Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,775 posts.
From the very beginning of VALORANT development, we made it a priority to build out cheating resistance to ensure competitive integrity. In this article, I’ll walk you through one of these anti-cheat systems - Fog of War. This…
There are not a lot of very strong empirical results in the field of programming languages . This is probably because there’s a huge amount of variables to control for, and most of the subjects available to researchers are CS undergraduates. However, I have recently found a result replicated across numerous codebases…
At Let’s Encrypt we’re always looking for ways to improve the security and integrity of the Web PKI. We’re proud to launch multi-perspective domain validation today because we believe it’s an important step forward for the domain validation process. To our knowledge we are the first CA to deploy multi-perspective…
David Fifield, University of California, Berkeley Chang Lan, University of California, Berkeley Rod Hynes, Psiphon Inc Percy Wegmann, Brave New Software Vern Paxson, University of California, Berkeley and the International Computer Science Institute
Since we announced Let’s Encrypt we’ve often been asked how we’ll ensure that we don’t issue certificates for phishing and malware sites. The concern most commonly expressed is that having valid HTTPS certificates helps these sites look more legitimate, making people more likely to trust them. Deciding what to do here…
A possibly revised version of this article can be found at: https://gnupg.org/faq/whats-new-in-2.1.html
Back in 1998, I wrote: Anyone, from the most clueless amateur to the best cryptographer, can create an algorithm that he himself can’t break. In 2004, Cory Doctorow called this Schneier’s law: …what I think of as Schneier’s Law: “any person can invent a security system so clever that she or he can’t think of how to…
To comply with a new EU law, the Digital Markets Act (DMA), which comes into force on March 7th, we’ve made major changes to WhatsApp and Messenger to enable interoperability with third-party messa…
Proton's transparency report with aggregate statistics of legal orders from the Swiss authorities, covering Proton Mail, Proton Drive, and Proton Calendar.
The problem isn’t your camera, it’s malware. Don’t install any software from unknown or sketchy sources, keep your OS up to date, and you should be fine. And if you do have malware on your Mac, the webcam is likely the least of your problems.
Joe Bonneau dives deep into systems using dice to generate random passphrases and introduces EFF's three new wordlists.
At Apple, we believe privacy is a fundamental human right. Our work to protect user privacy is informed by a set of privacy principles, and…
Posted by Matt Linton, Senior Security Engineer and Pat Parseghian, Technical Program Manager [Google Cloud, G Suite, and Chrome customers...
Today we announced support for encrypted SNI, an extension to the TLS 1.3 protocol that improves privacy of Internet users.
Posted by Ryan Sleevi, Software Engineer This post updates our previous notification of a misissued certificate for google.com Followin...
This is a big deal: On May 13th, 2008 the Debian project announced that Luciano Bello found an interesting vulnerability in the OpenSSL package they were distributing. The bug in question was caused by the removal of the following line of code from md_rand.c MD_Update(&m,buf,j); [ .. ] MD_Update(&m,buf,j); /* purify…
LocationSmart , a U.S. based company that acts as an aggregator of real-time data about the precise location of mobile phone devices, has been leaking this information to anyone via a buggy component of its Web site — without the need for any password or other form of authentication or authorization — KrebsOnSecurity…
The Cloudflare lava lamps are used for Internet encryption. Learn about entropy in cryptography and why randomness is essential for SSL encryption.
F-Droid is a popular alternative app repository for Android, especially known for its main repository dedicated to free and open-source software. F-Droid is often recommended among security and privacy enthusiasts, but how does it stack up against Play Store in practice? This write-up will attempt to emphasize major…
Today, The Intercept released documents on election tampering from an NSA leaker. Later, the arrest warrant request for an NSA contractor ...
In a long-awaited decision in hiQ Labs, Inc. v. LinkedIn Corp., the Ninth Circuit Court of Appeals ruled that automated scraping of publicly accessible data likely does not violate the Computer Fraud and Abuse Act (CFAA). This is an important clarification of the CFAA’s scope, which should provide...
Whenever I talk or write about my own security setup, the one thing that surprises people—and attracts the most criticism—is the fact that I run an open wireless network at home. There’s no password. There’s no encryption. Anyone with wireless capability who can see my network can use it to access the internet. To me…
Chrome's HTTP cache partitioning helps with better security and privacy.
Deeper analysis of Storm-0558 techniques for obtaining unauthorized access to email data, tools, and unique infrastructure characteristics.
Guide on using remote attestation in a way that's compatible with GrapheneOS.
Today, v2 of Pwned Passwords was released as part of the Have I Been Pwned service offered by Troy Hunt. Containing over half a billion real world leaked passwords, this database provides a vital tool for correcting the course of how the industry combats modern threats against password security.
The terrorist attacks of September 11have revived proposals for a national identity card system as a way to verify the identity of airline passengers and prevent terrorists from entering the country. For example, the Chairman and CEO of Oracle Corp., Larry Ellison, recently called for the creation of a national ID…
Microsoft’s Jesper Johansson urged people to write down their passwords. This is good advice, and I’ve been saying it for years. Simply, people can no longer remember passwords good enough to reliably defend against dictionary attacks, and are much more secure if they choose a password too complicated to remember and…
