61
Zoom rolled their own encryption scheme, transmit keys through servers in China
This report examines the encryption that protects meetings in Zoom and finds that they have made their own encryption scheme and has significant weaknesses.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,439 posts.
62
Delays aren’t good enough – Apple must abandon its surveillance plans
Apple announced today that it would “take additional time over the coming months to collect input and make improvements” to a program that will weaken privacy and security on iPhones and other products. EFF is pleased Apple is now listening to the concerns of customers, researchers, civil liberties...
63
64
Confirmed: The NSA is Spying on Millions of Americans
Today, the Guardian newspaper confirmed what EFF (and many others) have long claimed: the NSA is conducting widespread, untargeted, domestic surveillance on millions of Americans. This revelation should end, once and for all, the government's long-discredited secrecy claims about its dragnet...
65
Amazon threatens to suspend Signal's AWS account over censorship circumvention
Last week, we received the following email from Amazon: From: [redacted], [redacted] <[redacted]@amazon.com> Subject: Notification of potential account suspension regarding AWS Service Terms Moxie, Yesterday AWS became aware of your GitHub and Hacker News/ycombinator posts des...
66
67
Tech-savvy audiences block Google Analytics
Is Google Analytics still useful and how accurate are its stats? How much data is missing from Google Analytics due to adblockers and privacy-friendly browsers?
68
Warp – Mobile VPN
Today we're excited to announce what we began to plan more than two years ago: the 1.1.1.1 App with WARP performance and security technology. We built Warp from the ground up to thrive in the harsh conditions of the modern mobile Internet.
69
A small number of samples can poison LLMs of any size
Anthropic research on data poisoning attacks shows a few hundred malicious documents can "backdoor" large language models of any size.
70
Someone bought 30 WordPress plugins and planted a backdoor in all of them
Last week, I wrote about catching a supply chain attack on a WordPress plugin called Widget Logic. A trusted name, acquired by a new owner, turned into
71
Use of Google Analytics declared illegal by French data protection authority
In reaction to the invalidation of the Privacy Shield in July 2020 by the Court of Justice of the European Union (CJEU), US President Joe Biden adopted on 7 October 2022 a new legal framework (Executive Order) to strengthen safeguards on the collection and use of personal data by US intelligence agencies.
72
Let's Encrypt Has Issued a Billion Certificates
We issued our billionth certificate on February 27, 2020. We’re going to use this big round number as an opportunity to reflect on what has changed for us, and for the Internet, leading up to this event. In particular, we want to talk about what has happened since the last time we talked about a big round number of…
73
eMudhra to exit global SSL/TLS certificate business
eMudhra Limited (BSE: 543533 | NSE: EMUDHRA), a global digital trust company, today announced that its Board has decided to voluntarily withdraw from the global SSL/TLS certificate business.
74
How we got read access on Google’s production servers
This is the original writeup on how Detectify security researchers gained read access on Google's production servers.
75
PyPI Was Subpoenaed
The PSF received three subpoenas from the US Department of Justice for PyPI user data in March and April of 2023.
76
Our First Certificate Is Now Live
Let’s Encrypt passed another major milestone by issuing our first certificate. You can see it in action here. Our cross signature is not yet in place, however this certificate is fully functional for clients with the ISRG root in their trust store. When we are cross signed, approximately a month from now, our…
77
Today, we hacked what we'd set out to hack: the iPhone
Today, we hacked what we'd set out to hack: the iPhone.
78
Apple sues NSO Group to curb the abuse of state-sponsored spyware
Apple today filed a lawsuit against NSO Group to hold it accountable for abusive surveillance and the targeting of a small number of Apple users.
79
GLM 5.2 beats Claude in our benchmarks
Among models given nothing but a prompt, the best open-weight option beat Claude Opus 4.8.
80
81
82
Postmortem: TanStack NPM supply-chain compromise
On 2026-05-11, an attacker chained a pull_request_target Pwn Request, GitHub Actions cache poisoning across the fork↔base trust boundary, and OIDC token extraction from runner memory to publish 84 malicious versions across 42 @tanstack/* packages on npm. Full postmortem.
83
Smartphones with Qualcomm chip secretly send personal data to Qualcomm
Nitrokey security research reveals that smartphones with Qualcomm chips secretly send device data to Qualcomm without user consent. NitroPhone is not affected.
84
Cloudflare defeats patent troll Sable at trial
Last Thursday, on a clear, sunny morning in Waco, Texas, a jury returned a verdict after less than two hours of deliberation. The jury found that Cloudflare did not infringe the patent asserted against Cloudflare by patent trolls Sable IP and Sable Networks.
85
86
Why we won’t be supporting Sign in with Apple
The official blog of the AnyList team.
87
Firefox Now Available with Enhanced Tracking Protection by Default
It’s been several weeks since I was promoted to Senior Vice President of Firefox, responsible for overall Firefox product and web platform development. A
88
Tips for linking shell companies to their secret owners
At a recent panel at the 2024 NICAR conference, Karrie Kehoe, deputy head of data and research at ICIJ, offered a series of tips for investigating the true owners of shell companies.
89
Claude reveals ECDSA curve origins
The decades-old mystery of the origins of one of the most popular cryptographic standards has been explained.
90
NYT journalist hacked with Pegasus after reporting on previous hacking attempts
Our forensic analysis of two iPhones belonging to Hubbard found evidence of Pegasus infections in July 2020 and June 2021. Notably, these infections occurred after Hubbard reported in January 2020 that we found that he was targeted in 2018 by the Saudi Arabia-linked Pegasus operator that we call KINGDOM.