Every blog post that took off on Hacker News, ranked by the votes of its best submission. 642 posts.
I found this on a security-related Slack (shared with permission). It launched an entertaining discussion about the risks of taking a potentially fake FIDO token. We all know the risks of taking a free USB drive and shoving it in our computer, right? USB sticks can install software, act as a keylogger, transmit data…
Purism makes premium phones, laptops, mini PCs and servers running free software on PureOS. Purism products respect people's privacy and freedom while protecting their security.
Researchers have calculated the quantum computer size necessary to break 256-bit elliptic curve public-key cryptography: Finally, we calculate the number of physical qubits required to break the 256-bit elliptic curve encryption of keys in the Bitcoin network within the small available time frame in which it would…
A deep dive into an in-the-wild Android exploit Guest Post by Xingyu Jin, Android Security Resea...
A recent proliferation of phony executive profiles on LinkedIn is creating something of an identity crisis for the business networking site, and for companies that rely on it to hire and screen prospective employees. The fabricated LinkedIn identities — which pair AI-generated profile photos with text lifted from…
No one should build permissions and RBAC on their own. Aserto's authorization-as-a-service platform is here to make sure of it!
Vulnerabilities and exploits in common targets like browsers are often associated with memory safety issues. Typically this involves either a direct error in memory management or a way to corrupt internal object state in the JavaScript engine. One way to eliminate such memory safety issues is to use
With the Supreme Court poised to rip away a constitutional right that’s been the law of the land for nearly half a century by overturning Roe v. Wade, it’s time for the gloves to come off in the encryption debate. For a quarter of a century, it has
A discussion about the Austrian Google Analytics case, and if consent of the user would have made the difference.
Technical article explains JSON Web Tokens (JWT), their component parts, and how they are used for authentication.
KrebsOnSecurity recently reviewed a copy of the private chat messages between members of the LAPSUS$ cybercrime group in the week leading up to the arrest of its most active members last month. The logs show LAPSUS$ breached T-Mobile multiple times in March, stealing source code for a range of company projects…
A single employee leaked sensitive data to secret services, potentially also to Russia.
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw.
An introduction to QUIC and its potential for censorship resistance, as well as a survey of current QUIC blocking in China, India, Russia and Uganda.
Understand Chrome's deprecation of U2F API and its effects, while exploring how to migrate to the WebAuthn API for continued YubiKey support.
Despite the fact that it is not a 'real' vulnerability, escaping privileged Docker containers is nevertheless pretty funny. And because there will always be people who will come up with reasons or excuses to run a privileged container (even though you really shouldn't), this could really be handy at some point in the…
"Privacy" can mean different things in different contexts. Tracking-reduction and tracking-evasion represent different goals with some conflict and overlap.
Britain's computer crime cops are targeting youngsters as young as nine years old in an attempt to dissuade them from embarking on a life of cybercrime.
Without cryptocurrency, a cashless society is a surveillance society
Apple’s ad business is growing fast. It tracks you in its apps and uses that data to sell ads despite its privacy claims.
Or how to reverse engineer React Native apps, and abuse API.
Rust for Linux and Prossimo The Rust for Linux project aims to bring a new system programming language into the Linux kernel. Rust has a key property that makes it very interesting to consider as the second language in the kernel: it guarantees no undefined behavior takes place (as long as unsafe code is sound)…
The growing appearance of deepfake attacks is significantly reshaping the threat landscape. These fakes brings attacks such as business email compromise (BEC) and identity verification bypassing to new levels.
Anybody who runs an internet-facing webserver has seen their fair share of spammy scanners in the logs. It varies server to server, but some of mine get up to 15,000 scans per day. Almost all of these are harmless network mappers, but they still annoy me. Many are compromised hosts or belong to hackers & organized…
Martin Kotuliak, Simon Erni, Patrick Leu, Marc Röschlin, and Srdjan Čapkun, ETH Zurich
The European Union's General Data Protection Regulation (GDPR) requires websites to inform users about personal data collection and request consent for cookies. Yet the majority of websites do not give users any choices, and others attempt to deceive them into accepting all cookies. We document the severity of this…
