Topics /
The most popular blog posts about security & privacy on Hacker News. 4,441 posts.
Threats to your IT infrastructure (AWS accounts & credentials, AWS resources, guest operating systems, and applications) come in all shapes and sizes! The online world can be a treacherous place and we want to make sure that you have the tools, knowledge, and perspective to keep your IT infrastructure safe & sound…
Posted by Seth Jenkins, Google Project ZeroIntroduction Android's open-source ecosystem has ...
The following is a summary of an internal research project conducted by Hudson H. and Andrew G.
Posted by Ian Beer of Google Project ZeroThe OS X and iOS kernel code responsible for loading a s...
The Fixed Bounty Bug Revealed Last month Google awarded our security analyst Luka Treiber a Chromium Security Reward for a high-severity ...
Editor's note – May 12, 2023Last year, we launched an important update to Location History. We remain committed to improving the experience and making it as helpful…
News and insights on the Android platform, developer tools, and events.
Over-privileged Azure Key Vault roles & API vulnerabilities let attackers steal credentials silently. Learn how Token Security detects & remediates these critical exposure paths.
The free DNS4EU resolver, for everyone in Europe. Get the addresses, set it up in minutes, and block malware and phishing with no tracking.
The entire family of devices built on the iPhone OS (iPhone, iPod Touch, iPad) have been designed to run only software that is approved by Apple—a major shift from the norms of the personal computer market. Software developers who want Apple's approval must first agree to the iPhone Developer...
Today, the Colorado Supreme Court became the first state supreme court in the country to address the constitutionality of a keyword warrant—a digital dragnet tool that allows law enforcement to identify everyone who searched the internet for a specific term or phrase. In a weak and ultimately...
One of legal tech's clichés is that "lawyers live in Word". This is demonstrably incorrect. I, for example, am a lawyer and in fact live in London, England…
OpenAI responds to the Axios supply chain attack by rotating macOS code signing certificates, updating apps, and confirming no user data was compromised.
A hotel check-in kiosk application crashed when entering a single quote into the guest search, which enabled access to the Windows Desktop. The terminal uses the Ariane Allegro Scenario Player.
Kaspersky’s Global Research and Analysis Team (GReAT) has unveiled a previously unknown hardware feature in Apple iPhones, pivotal to the Operation Triangulation campaign. The team presented this discovery at the 37th Chaos Communication Congress in Hamburg.
Earlier today, the Wall Street Journal published evidence that Google has been circumventing the privacy settings of Safari and iPhone users, tracking them on non-Google sites despite Apple's default settings, which were intended to prevent such tracking. This tracking, discovered by Stanford...
Show issues fixed only in OpenSSL 4.0 , 3.6 , 3.5 , 3.4 , 3.3 , 3.2 , 3.1 , 3.0 , 1.1.1 , 1.1.0 , 1.0.2 , 1.0.1 , 1.0.0 , 0.9.8 , 0.9.7 , 0.9.6 .
Data-only attacks, those that do not affect a program’s control flow, have long been considered too sophisticated and niche to pose a practical threat. With our research, however, we have built a tool that automatically generates them with surprising ease. We explain how such attacks work, and why our tool, Einstein…
The Snyk security research team has made two significant disclosures surrounding the Mintegral SDK. Learn about these SourMint vulnerabilities.
In this report, we analyze the Windows, Android, and iOS versions of Tencent’s Sogou Input Method, the most popular Chinese-language input method in China. Our analysis found serious vulnerabilities in the app’s custom encryption system and how it encrypts sensitive data. These vulnerabilities could allow a network…
The MIKEY-SAKKE protocol is being promoted by the UK government as a better way to secure phone calls. The reality is that MIKEY-SAKKE is designed to offer minimal security while allowing undetectable mass surveillance, through the introduction a backdoor based around mandatory key-escrow. This weakness has…
At the heart of Edward Snowden's decision to expose the NSA's massive phone and Internet spying programs was a fundamental belief in the people's right-to-know. "My sole motive is to inform the public as to that which is done in their name and that which is done against them," he …
Huawei has seemingly stepped its foot into the kernel self-protection game with the release of HKSP. Absent any threat model and riddled with weaknesses, it also introduces a trivially exploitable local root vulnerability due to a complete lack of defensive programming.
UPDATE 5/28: We are going to resume the rollout with the stable release of Chrome M84. More details . With the stable release of Chrome 8...
Add Two-Factor Authentication To Your Website with Google Authenticator and Twilio SMS
Looking for a way to help the Internet stay open and free? This topic needs some dedicated...
