61
Rust in Android: move fast and fix things
Last year, we wrote about why a memory safety strategy that focuses on vulnerability prevention in new code quickly yields durable and compounding gains. This year we lo…
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 308 posts.
62
Bots are getting good at mimicking engagement
Click fraud protection in one tool: DataCops flags bot clicks, blocks repeat bots at your Cloudflare edge, keeps them out of the conversions 8 ad platforms learn from, and exports Google refund evidence.
63
FSE meets the FBI
I have for you a bizarre tale of scrapers, feds, data poisoning, Torswats, and everyone's favorite fedi instance. It veers technical, because I suspect it will be of interest to other people running servers with UGC (i.e., every fedi instance), and also because the mechanics of how I figured out what I figured out…
64
How the “Kim” dump exposed North Korea's credential theft playbook
A rare and revealing breach attributed to a North Korean-affiliated actor, known only as “Kim” as named by the hackers who dumped the data, has delivered a new insight into Kimsuky (APT43) tactics, techniques, and infrastructure. This actor's operational profile showcases credential-focused intrusions targeting South…
65
Fighting the New York Times' invasion of user privacy
OpenAI is fighting the New York Times’ demand for 20 million private ChatGPT conversations and accelerating new security and privacy protections to protect your data.
66
The UK is still trying to backdoor encryption for Apple users
The Financial Times reports that the U.K. is once again demanding that Apple create a backdoor into its encrypted backup services. The only change since the last time they demanded this is that the order is allegedly limited to only apply to British users. That doesn’t make it any better.The demand...
67
68
EPA Seeks to Eliminate Critical PFAS Drinking Water Protections
The move continues to expose communities across the country to toxic forever chemicals in tap water
69
Meta accessed women's health data from Flo app without consent, says court
A jury has ruled that Meta accessed sensitive information from women's reproductive health tracking app Flo without consent.
70
Ring introducing new feature to allow police to live-stream access to cameras
Ring founder Jamie Siminoff is back at the helm of the surveillance doorbell company, and with him is the surveillance-first-privacy-last approach that made Ring one of the most maligned tech devices. Not only is the company reintroducing new versions of old features which would allow police to...
71
We identified a North Korean hacker who tried to get a job
Cybersecurity isn’t just a priority for Kraken, it’s part of our origin story and embedded into our DNA.
72
Disrupting the first reported AI-orchestrated cyber espionage campaign
A report describing a highly sophisticated AI-led cyberattack and how we disrupted it.
73
EFF launches Age Verification Hub
With ill-advised and dangerous age verification laws proliferating across the United States and around the world, creating surveillance and censorship regimes that will be used to harm both youth and adults, the Electronic Frontier Foundation has launched a new resource hub that will sort through the mess and help…
74
Websites are tracking you via browser fingerprinting
New research provides first evidence of the use of browser fingerprints for online tracking.
75
Speedrunners are vulnerability researchers, they just don't know it yet
Video game enthusiasts are developing experience in the cybersecurity industry by accident. Discover how gaming skills can translate into intriguing careers.
76
A Safer Container Ecosystem with Docker: Free Docker Hardened Images
Security for everyone. Docker Hardened Images are now free to use, share, and build on with no licensing surprises.
77
Abusing Entra OAuth for fun and access to internal Microsoft applications
The Eye Security Research team has uncovered a new critical misconfiguration that exposed sensitive data at internal Microsoft applications.
78
Flock's gunshot detection microphones will start listening for human voices
Flock Safety, the police technology company most notable for their extensive network of automated license plate readers spread throughout the United States, is rolling out a new and troubling product that may create headaches for the cities that adopt it: detection of “human distress” via audio. As...
79
Federal Court (Finally) Rules Backdoor Searches of Data Unconstitutional
In a landmark ruling, a federal district court held that backdoor searches of databases full of Americans’ private communications collected under Section 702 ordinarily require a warrant. Congress should uphold its responsibility to protect civil rights and civil liberties by refusing to renew Section 702 absent a…
80
Shai Hulud launches second supply-chain attack
The threat actor behind “Shai Hulud 2.0” launched a new malware campaign compromising the supply chain of Zapier, ENS Domains and more — exposing secrets, injecting malicious code, and enabling widespread developer-environment takeover.
81
Menstrual tracking app data is gold mine for advertisers that risks women safety
Cambridge researchers urge public health bodies like the NHS to provide trustworthy, research-driven alternatives to platforms driven by profit.
82
How we rooted Copilot
After a long week, the Eye Security Research Team thought it was time for a small light-hearted distraction. So we rooted Copilot.
83
TinyKVM: Fast sandbox that runs on top of Varnish
TinyKVM can be used to sandbox regular Linux programs or programs with specialized APIs embedded into your servers.
84
85
Denial of service and source code exposure in React Server Components
The library for web and native user interfaces
86
Linux Sandboxes and Fil-C
Memory safety and sandboxing are two different things. It's reasonable to think of them as orthogonal: you could have memory safety but not be sandboxed, or you could be sandboxed but not memory safe.
87
O2 VoLTE: locating any customer with a phone call
Privacy is dead: For multiple months, any O2 customer has had their location exposed to call initiators without their knowledge.
88
Opening up ‘Zero-Knowledge Proof’ technology
Today, we open sourced our Zero-Knowledge Proof (ZKP) libraries, fulfilling a promise and building on our partnership with Sparkasse to support EU age assurance.
89
Tell the EU: Don't Break Encryption with "Chat Control"
The EU’s Chat Control law would scan private messages and weaken encryption. Sign Mozilla Foundation’s petition to defend privacy and protect our digital future.
90
Introducing a terms of use and updated privacy notice for Firefox
UPDATE: We’ve seen a little confusion about the language regarding licenses, so we want to clear that up. We need a license to allow us to make some of t