781
WebAssembly and Back Again: Fine-Grained Sandboxing in Firefox 95
In Firefox 95, we're shipping a sandboxing technology called RLBox — developed with researchers at UC San Diego and the University of Texas
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,439 posts.
782
Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised
A compromised npm maintainer account published 637 malicious versions across 317 packages including size-sensor, echarts-for-react, timeago.js, and hundreds…
783
Hack your way through Stripe's Capture the Flag
Online payment processing for internet businesses. Stripe is a suite of payment APIs that powers commerce for businesses of all sizes.
784
785
AAD misconfiguration led to Bing.com results manipulation, account takeover
How Wiz Research found a common misconfiguration in Azure Active Directory that compromised multiple Microsoft applications, including a Bing management portal
786
This POODLE bites: exploiting the SSL 3.0 fallback
Today we are publishing details of a vulnerability in the design of SSL version 3.0. This vulnerability allows the plaintext of secure conn...
787
New Mac ransomware spreading through piracy
We analyze a new Mac ransomware that appears to encrypt user files with a bit of a time delay. The ransomware encrypts files with little strategy.
788
Updates to GitHub Copilot interaction data usage policy
From April 24 onward, interaction data from Copilot Free, Pro, and Pro+ users will be used to train and improve our AI models unless they opt out.
789
790
Dark Patterns at Scale: Findings from a Crawl of 11K Shopping Websites (2019)
Dark patterns are user interface design choices that benefit an online service by coercing, steering, or deceiving users into making unintended and potentially harmful decisions. We conducted a large-scale study, analyzing ~53K product pages from ~11K shopping websites to characterize and quantify the prevalence of…
791
Firefox 87 introduces SmartBlock for Private Browsing
Today, with the launch of Firefox 87, we are excited to introduce SmartBlock, a new intelligent tracker blocking mechanism for Firefox Private Browsing and Strict Mode. SmartBlock ensures that strong ...
792
Results of technical investigations for Storm-0558 key acquisition
Microsoft Security Response Center Blog
793
Mozilla takes action to protect users in Kazakhstan
Today, Mozilla and Google took action to protect the online security and privacy of individuals in Kazakhstan. Together the companies deployed technical so
794
Hardening Firefox with Claude Mythos Preview
New details about what we found, and how agentic harnesses are now able to reproduce real bugs and dismiss false positives.
795
Mitmproxy 11: Full HTTP/3 Support
We are excited to announce the release of mitmproxy 11, which introduces full support for HTTP/3 in both transparent and reverse proxy modes. We’re also bringing in a ton of DNS improvements that we’ll cover in this blog post.
796
EPA Seeks to Eliminate Critical PFAS Drinking Water Protections
The move continues to expose communities across the country to toxic forever chemicals in tap water
797
Meta accessed women's health data from Flo app without consent, says court
A jury has ruled that Meta accessed sensitive information from women's reproductive health tracking app Flo without consent.
798
Remotely Compromising Android and iOS via a bug in Broadcom's WI-FI Chipsets
Author: Nitay Artenstein Introduction Fully remote exploits that allow for compromise of a target without any user interaction have become something of a myth in recent years. While some are occasionally still found against insecure and unpatched targets such as routers, various IoT devices or old versions of Windows…
799
Git security vulnerabilities announced
Git users are encouraged to upgrade to the latest version, especially if they use `git archive`, work in untrusted repositories, or use Git GUI on Windows.
800
API Tokens: A Tedious Survey
Documentation and guides from the team at Fly.io.
801
Everything you should know about certificates and PKI but are too afraid to ask
Certificates and public key infrastructure (PKI) are hard. No shit, right? I know a lot of smart people who''ve avoided this particular rabbit hole. Eventually, I was forced to learn this stuff because of what it enables: PKI lets you define a system cryptographically. It''s universal and vendor-neutral yet poorly…
802
JSON Web Tokens should be avoided
JWT, JWE, JWS, etc. are terrible designs and need to be scrapped, not resuscitated.
803
Cloudflare targets 2029 for full post-quantum security
Recent advances in quantum hardware and software have accelerated the timeline on which quantum attack might happen. Cloudflare is responding by moving our target for full post-quantum security to 2029.
804
LoJax: First UEFI rootkit found in the wild, courtesy of the Sednit group
ESET researchers have discovered the first in-the-wild UEFI rootkit. Dubbed LoJax, the research team has shown that the Sednit operators used different components of the LoJax malware to target a few government organizations in the Balkans as well as in Central and Eastern Europe.
805
806
Sophisticated OS X Backdoor Discovered
Back in January this year we found a new family of cross-platform backdoors for desktop environments. After the discovery of the binaries for Linux and Windows systems, we have now finally come across the OS X version of Mokes.A.
807
808
The feds' vehicle 'kill switch' mandate is a gross violation of privacy
Over the last century, the Land of the Free has slowly transformed into a land governed by endless laws, largely by cracking down on vices instead of actual crimes, creating a society that would render us all criminals if our behavior were constantly observed. Meanwhile, the state has steadily expanded its use of mass…
809
Notepad++ supply chain attack breakdown
Kaspersky GReAT experts discovered previously undocumented infection chains used in the Notepad++ supply chain attacks. The article provides new IoCs related to those incidents which employ DLL sideloading and Cobalt Strike Beacon delivery.
810
AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely
Today we’re launching AWS Secrets Manager which makes it easy to store and retrieve your secrets via API or the AWS Command Line Interface (AWS CLI) and rotate your credentials with built-in or custom AWS Lambda functions. Managing application secrets like database credentials, passwords, or API Keys is easy when…