481
Zoom zero-day discovery
White hat hackers demonstrated a Zoom vulnerability allowing a Remote Code Execution attack at the Pwn2Own event.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,439 posts.
482
483
EU Agencies Falsely Report More Than 550 Archive.org URLs as Terrorist Content
CORRECTION: This post previously identified the sender of the 550 falsely identified URLs as Europol's EU Internet Referral Unit (EU IRU). The sender was in fact, the French national Internet Referral Unit, using Europol's application, which sends the email from an @europol.europa.eu address. The EU IRU has informed…
484
Running your own secure communication service with Matrix and Jitsi
Matrix, the open protocol for secure decentralised communications
485
Sen. Wyden Confirms Cell-Site Simulators Disrupt Emergency Calls
Sen. Ron Wyden has sent a letter to the U.S. Department of Justice concerning disruptions to 911 emergency services caused by law enforcement’s use of cell-site simulators (CSS, also known as IMSI catchers or Stingrays). In the letter, Sen. Wyden states that:Senior officials from the Harris...
486
EFF Wins Access to License Plate Reader Data to Study Law Enforcement Use
San Francisco—Electronic Frontier Foundation (EFF) and the American Civil Liberties Union Foundation of Southern California (ACLU SoCal) have reached an agreement with Los Angeles law enforcement agencies under which the police and sheriff’s departments will turn over license plate data they...
487
Memory Integrity Enforcement
Memory Integrity Enforcement (MIE) is the culmination of an unprecedented design and engineering effort spanning half a decade that combines the unique strengths of Apple silicon hardware with our advanced operating system security to provide industry-first, always-on memory safety protection across our devices …
488
Possible upcoming attempts to disable the Tor network
The Tor Project has learned that there may be an attempt to incapacitate our network in the next...
489
Introducing Firefox Monitor, Helping People Take Control After a Data Breach
Data breaches, when information like your username and password are stolen from a website you use, are an unfortunate part of life on the internet today. I
490
Canadians are running out of time to oppose Bill C-22
Bill C-22, Canada’s Lawful Access Act, passed the House and is before the Senate. It threatens encryption and expands surveillance. Learn more + sign the petition.
491
Open Letter from the OpenID Foundation to Apple Regarding Sign in with Apple
June 27, 2019Mr. Craig Federighi Apple Senior Vice President of Software Engineering One Apple Park Way Cupertino, CA 95014RE: Open Letter from the OpenID Foundation to Apple Regarding Sign In with AppleDear Mr. Federighi,The OpenID Foundation applauds Apple’s efforts to allow users to login to third-party mobile and…
492
TLS certificate lifetimes will officially reduce to 47 days
The CA/Browser Forum has officially voted to amend the TLS Baseline Requirements to set a schedule for shortening both the lifetime of TLS certificates.
493
Trump’s new social media platform found using Mastodon code
From media reports and individual findings that various people have presented to us, it seems that the new social media platform owned by the former president of the United States, Donald J. Trump, so-called Truth Social, is using Mastodon’s source code with various visual adjustments. The platform has not formally…
494
Chrome is entrenching third-party cookies that will mislead users
Related Website Sets is a user-hostile weakening of the Web's privacy model, plainly designed to benefit websites and advertisers, to the detriment of user privacy.
495
Denmark data breach exposes 8.8M people's personal data
Det Centrale Personregister (CPR) har konstateret en alvorlig sikkerhedshændelse. Ved at misbruge en dansk virksomheds lovlige adgang til at søge...
496
497
Announcing Keyless SSL
CloudFlare is an engineering-driven company. This is a story we're proud of because it embodies the essence of who we are: when faced with a problem, we found a novel solution.
498
Surveilance bill rushed through Australian parliament in 24 hours
New Australian surveillance bill enables police to hack your device, collect or delete your data, and take over your social media accounts.
499
GitHub MCP exploited: Accessing private repositories via MCP
We showcase a critical vulnerability with the official GitHub MCP server, allowing attackers to access private repository data. The vulnerability is among the first discovered by Invariant's security analyzer for detecting toxic agent flows.
500
6-Day and IP Address Certificates Are Generally Available
Update: March 11, 2026 If you use Certbot, see Six-Day and IP Address Certificates Available in Certbot for details on requesting these certificates. Short-lived and IP address certificates are now generally available from Let’s Encrypt. These certificates are valid for 160 hours, just over six days. In order to get a…
501
How we hacked McKinsey's AI platform
An autonomous AI agent found a SQL injection in McKinsey's Lilli AI platform. What it extracted was worse than we expected.
502
Tech companies shouldn't be bullied into doing surveillance
The Secretary of Defense has given an ultimatum to the artificial intelligence company Anthropic in an attempt to bully them into making their technology available to the U.S. military without any restrictions for their use. Anthropic should stick by their principles and refuse to allow their...
503
Open Whisper Systems partners with WhatsApp to provide end-to-end encryption
At Open Whisper Systems, our goal is to make private communication simple. For the past three years, we’ve been developing a modern, open source, strong encryption protocol for asynchronous messaging systems, designed to make seamless end-to-end encrypted messaging possible. Today we’re excited ...
504
How Verizon and Turn Defeat Browser Privacy Protections
Update 2014-01-16: Turn announced today they will suspend their zombie cookie program by early February, but left open the possibility to resume in the future. We ask that they end the program permanently.Verizon advertising partner Turn has been caught using Verizon Wireless's UIDH tracking header...
505
Critical Bluetooth vulnerability in Android
On November 3rd, 2019, we have reported a critical vulnerability affecting the Android Bluetooth subsystem. This vulnerability has been assigned CVE-2020-0022 and was now patched in the latest security patch from February 2020. The security impact is as follows:
506
What went wrong inside recalled Anker PowerCore 10000 power banks?
Investigate Anker’s recalled power banks. See how CT scanning uncovers battery defects and improves safety in lithium-ion designs.
507
Adobe Spyware Reveals Again the Price of DRM: Your Privacy and Security
The publishing world may finally be facing its “rootkit scandal.” Two independent reports claim that Adobe’s e-book software, “Digital Editions,” logs every document readers add to their local “library,” tracks what happens with those files, and then sends those logs back to the mother-ship, over...
508
Writing Safe Shell Scripts (2019)
This page was migrated from the old website and has not been manually reviewed, or is here for historical purposes. We make no guarantees that the content is up-to-date or reflects SIPB's current views. Contact sipb-www@mit.edu if anything is broken or you have other questions or feedback.
509
GoodWill ransomware forces victims to donate to the poor
Goodwill ransomware group propagates very unusual demands in exchange for the decryption key. The Robin Hood-like group is forcing its Victims to donate to the poor and provides financial assistance to the patients in need.
510
Google’s OAuth login doesn’t protect against purchasing a failed startup domain
Millions of Americans can have their data stolen right now because of a deficiency in Google’s “Sign in with Google” authentication flow. If you’ve worked for a startup in the past - especially one that has since shut down - you might be vulnerable.