661
Memory Safe Languages in Android 13
Posted by Jeff Vander Stoep For more than a decade, memory safety vulnerabilities have consistently represented more than 65% of vulnerab...
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,768 posts.
662
Apple Has Opened the Backdoor to Increased Surveillance and Censorship
UPDATE: Apple announced it will provide fully encrypted iCloud backups, meeting a longstanding demand by EFF and other privacy-focused organizations, and it has officially dropped its plans to install photo-scanning software on its devices, which would have inspected users’ private photos in iCloud...
663
Brave, the false sensation of privacy
ebin.city is a short 4-character .city domain available for buy. Listed at $100 — secure it before someone else does.
664
Private Cloud Compute: A new frontier for AI privacy in the cloud
Secure and private AI processing in the cloud poses a formidable new challenge. To support advanced features of Apple Intelligence with larger foundation models, we created Private Cloud Compute (PCC), a groundbreaking cloud intelligence system designed specifically for private AI processing. Built with custom Apple…
665
Proof of concept: end-to-end encryption in Jitsi Meet
Check out our progress in end-to-end encryption calls in Jitsi. Give us your crypto knowledge feedback with the code and learn how to demo it here.
666
667
Setting up a home VPN server with WireGuard
Motivation For a moderately security conscious geek like myself, there can be a number of reasons to want to set up a home VPN server: Accessing your home computer via screen sharing without exposing it to the Internet (and thereby to potential evil-doers). Accessing servers with IP white lists (common case for…
668
Sinkholed
On 26 Nov 2019 at 14:55 UTC, I logged into my server that hosts my website to perform a simple maintenance activity. Merely three minutes later, at 14:58 UTC, the domain name susam.in used to host this website was transferred to another registrant without any authorisation by me or without any notification sent to me…
669
Bruteforcing the phone number of any Google user
From rate limits to no limits: How IPv6's massive address space and a crafty botguard bypass left every Google user's phone number vulnerable
670
Cross-signing and end-to-end encryption by default
Matrix, the open protocol for secure decentralised communications
671
You can now ask Google to remove your phone number, email or address from search
Google said this week it is expanding the types of data people can ask to have removed from search results, to include personal contact information like your phone number, email address or physical address. The move comes just months after Google rolled out a new policy enabling people under the age of 18 (or a…
672
Open source firmware is important for security
Why open source firmware is important for security.
673
macOS has checked app signatures online for over 2 years
Why does it take 2 years to realise that macOS has been checking signing certificate validity online?
674
Instead of “auth”, we should say “permissions” and “login”
Most computer systems we interact with have an auth system of some kind. The problem is, that sentence is at best unclear and at worst nonsense. "Auth" can mean at least two things: authentication or authorization [1] . Which do we mean for an "auth system"? It's never perfectly clear and, unfortunately, we often mean…
675
Keybase is not softer than TOFU
You're reading the Keybase blog. There are more posts . When you're done, you can install Keybase .
676
Hidden Networks in TP-Link Routers
I was debugging my WiFi settings this week when I noticed something strange. WiFi Analyzer was showing two hidden networks coming from my router, one for each frequency: 2.4GHz and 5GHz. Networks which I haven't configured and didn't appear in my router's admin interface. WTF?
677
Mullvad exit IPs are surprisingly identifying
Update 5/29: Mullvad has begun rolling out a mitigation feature on their servers that scrambles exit IP positions, thereby fixing this issue. IPs are still deterministically selected based on the pubkey. Mullvad is one of the few VPN providers that offers multiple exit IPs for its servers. If two people connect to the…
678
679
The EARN IT Act: how to ban end-to-end encryption without banning it
Stanford Center for Internet and Society2020613 points234 commentscited by 8Society, Policy & Culture details
The story so far: In the ‘90s the Internet was created. This has made a lot of people very angry and been widely regarded as a bad move. (with apologies to Douglas Adams)[1] There’s a new bill afoot in Congress called the EARN IT Act. A “discussion draft”
680
681
Face ID, Touch ID, No ID, PINs and Pragmatic Security
I was wondering recently after poring through yet another data breach how many people actually use multi-step verification. I mean here we have a construct where even if the attacker has the victim's credentials, they're rendered useless once challenged for the authenticator code or SMS which is
682
CAN Injection: Keyless car theft
This is a detective story about how a car was stolen - and how it uncovered an epidemic of high-tech car theft. It begins with a tweet. In April 2022, my friend Ian Tabor tweeted that vandals had been at his car, pulling apart the headlight and unplugging the cables.
683
Malicious attack on Wikipedia – what we know and what we’re doing
Today, Wikipedia was hit with a malicious attack that has taken it offline in several countries for intermittent periods. The attack is ongoing and our Site Reliability Engineering team is working hard to stop it and restore access to the site. As one of the world’s most popular sites, Wikipedia sometimes attracts…
684
685
Major European payment processor can't send email to Google Workspace users
Viva.com, one of Europe's largest payment processors, sends verification emails without a Message-ID header — a requirement of RFC 5322 since 2008. Google Workspace rejects them outright. Their support team's response to my detailed bug report: your account has a verified email, so there's no problem.
686
Ubiquiti all but confirms breach response iniquity
Last year, I posted a series of articles about a purported “breach” at Ubiquiti. My sole source for that reporting was the person who has since been indicted by federal prosecutors for his alleged wrongdoing – which includes providing false information to the press.
687
Stupid security things
My mate Lars Klint shared this tweet the other day: > Your password is not unique. pic.twitter.com/ga4GwxtzrQ [https://t.co/ga4GwxtzrQ] — Lars Klint (@larsklint) April 16, 2017 [https://twitter.com/larsklint/status/853507749488975873] Naturally, I passed it on [https://twitter.com/troyhunt/status/853517036131041280]…
688
An update on the threat landscape
Online security is extremely important for people in Ukraine and the surrounding region right now. Government agencies, independent newspapers and public service provide…
689
Microsoft bakes a VPN into Edge and turns it on
Microsoft has bundled a VPN with its Edge browser, and we expect others to follow suit. But can a built-in VPN replace a full-fledged VPN service, and is it a good example to follow? We give our take.
690
Evidence that Adani Group has engaged in stock manipulation and accounting fraud
Initial Disclosure: After extensive research, we have taken a short position in Adani Group Companies through U.S.-traded bonds and non-Indian-traded derivative instruments. This report relates solely to the valuation of securities traded outside of India. This report does not constitute a recommendation on…