271
Adtech is built on a privacy fault line
The IAPP's Cobun Zweifel-Keegan rounds up the latest privacy developments from Washington, D.C., and elsewhere in the U.S. for the week of 24 July 2023.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 317 posts.
272
Remote Code Execution as a Service
Learn how Earthly Compute, a remote code execution as a service, was built to handle bursty workloads and provide secure and fast remote execution ...
273
How to get a heart attack while using JEB decompiler (2022)
Finding RCE during deobfuscation in JEB decompiler running on Java 18.
274
275
The low, low cost of committing cybercrime
The low, low cost of (committing) cybercrime, Author: Jan Kopriva
276
Reliability via Automated Renewal Information
The Let’s Encrypt team is excited to announce that ACME Renewal Information (ARI) is live in production! ARI makes it possible for our subscribers to handle certificate revocation and renewal as easily and automatically as the process of getting a certificate in the first place. With ARI, Let’s Encrypt can signal to…
277
Microsoft’s Revocation of the Verisign Class 3 Public Primary G5 Root Cert
Microsoft has rolled back the revocation of the Verisign Class 3 Public Primary Certification Authority - G5 Root Certificate.
278
'Reptar', a new CPU vulnerability
A new CPU vulnerability, ‘Reptar,’ found by Google researchers, has been patched by Google and Intel. Here’s what you need to know.
279
280
EU member states still cannot agree about end-to-end encryption
Recently, Wired reported on documents leaked in May from the Council of the European Union’s ongoing deliberations over the draft Child Sex Abuse Regulation. The proposal is controversial because, as presently written, it would require online service providers to proactively scan their services – including users’…
281
282
macOS 14 Sonoma firewall bug fixed
The firewall bug in macOS 14 Sonoma betas and release candidates that we blogged about last week has been fixed by Apple.
283
Messaging layer security: Secure and usable end-to-end encryption
The IETF has approved publication of Messaging Layer Security (MLS), a new standard for end-to-end security that will make it easy for apps to provide the highest level of security to their users. End-to-end encryption is an increasingly important security feature in Internet applications. It keeps users’ information…
284
285
UK Online Safety Bill threatens encryption, secure communication, and reporting
Does the image above, depicting the rescue of a child who attempted to reach the U.K. by sea, present the act of immigration in “a positive light”? It’s an absurd question, of course. It’s journalism – an effort to convey in visual terms the stark truth that tens of thousands of migrants and asylum-seekers try to…
286
Google's response to Reptar CPU vulnerability
Just as Vulnerability Research is an important area of focus at Google, so is Vulnerability Response to critical and complex vulnerabilities. Vulnerability Response at Google not only helps secure Google’s products and users, but in certain cases, it affects millions of devices across the Internet. In this post, we'll…
287
PyPI Requires 2FA for New User Registrations
PyPI requires new users to enable 2FA before performing management actions.
288
Smashing the state machine: the true potential of web race conditions
For too long, web race condition attacks have focused on a tiny handful of scenarios. Their true potential has been masked thanks to tricky workflows, missing tooling, and simple network jitter hiding
289
Enigma Crypto Transmission from KPH at 426 KHz and Shortwave
DA was a part of our KPH project from the beginning. She learned her trade at US Coast Guard master station NMC, adjacent to KPH. At NMC she earned the coveted gold lightning bolt radnoman’s insignia (there was no such thing as a radiowoman in the Coast Guard). She also acquired the salty vocabulary she needed to hold…
290
Norway Fining Meta $98,500 per Day for User Privacy Breach
Norway’s DPA Datatilsynet is penalizing Meta over alleged data privacy breaches, with profound implications across Europe. Learn more in the full news story!
291
TEMU Is Cleverly Hidden Spyware That Poses an Urgent Security Threat to U.S.
Analysis of PDD’s app software by multiple experts is showing all the signs of red-flag concern. The calls to outside device data and functions that violate users’ privacy are far more aggressive than any well-known consumer shopping app.
292
293
CJEU declares Meta's GDPR approach illegal
In today's decision, the CJEU declared Meta/Facebook's GDPR approach largely illegal - similar to noyb's previous litigation before the EDPB leading to a fine of € 390 million.
294
RCE on MikroTik routers with IPv6 RA enabled
MikroTik makes networking hardware and software, which is used in nearly all countries of the world. Our mission is to make existing Internet technologies faster, more powerful and affordable to wider range of users.
295
HTTP/2 Rapid Reset: deconstructing the record-breaking attack
This post dives into the details of the HTTP/2 protocol, the feature that attackers exploited to generate the massive Rapid Reset attacks
296
Concrete: A fully homomorphic encryption compiler
An introduction on how to use the Zama Concrete open source TFHE compiler
297
Windows 11: TPMs and Digital Sovereignty
The problem with enforcing TPMs on consumers
298
EU Digital Identity framework (eIDAS) another kind of chat control?
The proposed EU Digital Identity framework (eIDAS) aims to meddle with the process around internet certificates and will undermine the independence and security assurances of the basis for website security:
299
When does an old iPhone become unsafe to use?
When Apple stops issuing security updates for older iPhones, they become unsafe to use. But exactly how long can you safely keep using an old iPhone, and when should you upgrade?
300
Information about a recent security incident at Mailchimp
Maintaining our security commitment to our customers