Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,769 posts.
Let's Encrypt have announced that on July 8th, 2019 they will begin issuing new certificates from their own intermediate CA and not their current cross-signed intermediate. Here's what that means and what action, if any, site operators need to take…
Today, we permanently banned over 40,000 accounts that were using third-party software to cheat in Dota over the last few weeks. This software was able to access information used internally by the Dota client that wasn't visible during normal gameplay, giving the cheater an unfair advantage. While fixing the…
Research on aligning AI with human values and intent, and reports documenting model failures.
Today, we open sourced our Zero-Knowledge Proof (ZKP) libraries, fulfilling a promise and building on our partnership with Sparkasse to support EU age assurance.
(If you just want some recommendations for what to do, skip down to the Recommendations section below .)
A security blog focusing on Android, the Linux Kernel and everything nice.
Anonymity technologies are becoming a legal requirement for public agency and corporate anti-corruption compliance.
Why the OAuth2 protocol was designed the way it is and how it works.
This is a write-up of the wInd3x bootrom exploit affecting iPod Nanos from 3rd gen to 5th gen. A ready-made tool to use this exploit is available at github.com/freemyipod/wInd3x .
We put a lot of effort into developing an experimental browser extension that could meet all the requirements of Manifest V3 (Chrome's new extension API) and block ads properly within its tight confines. Read the article to find out what we went through and what we achieved.
Today we are announcing our intent to phase out non-secure HTTP. There's pretty broad agreement that HTTPS is the way forward for the web. In recent months, there have been ...
Microsoft Team's link preview feature is susceptible to spoofing and vulnerable to Server-Side Request Forgery. Team's Android users can be DoS'ed and, in the past, their IP address could be leaked.
Results from AI agent permission game: which attacks beat human reviewers, and which safe commands got blocked instead.
*On August 10, 2017, we updated this post with additional National Security Letters (NSLs) we received where, either through litigation or legislation, we have been free…
In May, KrebsOnSecurity broke a story about lax security at a payroll division of big-three credit bureau Equifax that let identity thieves access personal and financial data on an unknown number of Americans. Incredibly, this same division makes it simple to access detailed salary and employment history on a large…
SQLite is probably the most popular embedded database in use today; it is also known for being exceptionally well-tested and robust. In co...
In my previous blog posts, Azure’s Weakest Link? and Azure’s Weakest Link - Full Cross-Tenant Compromise, I gave an overview of the severely insecure architecture behind API Connections in Azure, a part of Azure Logic Apps, and an instance of a full cross-tenant compromise using these inherent flaws. Now I am back…
You probably came here because your Mac showed a message telling you that software from “Objective Development Software GmbH” (Little Snitch) loaded a system extension that will no longer be compatible with a future version of macOS and that you…
Introduction I've been on a bit of a floppy disc protection odyssey recently. This will probably be the last floppy disc related post for so...
On June 20th, board members of the „Zwiebelfreunde“ association in multiple German cities had their homes searched under the dubious pretence that they were „witnesses“ while their computers and...
A security audit funded by Mozilla has discovered a critical security vulnerability in the widely used macOS terminal emulator iTerm2.
Posted by Mark Seaborn, sandbox builder and breaker, with contributions by Thomas Dullien, revers...
Those of you who haven’t been in IT for far, far too long might not know that next month will be the 16th(!) anniversary of the disclosure of what was, at the time, a fairly earth-shattering revelation: that for about 18 months, the Debian OpenSSL package was generating entirely predictable private keys .
Learn cryptography in Go by building ciphers, hashes, password security, and encryption tools. Understand security beneath the library call.
or: reverse-engineering a custom, unknown CPU from a single programtl;dr: We reverse-engineered a program written for a completely custom, unknown CPU architecture, without any documentation for th…
