1621
Using Zoom? Here are the privacy issues you need to be aware of
If you’re using Zoom while working from home, you should be aware of Zoom's privacy policies, including its “attention tracking” tool.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,768 posts.
1622
HTTP/2-exclusive threats caused by implementation flaws and RFC imperfections
In this research paper James Kettle introduces multiple new classes of HTTP/2-exclusive attacks, demonstrated on popular websites and servers.
1623
SSH Agent Explained
The SSH agent acts behind the scenes to keep you safe. Here's how it works.
1624
1Password for Linux
The wait is over. [1Password for Linux is officially here](https://support.1password.com/getting-started-linux/).
1625
PoisonGPT: We hid a lobotomized LLM on Hugging Face to spread fake news
We will show in this article how one can surgically modify an open-source model, GPT-J-6B, and upload it to Hugging Face to make it spread misinformation while being undetected by standard benchmarks.
1626
Don't run 'strings' on untrusted files
Many shell users, and certainly most of the people working in computer forensics or other fields of information security, have a habit of ru...
1627
1628
How to prevent email spoofing, using an unholy combination of silly standards
How to use SPF, DKIM, and DMARC to improve your domain's email security and limit spoofing - but written for humans.
1629
WebAssembly and Back Again: Fine-Grained Sandboxing in Firefox 95
In Firefox 95, we're shipping a sandboxing technology called RLBox — developed with researchers at UC San Diego and the University of Texas
1630
How I bypassed 2-Factor-Authentication on Google, Facebook, Yahoo, LinkedIn
I remember fondly two years ago, when 2-Factor-Authentication (2FA) became popular and well used across major web applications (Google, Facebook, Yahoo and others). I found, my naive sixteen year old self unable to come to terms for why the genius idea had not been thought of before. At
1631
Thunderstrike – Apple EFI firmware vulnerability
31C3 presentation on the Thunderstrike firmware vulnerability in MacBooks
1632
Apple vs the Law
Apple & Google at the EU DMA compliance workshops, June 2025.
1633
Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised
A compromised npm maintainer account published 637 malicious versions across 317 packages including size-sensor, echarts-for-react, timeago.js, and hundreds…
1634
The IAB loves tracking users but hates users tracking them
The Interactive Advertising Bureau (IAB) is a standards development group for the advertising industry. Their members love tracking users. They want to know where you are, who you're with, what you're buying, and what you think. All so they can convince you to spend slightly more on toothpaste. Or change your…
1635
1636
Should you be concerned about LastPass uploading your passwords to its server?
The answer to this question is still "Yes!" Here I demonstrate yet another way for the server to access your data, the issues being structural.
1637
Hack your way through Stripe's Capture the Flag
Online payment processing for internet businesses. Stripe is a suite of payment APIs that powers commerce for businesses of all sizes.
1638
1639
1640
AAD misconfiguration led to Bing.com results manipulation, account takeover
How Wiz Research found a common misconfiguration in Azure Active Directory that compromised multiple Microsoft applications, including a Bing management portal
1641
Someone at BrowserStack is leaking users' email addresses
Like all good nerds, I generate a unique email address for every service I sign up to. This has several advantages - it allows me to see if a message is legitimately from a service, if a service is hacked the hackers can't go credential stuffing, and I instantly know who leaked my address. A few weeks ago I signed up…
1642
This POODLE bites: exploiting the SSL 3.0 fallback
Today we are publishing details of a vulnerability in the design of SSL version 3.0. This vulnerability allows the plaintext of secure conn...
1643
How the Devteam Conquered the iPhone
The summer of 2007 was an eventful one if you were into cell phones. It all started on June 29 when Apple announced the release of the iPhone. If you have never taken the time to watch the full keynote, I highly recommend it.
1644
New Mac ransomware spreading through piracy
We analyze a new Mac ransomware that appears to encrypt user files with a bit of a time delay. The ransomware encrypts files with little strategy.
1645
My NAS exposes itself over the internet without permission
The Terramaster NAS decided to expose itself to the public internet without asking. Let's see what we can do about it.
1646
Updates to GitHub Copilot interaction data usage policy
From April 24 onward, interaction data from Copilot Free, Pro, and Pro+ users will be used to train and improve our AI models unless they opt out.
1647
1648
I may be the only evil (bit) user on the internet (2015)
Almost every year a joke RFC is made on April 1st (these have caught on so well, that it’s now common to see more than one of these every year), or April Fool’s Day, and some of them are pretty great. Here are some of my favourites:
1649
1650
Dark Patterns at Scale: Findings from a Crawl of 11K Shopping Websites (2019)
Dark patterns are user interface design choices that benefit an online service by coercing, steering, or deceiving users into making unintended and potentially harmful decisions. We conducted a large-scale study, analyzing ~53K product pages from ~11K shopping websites to characterize and quantify the prevalence of…