1
Announcing the first SHA-1 collision
Posted by Marc Stevens (CWI Amsterdam), Elie Bursztein (Google), Pierre Karpman (CWI Amsterdam), Ange Albertini (Google), Yarik Markov (Goog...
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,438 posts.
2
No Cookie for You
The developer community remains the heart of GitHub, and we’re committed to respecting the privacy of developers using our product.
3
Motorola announces a partnership with GrapheneOS
Motorola announces three new B2B solutions at MWC 2026, including GrapheneOS partnership, Moto Analytics and more.
4
Reading privileged memory with a side-channel
Posted by Jann Horn, Project ZeroWe have discovered that CPU data cache timing can be abused to e...
5
Apple's plan to “think different” about encryption opens a backdoor to your life
Apple has announced impending changes to its operating systems that include new “protections for children” features in iCloud and iMessage. If you’ve spent any time following the Crypto Wars, you know what this means: Apple is planning to build a backdoor into its data storage system and its messaging system.
6
7
Court: Suspicionless Searches of Travelers’ Phones and Laptops Unconstitutional
Government Must Have Reasonable Suspicion of Digital Contraband Before Searching Electronic Devices at the U.S. Border
8
Firefox Send: Free encrypted file transfer service
At Mozilla, we are always committed to people’s security and privacy. It’s part of our long-standing Mozilla Manifesto. We are continually looking for
9
Launching in 2015: A Certificate Authority to Encrypt the Entire Web
Today EFF is pleased to announce Let’s Encrypt, a new certificate authority (CA) initiative that we have put together with Mozilla, Cisco, Akamai, IdenTrust, and researchers at the University of Michigan that aims to clear the remaining roadblocks to transition the Web from HTTP to HTTPS.Although...
10
Anyone can access deleted and private repository data on GitHub
You can access data from deleted forks, deleted repositories and even private repositories on GitHub. And it is available forever. This is known by GitHub, and intentionally designed that way.
11
Axios compromised on NPM – Malicious versions drop remote access trojan
Hijacked maintainer account used to publish poisoned axios releases including 1.14.1 and 0.30.4. The attacker injected a hidden dependency that drops a cross platform RAT. We are actively investigating and will update this post with a full technical analysis.
12
Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer
Cellebrite makes software to automate physically extracting and indexing data from mobile devices. They exist within the grey – where enterprise branding joins together with the larcenous to be called “digital intelligence.” Their customer list has included authoritarian regimes in Belarus, Russi...
13
1.1.1.1: Fast, privacy-first consumer DNS service
Cloudflare's mission is to help build a better Internet. We're excited today to take another step toward that mission with the launch of 1.1.1.1 — the Internet's fastest, privacy-first consumer DNS service. This post will talk a little about what that is and a lot about why we decided to do it.
14
Zoom Acquires Keybase
You're reading the Keybase blog. There are more posts . When you're done, you can install Keybase .
15
Google’s GDPR Workaround
Brave presents new RTB evidence, and has uncovered a mechanism by which Google appears to be circumventing its purported GDPR privacy protections.
16
Our investigation into the suspicious pressure on Archive.today
Some time ago, we were contacted by a group fighting against online CSAM, demanding that AdGuard DNS blocks the Archive.today website. This was only the beginning of a much larger story…
17
Android Developer Verification: Threat masquerading as protection
If you are running Android 8 or higher, a virus has been installed on your device and is silently awaiting remote activation. Over the past few months, devic...
18
Google broke its promise to me – now ICE has my data
In 2025, Google gave Amandla Thomas-Johnson's data to ICE without giving him the chance to challenge the subpoena, breaking a nearly decade-long promise to notify users before handing their data to law enforcement.
19
Your phone is about to stop being yours
Your phone is about to stop being yours. In 2027, Google will block every Android app whose developer hasn't registered with them.
20
OpenAI and Hugging Face address security incident during model evaluation
OpenAI and Hugging Face share early findings from a security incident during AI model evaluation, highlighting advanced cyber capabilities and lessons for defenders.
21
We spent $20 to achieve RCE and accidentally became the admins of .mobi
Welcome back to another watchTowr Labs blog. Brace yourselves, this is one of our most astounding discoveries. Summary What started out as a bit of fun between colleagues while avoiding the Vegas heat and $20 bottles of water in our Black Hat hotel rooms - has now seemingly become a major
22
Why Raspberry Pi Isn't Vulnerable to Spectre or Meltdown
Eben gives you a crash course in how modern processors work to explain why Raspberry Pi is unaffected by the Spectre and Meltdown security vulnerabilities.
23
Zoom needs to clean up its privacy act
[21 April 2020—Hundreds of people are arriving here from this tweet, which calls me a “Harvard researcher” and suggests that this post and the three that follow are about “the ful…
24
Mark Klein, AT&T whistleblower who revealed NSA mass spying, has died
EFF is deeply saddened to learn of the passing of Mark Klein, a bona fide hero who risked civil liability and criminal prosecution to help expose a massive spying program that violated the rights of millions of Americans.Mark didn’t set out to change the world. For 22 years, he was a...
25
Apple previews Lockdown Mode
Apple today detailed two initiatives to help protect users who may be personally targeted by sophisticated digital threats.
26
Firefox 85 cracks down on supercookies
Trackers and adtech companies have long abused browser features to follow people around the web. Since 2018, we have been dedicated to reducing the number of ways our users can ...
27
Security advisory: Critical remote code execution vulnerabilities, update now
PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.
28
Project Glasswing: Securing critical software for the AI era
A new initiative to secure the world’s most critical software and give defenders a durable advantage in the coming AI-driven era of cybersecurity.
29
Let's Encrypt Root Trusted by All Major Root Programs
As of the end of July 2018, the Let’s Encrypt root, ISRG Root X1, is directly trusted by Microsoft products. Our root is now trusted by all major root programs, including Microsoft, Google, Apple, Mozilla, Oracle, and Blackberry. Today’s announcement that we’re trusted by all major root programs represents a major…
30
Total Cookie Protection
Total Cookie Protection is a major anti-tracking advance in Firefox that confines cookies to the site where they were created.