2371
The Policy Puppetry Attack: Novel bypass for major LLMs
HiddenLayer’s latest research uncovers a universal prompt injection bypass impacting GPT-4, Claude, Gemini, and more, exposing major LLM security gaps.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,769 posts.
2372
French court: refusing to disclose mobile passcode to law enforcement is a crime
The French Court of Cassation has ruled that people who are suspected or accused of a crime are obliged to reveal the passcode of their mobile phone to the investigative authorities.
2373
Industry Concerns about TLS 1.3
Search IETF mail list archives
2374
2375
Google's Abandoned Android Authenticator App
The news has just broken that Google's Authenticator App can have its codes stolen by malware. I doubt Google will ever release a fix for this issue - their 2FA app hasn't been updated since September 2017. Update! 3 months after I published this post, Google updated their app For two-and-a-half years, Google hasn't…
2376
What If We Put Warnings on IoT Devices?
A couple of years ago, I was heavily involved in analysing and reporting on the massive VTech hack [https://www.troyhunt.com/when-children-are-breached-inside/], the one where millions of records were exposed including kids' names, genders, ages, photos and the relationship to parents' records which included their
2377
The US Government has no credibility to compel anybody to weaken security
This is my belated obligatory post about the entire "Apple vs the FBI" episode and whether it should help decrypt the San Bernardino shooter's iPhone. People have commented that I should write something, and I've been reluctant in case I go off in full-rant-mode. I wrote the entire post and…
2378
Formal GDPR complaint against Google’s internal data free-for-all
Brave filed a GDPR complaint v Google for infringing the GDPR “purpose limitation” principle. Enforcement would be tantamount to a functional separation of Google’s business.
2379
CSRF is really dead
A little while back I wrote a blog post about how "CSRF is dead". It focused on SameSite cookies, a powerful yet simple feature to protect your website against CSRF attacks. As powerful as it was, and as much as it will kill CSRF, you had to enable it on
2380
Let's Reverse Engineer Discord
How we reverse engineered Discord’s call protocol and found it being MITM-ed by Discord.
2381
Why Deleting Sensitive Information from GitHub Doesn't Save You
Security and Programming Blog
2382
Senate Testimony on Privacy Rights and Data Collection in a Digital Economy
Idle Words > Talks > Privacy Rights and Data Collection in a Digital Economy (Senate hearing)
2383
EFF’s Tweet About a DMCA Takedown Is Now Subject to an Overzealous Takedown
Get ready for a tale as good as anything you’d see on television. Here’s the sequence of events: the website TorrentFreak publishes an article about a leak of TV episodes, including shows from the network Starz. TorrentFreak tweets its article, Starz sends a copyright takedown notice. TorrentFreak writes about the…
2384
We have a year to fix security everywhere
consumer-grade hardware can run an LLM that hacks the planet. we can stop it, but we don't have much time.
2385
ICE Is Going on a Surveillance Shopping Spree
We need to have a hard look at the surveillance industry. It is a key enabler of vast and untold violations of human rights and civil liberties, and it continues to be used by aspiring autocrats to threaten our very democracy. As long as it exists, the surveillance industry, and the data it generates, will be an…
2386
2387
The insecurity of telecom stacks in the wake of Salt Typhoon
Towards the end of last year, we learned that a group (allegedly affiliated with the Chinese government, referred to as “Salt Typhoon”) breached T-Mobile and other telecommunications co…
2388
The Gates to Hell: Apple’s Notarizing
NeoFinder is a powerful and very fast disk cataloging tool for songs, videos, photos, all your digital documents
2389
NPM package compromised by author: erases files on RU / BY computers on install
Vue.js users using the dependency “node-ipc” are experiencing a supply chain attack protesting the invasion of Ukraine, from a package named “peacenotwar”.
2390
Firefox Release Includes Total Cookie Protection and Multiple Picture-in-Picture
Beginning last year, the internet began playing a bigger role in our lives than ever before. In the US, we went from only three percent of workers to more
2391
Upcoming Hardening in PHP
Personal blog of Julien (jvoisin) Voisin
2392
From email to phone number, a new OSINT approach (2019)
How to find out someone's phone number if you just know their email address and how it can be automated using a new OSINT tool: email2phonenumber
2393
Sign in as anyone: Bypassing SAML SSO authentication with parser differentials
Critical authentication bypass vulnerabilities were discovered in ruby-saml up to version 1.17.0. See how they were uncovered.
2394
2395
2396
Securing a Postgres Database
A comprehensive overview of the best practices for securing access to PostgreSQL databases.
2397
AirPods fast connect security vulnerability
tldr: There's a security vulnerability (CVE-2024-27867) in the firmware of Apple AirPods. Anyone who knows the Bluetooth MAC address (which is somewhat public) can connect to your AirPods and listen to the microphone or play music. Even while the AirPods are connected to your phone (although music would stop playing…
2398
On-device browser translations with Firefox Translations
Firefox can now do offline and privacy-preserving translation of eight languages with more on the way. Powered by open-source and machine-learning.
2399
A cache invalidation bug in Linux memory management
Posted by Jann Horn, Google Project ZeroThis blogpost describes a way to exploit a Linux kernel b...
2400
Dutch DPA fines Uber €290M because of transfers of drivers’ data to the US
Met deze test controleren we of u een mens bent. Hiermee voorkomen we ongeoorloofd gebruik van deze dienst.