2701
Hacking the T2S+ Out of Fear: Get Lock-In Thermography for Free
Hacking the T2S+ v2 to work on computers, tear it down for the first time online, and play with lock-in thermography as a bonus!
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,770 posts.
2702
The Israeli spyware firm that accidentally just exposed itself
The Billion-Dollar Surveillance Pipeline: From Occupation Technology to Global Control
2703
Dutch schools must stop using Google's email and cloud due to privacy concerns
Dutch Personal Data Authority raised concerns about Google's GDPR compliance.
2704
Mozilla Monitor Plus: automatically remove your personal info from data brokers
Today, Mozilla Monitor (previously called Firefox Monitor), a free service that notifies you when your email has been part of a breach, announced its new p
2705
Android Chrome 99 expands Certificate Transparency, breaking all MitM dev tools
Certificate transparency is superb improvement to HTTPS certificate security on the web that's great for users and businesses, but on Android it creates a huge...
2706
Privacy Analysis of FLoC
In a previous post, I wrote about a new set of technologies “Privacy Preserving Advertising”, which are intended to allow for advertising without compr
2707
2708
2709
Playing chicken with cat.jpg
I was reminded of this by 37signals' response on Monday to last week's cat.jpg privacy failure . To be clear, I have a lot of sympathy for 37signals: Once someone looked in their logs and saw "cat.jpg" as the name of the one hundred millionth file they had stored, I'm sure the resulting fit of laughter significantly…
2710
What I'm Telling US Congress about Data Breaches
Last week I wrote about my upcoming congressional testimony [https://www.troyhunt.com/im-testifying-in-front-of-congress-in-washington-dc-about-data-breaches-what-should-i-say/] and wow - you guys are awesome! Seriously, the feedback there was absolutely sensational and it's helped shape what I'll
2711
2712
The VeraCrypt Audit Results
VeraCrypt 1.18 and its bootloaders were evaluated. This release included a number of new features including non-western developed encryption options, a boot loader that supports UEFI (modern BIOSes), and more.
2713
Netherlands Seizes 800 Servers, Arrests 2 for Aiding Cyberattacks
Authorities in the Netherlands have arrested the co-owners of two related Internet hosting companies for operating IT infrastructure used by Russia to carry out cyberattacks, influence operations and disinformation campaigns inside the European Union. The two men were the focus of a 2025 KrebsOnSecurity story about…
2714
A new set of vulnerabilities affecting users of PGP and S/MIME
UPDATE: Enigmail and GPG Tools have been patched for EFAIL. For more up-to-date information, please see EFF's Surveillance Self-Defense guides.UPDATE (5/14/18): More information has been released. See EFF's more detailed explanation and analysis here.A group of European security researchers have...
2715
Why are banks still getting authentication so wrong?
While recently traveling to the U.S., I was completely locked out of my TD Personal Banking account. TD relies heavily on SMS-based two-factor authenticat...
2716
Did Schnorr destroy RSA? Show me the factors
Schnorr has claimed new factoring methods that “destroy RSA”. This should be easy to demonstrate with well known challenges.
2717
Building a more private web: A path towards making third party cookies obsolete
In August, we announced a new initiative (known as Privacy Sandbox) to develop a set of open standards to fundamentally enhance privacy on...
2718
The .ly domain space to be considered unsafe
I would like to warn current and future owners of .ly domains of a concerning incident regarding the deletion of one of our prime domains…
2719
Firecracker VM Escape: PwnEscape Part 2
Firecracker is supposed to keep untrusted code inside a microVM. We escaped it and achieved code execution as root on the host.
2720
Google Calendar Unexpectedly Leaks Private Information
My wife likes to set reminders for herself in Google Calendar. Recently, she added a note to her personal Google Calendar reading "Email alice@example.com to discuss pay rise" and set the date for a few months from now. She'd had a discussion with her boss, Alice, and they'd agreed to talk about salary later in the…
2721
Website Glitch Let Me Overstock My Coinbase
Coinbase and Overstock.com just fixed a serious glitch that allowed Overstock customers to buy any item at a tiny fraction of the listed price. Potentially more punishing, the flaw let anyone paying with bitcoin reap many times the authorized bitcoin refund amount on any canceled Overstock orders.
2722
Quantifying the Impact of “Cloudbleed”
Last Thursday we released details on a bug in Cloudflare's parser impacting our customers. It was an extremely serious bug that caused data flowing through Cloudflare's network to be leaked onto the Internet.
2723
2724
Running the "Reflections on Trusting Trust" Compiler
Supply chain security is a hot topic today, but it is a very old problem. In October 1983, 40 years ago this week, Ken Thompson chose supply chain security as the topic for his Turing award lecture, although the specific term wasn’t used back then. (The field of computer science was still young and small enough that…
2725
Twitter Direct Message Caching and Firefox
Distinguished engineer Martin Thomson explains how this problem occurred, the implications for people who might be affected, and how problems of this nature might be avoided in future. To get ...
2726
Why we don’t generate elliptic curves every day
Elliptic curves are standardized, instead of being generated like Diffie-Hellman parameters. There's good reasons!
2727
Why (blank) gets you root
tracking down the cause of a serious authentication flaw
2728
Amnesty International: Encryption Is a Human Rights Issue
New Report Analyzes How Crypto Backdoors, Interference with Crypto, and Compelled Disclosure of Encryption Keys All Impact Free Expression and Privacy Defending encryption is a human rights issue, according to a new Amnesty International report. The report calls on nation-states to promote the use...
2729
Life Is About to Get Harder for Websites Without HTTPS
In case you haven't noticed, we're on a rapid march towards a "secure by default" web when it comes to protecting traffic. For example, back in Feb this year, 20% of the Alexa Top 1 Million sites were forcing the secure scheme: These figures are from Scott Helme'
2730
Reflections on Distrusting xz
Was the ssh backdoor the only goal that "Jia Tan" was pursuing with their multi-year operation against xz?