Every blog post that took off on Hacker News, ranked by the votes of its best submission. 679 posts.
I have heard stories of more aggressive interrogation of electronic devices at US border crossings. I know a lot about securing computers, but very little about securing phones. Are there easy ways to delete data—files, photos, etc.—on phones so it can’t be recovered? Does resetting a phone to factory defaults erase…
Vercel recently announced BotID, an anti-bot meant to protect against bots without requiring manual intervention. This post reverse-engineers the script and takes a peek inside.
We’ve heard some questions and concerns following our recent Terms of Service and Privacy Policy updates. We are thankful our community cares enough to
In this article I want to document my journey implementing fast TCP fingerprinting in a golang webserver, using eBPF.
Modern login systems require a second factor (2FA) to log in, in addition to the standard username and password combination. A Time-based one-time password (TOTP) as a 6-digit number is often used. Password managers like [1Password](https://1password.com/), [KeePass (or respective forks)](https://keepass.info/) and…
Because I'm a massive nerd, I actually try to read specification documents. As I've ranted ad nauseam before, the current TOTP spec is irresponsibly obsolete. The three major implementations of the spec - Google, Apple, and Yubico - all subtly disagree on how it should be implemented. Every other MFA app has their own…
A message posted on Monday to the homepage of the U.S. Cybersecurity & Infrastructure Security Agency (CISA) is the latest exhibit in the Trump administration’s continued disregard for basic cybersecurity protections. The message instructed recently-fired CISA employees to get in touch so they can be rehired and then…
AppGoblin has now run over 40k apps in an emulator, tracking millions of API calls thousands of advertising domains. Unfortunately, some of them are dark, meaning they have no landing page of any kind, and I’m unclear who controls these domains.
IDO based smart watches are a security nightmare, and there's likely millions of them out there
States need to have and use data privacy laws to bring privacy violations to light and hold companies accountable for them. So, we were glad to see that the Texas Attorney General’s Office has filed its first lawsuit under Texas Data Privacy and Security Act (TDPSA) to take the Allstate Corporation...
IntroductionI’ve recently been researching Pixel kernel exploitation and as part of this research...
I've been slowly removing Google apps from my life, and one of the last ones left is Authenticator. In this post I look at migrating codes out of Authenticator to a command-line OTP tool, and the steps involved.
A Texas firm recently charged with conspiring to distribute synthetic opioids in the United States is at the center of a vast network of companies in the U.S. and Pakistan whose employees are accused of using online ads to scam westerners seeking help with trademarks, book writing, mobile app development and logo…
A fun project that I learned a lot from.
As AI agents change how the Internet is used, they create a challenge for security. We explore how Anonymous Credentials can rate limit agent traffic and block abuse without tracking users or compromising their privacy.
New court documents shed light on what a 25-year-old DOGE worker named Marko Elez did inside Treasury Department payment systems, including what Treasury staff did to limit his access. The documents indicate that the situation is more nuanced than previously reported.
Tor is upgrading its relay encryption algorithm for improved security. In upcoming releases, Arti and Tor will both support a new encryption algorithm called Counter Galois Onion (CGO). CGO prevents attackers from tampering with encrypted traffic, adds forward secrecy, and brings Tor's encryption up to modern…
Authoritarianism is on the rise throughout the globe. Governments wants to monitor your social media accounts so they can make you disappear if you engage in wrongthink such as opposing wars or genocide. This is worsened by misguided laws like Chat control that would mandate scanning of all digital communication…
A public and free DNS service for a better security and privacy
It’s been almost 2 full years since Linux became a CNA (Certificate Numbering Authority) which meant that we (i.e. the kernel.org community) are now responsible for issuing all CVEs for the Linux kernel. During this time, we’ve become one of the largest creators of CVEs by quantity, going from nothing to number 3 in…
As of the time of writing, there is no real sandboxing technique available to NetBSD. There is chroot , which can be considered a weak sandbox because it modifies the root directory of the process, effectively restricting the process' view of the file system, but it doesn't isolate anything else, so all networking…
Over-privileged Azure Key Vault roles & API vulnerabilities let attackers steal credentials silently. Learn how Token Security detects & remediates these critical exposure paths.
The free DNS4EU resolver, for everyone in Europe. Get the addresses, set it up in minutes, and block malware and phishing with no tracking.
One of legal tech's clichés is that "lawyers live in Word". This is demonstrably incorrect. I, for example, am a lawyer and in fact live in London, England…
The conventional wisdom is that hashing more entropy sources can't hurt: if H is any modern cryptographic hash function then H(x,y,z) is at least as good a random number as H(x,y), no matter how awful z is. So we pile one source on top of another, hashing them all together and hoping that at least one of them is good.
This post is about the reason I will probably never try to warn any organisation in Belgium about any vulnerability again. Recently I have been dealing with an attempt at coordinated vulnerability disclosure (CVD) with an organisation in Belgium. This post is not about that, because I’m not allowed to write about it…
Age verification laws are proliferating fast across the United States and around the world, creating a dangerous and confusing tangle of rules about what we’re all allowed to see and do online. That's why today, we're launching EFF.org/Age, a one-stop shop for users seeking to understand what these laws actually do…
New research on simulated blackmail, industrial espionage, and other misaligned behaviors in LLMs.
