61
Android 14 introduces cellular connectivity security features
Posted by Roger Piqueras Jover, Yomna Nasser, and Sudhi Herle Android is the first mobile operating system to introduce advanced cellular...
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 317 posts.
62
EU's concealment of secret 'expert list' on CSAM regulation is maladministration
After a year-long inquiry, the EU Ombudsman recommends that the European Commission should monitor stages of progress in every Big Tech case that the Irish Data Protection Commission is responsible for.
63
When MFA isn't MFA, or how we got phished
Due to a recent Google change, MFA isn't truly MFA.
64
PoisonGPT: We hid a lobotomized LLM on Hugging Face to spread fake news
We will show in this article how one can surgically modify an open-source model, GPT-J-6B, and upload it to Hugging Face to make it spread misinformation while being undetected by standard benchmarks.
65
AAD misconfiguration led to Bing.com results manipulation, account takeover
How Wiz Research found a common misconfiguration in Azure Active Directory that compromised multiple Microsoft applications, including a Bing management portal
66
Results of technical investigations for Storm-0558 key acquisition
Microsoft Security Response Center Blog
67
Git security vulnerabilities announced
Git users are encouraged to upgrade to the latest version, especially if they use `git archive`, work in untrusted repositories, or use Git GUI on Windows.
68
The feds' vehicle 'kill switch' mandate is a gross violation of privacy
Over the last century, the Land of the Free has slowly transformed into a land governed by endless laws, largely by cracking down on vices instead of actual crimes, creating a society that would render us all criminals if our behavior were constantly observed. Meanwhile, the state has steadily expanded its use of mass…
69
The Online Safety Bill: An attack on encryption
The Online Safety Bill has some genuinely good intentions, but the proposed legislation is remarkably poor.
70
An experimental Android WebView Media Integrity API early next year
We’re piloting an experimental Android WebView Media Integrity API with select embedded media providers early next year.
71
Proof-of-Work Defense for Onion Services
Today, we are officially introducing a proof-of-work (PoW) defense for onion services designed to prioritize verified network traffic as a deterrent against denial of service (DoS) attacks with the release of Tor 0.4.8.
72
Detect breaches with Canary credit cards
Detect breaches with Canary credit cards! TL;DR; Today we’re releasing a new Canarytoken type: actual credit cards! Head over to canarytokens.org; We give you a valid credit card (number, expiration, and CVC); If anyone ever attempts to use that card you’ll be notified. We recommend placing one anywhere you store…
73
The novel HTTP/2 'Rapid Reset' DDoS attack
Learn how the new DDoS attack technique Rapid Reset works, and how to mitigate it
74
EARN IT Act undermines the privacy, security, and safety of law-abiding users
Yesterday, TechFreedom sent a letter to the Senate Judiciary Committee raising concerns about the Eliminating Abusive and Rampant Neglect of Interactive Technologies Act of 2023 (EARN IT Act). As it did when introduced in each of the past two sessions of Congress, the EARN IT Act undermines the privacy, security, and…
75
We have successfully completed our migration to RAM-only VPN infrastructure
Today we announce that we have completely removed all traces of disks being used by our VPN infrastructure!
76
Element is one of fourteen messaging apps blocked by Central Indian Government
Element is one of 14 messaging apps blocked by the Central Indian Government which - we believe from media reports - relates to Section 69A of the Information Technology Act, 2000.
77
The EARN IT bill is back. We've killed it twice, let's do it again
EARN IT Act is aiming at scanning our messages and photos, we are calling of Senators to oppose this surveillance bill!
78
The first stable release of a memory safe sudo implementation
Prossimo is pleased to announce the first stable release of sudo-rs, our Rust rewrite of the critical sudo utility. The sudo utility is one of the most common ways for engineers to cross the privilege boundary between user and administrative accounts in the ubiquitous Linux operating system. As such, its security is…
79
Google OAuth is broken (sort of)
Today I’m publicizing a Google OAuth vulnerability that allows employees at companies to retain indefinite access to applications like Slack and Zoom, after they’re off-boarded and removed from their company’s Google organization. The vulnerability is easy for a non-technical audience to understand and exploit.
80
81
We will not ‘walk out’ of UK, nor comply with any request to bypass encryption
Tutanota: We will not 'walk out' of UK like Signal. Nor will we comply with any request to bypass our encryption.
82
The FBI proves again it can’t be trusted with Section 702
The FBI doesn’t believe that either our rights or the limitations that Congress has placed upon them matter when it comes to the vast amount of information about us collected under FISA Section 702. The latest exhibit in this is in yet another newly declassified opinion of the Foreign Intelligence Surveillance Court…
83
LogoFAIL: Secure Boot bypass with manipulated boot logos
LogoFAIL by BINARLY: Discover how vulnerable image parsing impacts device manufacturers in the UEFI firmware ecosystem. Learn about critical LogoFAIL…
84
UCLA computer grad constructs “crown jewel of cryptography”
Aayush Jain’s dissertation, “Indistinguishability Obfuscation from Well-Studied Assumptions,” established the feasibility of mathematically rigorous software obfuscation from well-studied hardness conjectures. The central goal of software obfuscation is to transform source code to make it unintelligible without…
85
Mozilla solves the Manifest V3 puzzle to save ad blockers
Google Chrome's new platform for extensions, Manifest V3, threatens to limit the functionality of ad blockers. Firefox has found a way around this problem. Read how.
86
Valve bans 40k Dota 2 accounts using honeypot patch
Today, we permanently banned over 40,000 accounts that were using third-party software to cheat in Dota over the last few weeks. This software was able to access information used internally by the Dota client that wasn't visible during normal gameplay, giving the cheater an unfair advantage. While fixing the…
87
Today Is One of the Biggest Surveillance Votes. Will the FBI Stop Spying?
FISA Reform §702 Is a Threat to Democracy At Home and Abroad.
88
Purple Llama: Towards open trust and safety in generative AI
Meta AI announces Purple Llama, a project for open trust and safety in generative AI, with tools for cybersecurity and input/output filtering.
89
90
Chrome: Heap buffer overflow in WebP
The Stable and Extended stable channels has been updated to 116.0.5845.187 for Mac and Linux and 116.0.5845.187/.188 for Windows, which will...