181
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,768 posts.
182
183
France rejects backdoor mandate
In a moment of clarity after initially moving forward a deeply flawed piece of legislation, the French National Assembly has done the right thing: it rejected a dangerous proposal that would have gutted end-to-end encryption in the name of fighting drug trafficking.
184
Shai-Hulud Returns: Over 300 NPM Packages Infected
Over 1,000 NPM packages were infected using the same method as the previous attack, infecting with a fake Bun runtime. The attacker leveraged the `preinstall` script to download and execute a malicious payload, stealing sensitive information from the compromised machines.
185
30k U.S. organizations newly hacked via holes in Microsoft Exchange Server
At least 30,000 organizations across the United States — including a significant number of small businesses, towns, cities and local governments — have over the past few days been hacked by an unusually aggressive Chinese cyber espionage unit that’s focused on stealing email from victim organizations, multiple sources…
186
How Dropbox Hacks Your Mac
Update: Dropbox hack blocked by Apple in Sierra Following my post revealing Dropbox’s Dirty Little Security Hack a few weeks ago, I thought I’d look deeper into how Dropbox was getti…
187
“PayPal has demanded that we monitor data traffic as well as customers’ files”
Seafile is an open source, self-hosted file sync and share solution with high performance and reliability. Sync, access, and collaborate on files on your own server or private cloud.
188
How to own an airline in 3 easy steps and grab the TSA nofly list along the way
and grab the TSA nofly list along the way
189
The Horror of a 'Secure Golden Key'
You're reading the Keybase blog. There are more posts . When you're done, you can install Keybase .
190
The dots do matter: how to scam a Gmail user
Gmail's "dots don't matter" feature lets scammers create an account on, say, Netflix, with your email address but different dots. Results in convincing phishing emails.
191
Age verification is just a precursor to automated attribution of speech
Lots of US states, European countries, and Australia have introduced "age verification" regulations. They present it as the classic "save the children" talking ...
192
Bug in macOS 14 Sonoma prevents our app from working
The macOS 14 Sonoma betas and release candidate contain a bug that causes the firewall to not filter traffic correctly. As a result, our app does not work.
193
There is no WhatsApp 'backdoor'
Today, The Guardian published a story falsely claiming that WhatsApp’s end-to-end encryption contains a “backdoor.”
194
195
DOGE worker’s code supports NLRB whistleblower
A whistleblower at the National Labor Relations Board (NLRB) alleged last week that denizens of Elon Musk’s Department of Government Efficiency (DOGE) siphoned gigabytes of data from the agency’s sensitive case files in early March. The whistleblower said accounts created for DOGE at the NLRB downloaded three code…
196
GitHub Source Code Leak
Straight talk on Canadian online privacy, open-source software, PIPEDA, browser extension security, and practical tools to protect your personal data.
197
I won't connect my dishwasher to your cloud
This weekend I had to buy a new dishwasher because our old GE died. I bought a Bosch 500 series because that's what Consumer Reports recommended, and more importantly, I could find one in stock. After my dad and I got it installed, I went to run a rinse cycle, only to find that that, along with features like delayed…
198
Backdoor in Claude Code for VS Code extension on the Cursor Marketplace
Phorion has detected a backdoor in the official Claude Code for VS Code extension bundle on the Cursor Marketplace that drops a persistent SSH backdoor across macOS, Linux, and Windows. This write-up …
199
Android may soon restrict on-device ADB
Changes proposed for ADB could kill an entire ecosystem of open-source power-user apps, mobile developer setups, and rootless privacy tools based on Shizuku.
200
Yahoo installed a backdoor for the NSA behind the back of the security team
[Update (12/14/16): Reuters has specified that the rootkit was implemented as a Linux kernel module. Wow.]
201
LastPass autofill exploit
Mathias Karlsson decided to check out the security of the LastPass browser extensions. Here's what he found.
202
Mastercard DNS error went unnoticed for years
The payment card giant MasterCard just fixed a glaring error in its domain name server settings that could have allowed anyone to intercept or divert Internet traffic for the company by registering an unused domain name. The misconfiguration persisted for nearly five years until a security researcher spent $300 to…
203
A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution
Posted by Ian Beer & Samuel Groß of Google Project Zero We want to thank Citizen Lab ...
204
Bill C-22, the Lawful Access Act: Dangerous backdoor surveillance risks remain
The decades-long battle over lawful access entered a new phase yesterday with the introduction of Bill C-22, the Lawful Access Act. This bill follows the attempt last spring to bury lawful access provisions in Bill C-2, a border measures bill that was the new government’s first piece of substantive legislation. The…
205
How is NSA breaking so much crypto?
There have been rumors for years that the NSA can decrypt a significant fraction of encrypted Internet traffic. In 2012, James Bamford published an article quoting anonymous former NSA officials stating that the agency had achieved a “computing breakthrough” that gave them “the ability to crack current public…
206
1Password Travel Mode: Protect your data when crossing borders
Travel Mode protects your 1Password data from unwarranted searches when you travel. Find out how – and why — to use it.
207
PIA VPN to be acquired by malware company founded by former Israeli spy
telegra.ph/private-internet-access-vpn-acquired-by-malware-business-founded-by-former-israeli-spies-12-0120191,004 points359 commentsSecurity & Privacy details
arccompute.com/blog The following article contains quotes and links meant to inform VPN consumers concerning the ownership, affiliations, and past business practices of Kape Technologies (formerly known as Crossrider) in light of their acquisition of Private Internet Access VPN. I'd like to start by giving credit…
208
How we recovered $300k of Bitcoin
Story time! Around twenty years ago, I was working as a reverse-engineer and cryptanalyst for AccessData while getting my Physics degree at BYU. It was the late 90s and early 2000s. The US governme…
209
210
Emailing a one-time code is worse than passwords
where my words occasionally escape /dev/null