2015, to explain why the latest Facebook privacy policy is really harmful. It’s since been read b
593
Researchers Could Have Uncovered Volkswagen’s Emissions Cheat If Not for DMCA
Automakers argue that it’s unlawful for independent researchers to look at the code that controls vehicles without the manufacturer’s permission. We’ve explained before how this allows manufacturers to prevent competition in the markets for add-on technologies and repair tools. It also makes it harder for watchdogs to…
594
How Bank of America Gave Away My Money
TLDR: Bank of America is a horrible business and it should be ashamed by how bad it is. Two weeks ago, I suddenly received emails informing me that my Bank of America…
595
596
Court finds Fourth Amendment doesn’t support broad search of protesters’ devices
In a big win for protesters’ rights, the U.S. Court of Appeals for the Tenth Circuit overturned a lower court’s dismissal of a challenge to sweeping warrants to search a protester’s devices and digital data and a nonprofit’s social media data.The case, Armendariz v. City of Colorado Springs, arose...
597
HTTPS on Your Landing Page Is Important
Occasionally, I feel like I'm just handing an organisation more shovels - "here, keep digging, I'm sure this'll work out just fine..." The latest such event was with NatWest [http://personal.natwest.com] (a bank in the UK), and it culminated with this tweet from them: > I'm
598
599
How to contact Google SRE by dropping a shell in Cloud SQL
Note: The vulnerabilities that are discussed in this post were patched quickly and properly by Google. We support responsible disclosure. The research that resulted in this post was done by me and …
600
Massachusetts Court Blocks Warrantless Access to Real-Time Location Data
There's heartening news for our location privacy out of Massachusetts this week. The Supreme Judicial Court, the state's highest court, ruled that police access to real-time cell phone location data—whether it comes from a phone company or from technology like a cell site simulator—intrudes on a...