3781
Apple's secret "wispr" request
When an Apple iOS device (iPhone, iPad, iPod) connects to a WiFi network, the first thing it does is make a request to the URL http://www.ap...
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,441 posts.
3782
Why Constant-Time Crypto?
In 1996, Paul Kocher published a novel attack on RSA, specifically on RSA implementations , that extracted information on the private key by simply measuring the time taken by the private key operation on various inputs. It took a few years for people to accept the idea that such attacks were practical and could be…
3783
3784
macOS 14 Sonoma firewall bug fixed
The firewall bug in macOS 14 Sonoma betas and release candidates that we blogged about last week has been fixed by Apple.
3785
Introducing selfie for sign-in: a new way to access your Google Account
Selfie video gives you more options if you’re ever locked out or don’t have access to your usual phone or computer.
3786
You cannot have our user's data
sourcehut is a network of useful open source tools for software project maintainers and collaborators, including git repos, bug tracking, continuous integration, and mailing lists.
3787
The EU Terrorist Content Regulation – a threat to the ecosystem and user rights
The EU has proposed a new law aimed at terrorist content online. Here we outline how the proposal poses a risk for rights and the internet ecosystem.
3788
3789
3790
Are We PEP740 Yet?
PEP 740 is a Python standard for defining cryptographically verifiable attestations hosted by indices like PyPI.
3791
Njalla – A privacy-aware domain registration service
FOR IMMACULATE RELEASE. Announcing the opening of NJAL.LA
3792
Chrome users oblivious to Heartbleed revocation tsunami
Explore thought leadership, industry insights, and other resources related to cybercrime detection, disruption, and takedowns.
3793
Helping to secure internet routing
The internet works reliably, in large part, on the basis of a key technology called Border Gateway Protocol (BGP). BGP is a means by which all junction points on the internet (routers) communicate with each other to dynamically establish the correct (and correctly weighted) paths that network packets should follow to…
3794
Android emulator abused to introduce malware onto PCs
Attackers have compromised the software distribution system of BigNox, developer of a popular Android emulator for PCs and Macs.
3795
Riseup moves to encrypted email in response to legal requests
After exhausting our legal options, Riseup recently chose to comply with two sealed warrants from the FBI, rather than facing contempt of court (which would have resulted in jail time for Riseup birds and/or termination of the Riseup organization). The first concerned the public contact address for an international…
3796
The quantum state of Linux kernel garbage collection
A deep dive into an in-the-wild Android exploit Guest Post by Xingyu Jin, Android Security Resea...
3797
ChaosDB Explained: Azure's Cosmos DB Vulnerability Walkthrough
This is the full story of the Azure ChaosDB Vulnerability that was discovered and disclosed by the Wiz Research Team, where we were able to gain complete unrestricted access to the databases of several thousand Microsoft Azure customers.
3798
The Great DOM Fuzz-Off of 2017
Posted by Ivan Fratric, Project ZeroIntroductionHistorically, DOM engines have been one of the la...
3799
Cascading Spy Sheets: Exploiting the Complexity of Modern CSS for Fingerprinting
In an attempt to combat user tracking, both privacy-aware browsers (e.g., Tor) and email applications usually disable JavaScript. This effectively closes a major angle for user fingerprinting. However, recent findings hint at the potential for privacy leakage through selected Cascading Style Sheets (CSS) features…
3800
3801
Software sandboxing: The basics (2025)
Diving into the territory of software sandboxing is diving into mostly uncharted territory. The necessary pieces to implement good sandboxing in your software are scattered all-around and the pioneers haven’t yet gathered enough knowledge into an unified mappa mundi that can guide new sailors through some well…
3802
3803
Cloudflare Access: Like BeyondCorp, but You Don’t Have to Be at Google to Use It
Tell me if this sounds familiar: any connection from inside the corporate network is trusted and any connection from the outside is not. This is the security strategy used by most enterprises today. The problem is that security is breached, the attacker has access to everything.
3804
Breaking Out of Docker via RunC
Unit 42 brings together world-renowned threat researchers, incident responders and security consultants to create an intelligence-driven, response-ready organization that's passionate about helping you proactively manage cyber risk.
3805
AWS VPC Traffic Mirroring
Running a complex network is not an easy job. In addition to simply keeping it up and running, you need to keep an ever-watchful eye out for unusual traffic patterns or content that could signify a network intrusion, a compromised instance, or some other anomaly. VPC Traffic Mirroring Today we are launching VPC…
3806
Grease: An Open-Source Tool for Uncovering Hidden Vulnerabilities in Binary Code
We take pride in personally connecting with all interested partners, collaborators and potential clients. Please email us with a brief description of how you would like to be connected with Galois and we will do our best to respond within one business day.
3807
DOM Snitch: Google's passive in-the-browser reconnaissance tool
By Radoslav Vasilev from Google Zurich Every day modern web applications are becoming increasingly sophisticated, and as their complexity ...
3808
3809
3810