3841
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,441 posts.
3842
Microsoft adopts first international cloud privacy standard
Today marks a major milestone, as Microsoft is the first major cloud provider to adopt the world’s first international standard for cloud privacy. It’s another reason customers can move with confidence to the Microsoft Cloud. The standard in question may seem technical, but it has important practical benefits for…
3843
3844
Aserto: Developer API for permissions and RBAC
No one should build permissions and RBAC on their own. Aserto's authorization-as-a-service platform is here to make sure of it!
3845
DNA testing company vanishes along with its customers' genetic data
Atlas Biomed, a DNA testing company that promised clients insights into their genetic disposition has suddenly disappeared.
3846
Preventing Pool-Party Attacks
Brave has identified a new category of tracking vulnerability, forms of which are present in all browsers. We call this category of attack “pool-party” attacks because the attack uses collections (or “pools”) of limited-but-shared resources to create side channels.
3847
3848
Firefox Under Fire: Anatomy of latest 0-day attack
The recent Firefox attacks are an example of active in-the-wild exploitation of a serious software vulnerability.
3849
Ending CAPTCHAs: Introducing Cryptographic Attestation of Personhood
We want to remove CAPTCHAs completely. The idea is rather simple: a real human should be able to touch or look at their device to prove they are human, without revealing their identity. Let's explore!
3850
3851
Introducing App Engine Firewall
A key security feature for application developers and administrators is to be able to allow or deny incoming requests based on source IP addresses. This capability can help you do production testing without exposing your app to the world, block access to your app from specific geographies or block requests from a…
3852
Superhuman AI Exfiltrates Emails
Superhuman AI was able to exfiltrate sensitive emails from user accounts - without the user even being aware. This vulnerability was rapidly remediated by the Superhuman team.
3853
Cryptographically Secure PHP Development
Your field guide to building secure cryptography features in PHP
3854
Leaked admin access token to Python, PyPI, and PSF GitHub repos
The JFrog Security Research team has recently discovered and reported a leaked access token with administrator access to Python’s, PyPI’s and Python Software Foundation’s GitHub repositories, which was leaked in a public Docker container hosted on Docker Hub. As a community service, the JFrog Security Research team…
3855
3856
3857
3858
UK Online Safety Bill threatens encryption, secure communication, and reporting
Does the image above, depicting the rescue of a child who attempted to reach the U.K. by sea, present the act of immigration in “a positive light”? It’s an absurd question, of course. It’s journalism – an effort to convey in visual terms the stark truth that tens of thousands of migrants and asylum-seekers try to…
3859
3860
Open Letter From UK Security Researchers
Dear Reader, The first set of publications based on Edward Snowden’s files were concerned with surveillance of internet communication h...
3861
3862
Serverless security implications from infra to OWASP
By its very nature, Serverless (FaaS) addresses some of today’s biggest security concerns but it doesn’t fix it all. This post outlines the top areas where Serverless helps or hinders our security efforts, offering advice on how to address concerns and thoughts on what’s to come next.
3863
No Leak, No Problem – Bypassing ASLR with a ROP Chain to Gain RCE
After my previous post on ARM exploitation, where we crafted an exploit for a known vulnerability, I decided to continue the research on a more modern IoT target. In this follow-up post, I will take you through building a considerably more complex binary exploit. We will explore the path from firmware extraction and…
3864
Judge's Investigation into Patent Troll Results in Criminal Referrals
In 2022, three companies with strange names and no clear business purpose beyond patent litigation filed dozens of lawsuits in Delaware federal court, accusing businesses of all sizes of patent infringement. Some of these complaints claimed patent rights over basic aspects of modern life; one, for...
3865
But You Told Me You Were Safe: Attacking the Mozilla Firefox Renderer (Part 1)
Vulnerabilities and exploits in common targets like browsers are often associated with memory safety issues. Typically this involves either a direct error in memory management or a way to corrupt internal object state in the JavaScript engine. One way to eliminate such memory safety issues is to use
3866
The end of Roe will bring about a sea change in the encryption debate
With the Supreme Court poised to rip away a constitutional right that’s been the law of the land for nearly half a century by overturning Roe v. Wade, it’s time for the gloves to come off in the encryption debate. For a quarter of a century, it has
3867
Microsoft Defender ATP for Linux is now generally available
Today we are excited to announce general availability of Microsoft Defender Advanced Threat Protection (ATP) for Linux! - This initial release delivers...
3868
Mailpile Chooses AGPL v3
I finally put the team's original plan into action, launching a vote on our new roadmap site , asking our community of backers to help us choose a single license for the project.
3869
3870
Google's response to Reptar CPU vulnerability
Just as Vulnerability Research is an important area of focus at Google, so is Vulnerability Response to critical and complex vulnerabilities. Vulnerability Response at Google not only helps secure Google’s products and users, but in certain cases, it affects millions of devices across the Internet. In this post, we'll…