3661
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,441 posts.
3662
The double standard of webhook security and API security
Explore the surprisingly different security standards we apply to webhooks versus traditional API requests.
3663
3664
Automatic cipher suite ordering in Go’s crypto/tls
Go 1.17 is making TLS configuration easier and safer by automating TLS cipher suite preference ordering.
3665
Announcing SSL Labs Grading Changes for 2017
At SSL Labs, we have a major review of our grading criteria about once a year. As the security of the ecosystem matures, our goal is to push forward and make the requirements [for a good grade]…
3666
Qubes OS 3.2 has been released
I’m happy to announce that today we’re releasing Qubes OS 3.2! This is an incremental improvement over the 3.1 version that we released earlier this year. A lot of work went into making this release more polished, more stable and easier to use than our previous releases. One major featu...
3667
An introduction to JavaScript-based DDoS
CloudFlare protects millions of websites from online threats. One of the oldest and most pervasive attacks launched against websites is the Distributed Denial of Service (DDoS) attack.
3668
3669
Report on FBI’s Use of Patriot Act Highlights Need for Intelligence Reform
The Justice Department’s Office of the Inspector General (OIG) yesterday released another report on the Federal Bureau of Investigation’s use of Section 215 of the Patriot Act between 2007 and 2009. The report was long delayed due to declassification and redaction issues, but the timing is...
3670
3671
A Yubico FAQ about passkeys
Delve into Yubico's comprehensive guide about passkeys, a term encapsulating FIDO/WebAuthn credentials that offer a secure, passwordless experience.
3672
Crowdsourcing a More Secure Future
A guy from Russia just earned $100,000. Crowdsourcing a More Secure Future
3673
Authorization terminology is a mess: Let's fix it
Authorization terminology often conflates ideas and presents complementary technologies as rivals. This post proposes a new taxonomy.
3674
The censorship of WallStreetBets needs to be a watershed moment for everyone
This event is when censorship overstepped a very serious mark.
3675
Critical vulnerability in AI coding platform Base44 allowing unauthorized access
New discovery underscores security implications of AI-powered development and the rise of Vibe Coding Platforms.
3676
A New Life for Certificate Revocation Lists
This month, Let’s Encrypt is turning on new infrastructure to support revoking certificates via Certificate Revocation Lists. Despite having been largely supplanted by the Online Certificate Status Protocol for over a decade now, CRLs are gaining new life with recent browser updates. By collecting and summarizing CRLs…
3677
A wiper attack paralyzed the Iranian train system
In the midst of an epic troll on a country-wide railway system, we discovered a new threat actor and their reusable wiper called Meteor.
3678
Improving privacy and security on the web
In 2008, we launched Chrome with the goal of building a speedy, simple, secure and stable web for everyone, everywhere. Ten years later, use...
3679
TunnelBear Publishes Security Audit
TunnelBear works with Cure53 to complete consumer VPN industry's first public security audit.
3680
Announcing Heroku Free SSL Beta and Flexible Dyno Hours
At Heroku, we want to make it easy for everyone to be able to learn and explore our service, and the related ecosystem of technologies, for free - be it...
3681
Critical flaw in Trezor hardware wallets
Kraken Security Labs has devised a way to extract seeds from both cryptocurrency hardware wallets offered from industry leader Trezor, the Trezor One and Trezor Model T. The attack requires just 15 minutes of physical access to the device. This is the first time that the detailed steps for a current attack against…
3682
Security experts declare all Proton apps secure after security audit
All our apps (Proton Mail, Proton Drive, etc) are open source and independently audited. Anyone can inspect our software and confirm our encryption works.
3683
EFF about EU: EIDAS 2.0 Sets a Dangerous Precedent for Web Security
The Council of the European Union this week adopted new language for regulations governing internet systems that may put the security of your browser at greater risk.The new language affects the EU’s electronic identification, authentication and trust services (eIDAS) rules, which are supposed to...
3684
Cloudflare AKE cuts origin HelloRetryRequests from 52% to 3.7%
Automatic Key Exchange probes TLS 1.3-capable customer origins to learn which key agreement algorithms they support. We then lead with the most secure algorithm when connecting to the origin, preferring post-quantum connections wherever the origin supports it.
3685
Polaris Privacy Initiative to Accelerate User-focused Privacy Online
At Mozilla, we believe that an individuals’ privacy on the Internet cannot be treated as optional. Our Privacy Principles guide us with the design of each of our products and ...
3686
Cross-Account Container Takeover in Azure Container Instances
Affecting Azure Container Instances, Azurescape is the first known cross-account container takeover in the public cloud.
3687
Packet capturing on Windows with netsh
No Wireshark? No TCPDump? No Problem!, Author: Rob VandenBrink
3688
Linux.Rex.1 – A multifunctional self-replicating Trojan for Linux written in Go
A multifunctional self-replicating Trojan for Linux written in Go. The Trojan implements the ВРЕ protocol to share data with other P2P botnet’s nodes and is launched as a node that receives and processes RPC messages. Probably, this malware program’s modification is still under development because ...
3689
Introducing the Cloudflare Onion Service
Two years ago this week Cloudflare introduced Opportunistic Encryption, a feature that provided additional security and performance benefits to websites that had not yet moved to HTTPS.
3690
Exploiting Windows 10 in a Local Network with WPAD/PAC and JScript
by Ivan Fratric, Thomas Dullien, James Forshaw and Steven VittitoeIntroMany widely-deployed techn...