3001
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,441 posts.
3002
Multiple programming languages vulnerable to DoS via hash algorithm collision
oCERT-2011-003 multiple implementations denial-of-service via hash algorithm collision
3003
Advanced sign-in security for your Google account
Insights from Googlers into our products, technology, and the Google culture
3004
Escaping the Safari sandbox with a kernel GPU bug
Posted by Ian BeerTL;DRAn OS X GPU driver trusted a user-supplied kernel C++ object pointer and c...
3005
3006
3007
IntelliJ GitHub Plugin leaking credentials
A new security issue was discovered that affects the JetBrains GitHub plugin on the IntelliJ platform, which could lead to disclosure of access tokens to third-party sites. The issue affects all IntelliJ-based IDEs as of 2023.1 onwards that have the JetBrains GitHub plugin enabled and configured/in-use.
3008
Craig Gentry named MacArthur Fellow for work on fully homomorphic encryption
Fueling a revolution in cryptography and theoretical computer science through his breakthroughs in fully homomorphic encryption, leading to the possibility of more secure cloud computing.
3009
EFF Urges Supreme Court to Take on Unconstitutional NSA Surveillance
WASHINGTON, D.C.—The Electronic Frontier Foundation (EFF) asked the Supreme Court to review and overturn an unprecedented ruling allowing the government to intercept, collect, and store—without a warrant—millions of Americans’ electronic communications, including emails, texts, phone calls, and...
3010
Are blockchains decentralized?
A new Trail of Bits research report examines unintended centralities in distributed ledgers Blockchains can help push the boundaries of current technology in useful ways. However, to make good risk decisions involving exciting and innovative technologies, people need demonstrable facts that are arrived at through…
3011
Fearless SSH: Short-lived certificates bring Zero Trust to infrastructure
Access for Infrastructure, BastionZero’s integration into Cloudflare One, will enable organizations to apply Zero Trust controls to their servers, databases, Kubernetes clusters, and more. Today we’re announcing short-lived SSH access as the first available feature of this integration.
3012
3013
How WhatsApp enables multi-device capability
For years, people have been asking us to create a true multi-device experience that allows people to use WhatsApp on other devices without requiring a smartphone connection. Today, we’re announcing…
3014
3015
3016
World of Warcraft: one simple line of code can cost you dearly
A few days ago, a new type of gold/item scam made the rounds. Usually scamming in MMORPGs is done using social engineering techniques, e.g. an attacker sells a fake item code for alleged in-game items like mounts to a potential victim for in-game currency. But this most recent kind of attack does not only involve…
3017
Surveillance forces journalists to think and act like spies
Once upon a time, a journalist never gave up a confidential source. When someone comes forward, anonymously, to inform the public, it's better to risk time incarcerated than give them up. This ethical responsibility was also a practical and professional necessity. If you promise anonymity, you're obliged to deliver…
3018
Monzo’s Response to Cloudbleed
Your salary sorted into Pots. Your spare change turned into savings. Your money, doing what it should with Monzo.
3019
Firmware update hides a device’s Bluetooth fingerprint
A smartphone’s unique Bluetooth fingerprint could be used to track the device’s user–until now. A team of researchers have developed a simple firmware update that can completely hide the Bluetooth fingerprint, eliminating the vulnerability.
3020
How we found a bug in Amazon ELB
Troubleshooting of an Amazon ELB bug found in production using the Sysdig and Wireshark analysis tools and following a strictly top-down approach.
3021
Download all of your GitHub data
Now you can request an archive of your data from your account settings page.
3022
OpenSK: a fully open-source security key implementation
Posted by Elie Bursztein, Security & Anti-abuse Research Lead, and Jean-Michel Picod, Software Engineer, Google Today, FIDO security...
3023
EFF: Online Speech is Only as Strong as the Weakest Intermediary
Co-authored by Rainey Reitman and Marcia Hofmann The First Amendment to the Constitution guarantees freedom of expression against government encroachment — but that doesn't help if the censorship doesn't come from the government. The controversial whistle-blower website WikiLeaks, which has begun...
3024
Congress Needs to End Warrantless Spying, Not Make It Permanent
Lawmakers are getting serious about renewing the U.S. government’s Internet spying powers, so we need to get serious about stopping their bad proposals. First out of the gate is a bill from Sen. Tom Cotton, an ardent defender of government surveillance. His bill would not just reauthorize, but make...
3025
Lessons from Bug Hunters Who've Found 400 Bugs in Popular DBMSs
TiDB is the distributed SQL database built for AI agents. Vectors, transactions, and analytics in one engine with ACID guarantees and elastic scale.
3026
Amazon S3 Block Public Access: Protection for Your Accounts and Buckets
Update (4/27/2023): Amazon S3 now automatically enables S3 Block Public Access and disables S3 access control lists (ACLs) for all new S3 buckets in all AWS Regions. Update (August 2019)– Fresh screen shots and changes to the names of the options. Newly created Amazon S3 buckets and objects are (and always have been)…
3027
3028
An update on attempted man-in-the-middle attacks
Posted by Heather Adkins, Information Security Manager Today we received reports of attempted SSL man-in-the-middle (MITM) attacks again...
3029
New “Terrorist Content” Regulations: A Grim Day for Digital Rights in Europe
Despite waves of calls and emails from European Internet users, the European Parliament today voted to accept the principle of a universal pre-emptive copyright filter for content-sharing sites, as well as the idea that news publishers should have the right to sue others for quoting news items...
3030
Unpacking the Benefits of Zero Trust Architecture as Defined by NIST
NIST has released a draft of SP 1800-35 , Implementing a Zero Trust Architecture. The lengthy documents lay out their definition of Zero Trust Architecture (ZTA) , the benefits, why it’s important, a few examples of how an organization can implement them, expected results associated with their example builds, and a…