Topics /
The most popular blog posts about security & privacy on Hacker News. 4,440 posts.
WASHINGTON – Twitter, Reddit, and Internet Association filed an amicus brief late yesterday in support of a lawsuit filed last year by the Knight First Amendment Institute at Columbia University, the Brennan Center for Justice, and Simpson Thacher & Bartlett LLP on behalf of plaintiffs Doc Society and International…
AI agents need a security model that assumes things will go wrong. The right response isn't better permission checks, it's architecture that makes trust unnecessary.
Research By: Yoav Alon, Netanel Ben-Simon Introduction The year 2017 was an inflection point in the vulnerability landscape. The number of new vulnerabilities reported that year was around 14,000, which is over twice the number from the year before (see table below). The probable reason for this is the increased…
It’s no secret that hardware selection is one of the biggest hurdles Qubes users face. Finding a computer that is secure, trustworthy, and compatible is more difficult than it should be. In an effort to address the compatibility aspect of that problem, we introduced the Qubes-certified ...
This project hosts security advisories and their accompanying proof-of-concepts related to research conducted at Google which impact non-Google owned code.
Memory safety and sandboxing are two different things. It's reasonable to think of them as orthogonal: you could have memory safety but not be sandboxed, or you could be sandboxed but not memory safe.
Google Chrome's new platform for extensions, Manifest V3, threatens to limit the functionality of ad blockers. Firefox has found a way around this problem. Read how.
Privacy is dead: For multiple months, any O2 customer has had their location exposed to call initiators without their knowledge.
Research on aligning AI with human values and intent, and reports documenting model failures.
Posted by Nicolas Lidzborski, Gmail Security Engineering Lead and Jonathan Pevarnek, Jigsaw Engineer Today, we’re announcing a variety of...
Update: This feature is now also enabled in Firefox Beta, starting with Firefox Beta 50. Pretty much everyone who uses the web has used a password to log into something. ...
Today, we permanently banned over 40,000 accounts that were using third-party software to cheat in Dota over the last few weeks. This software was able to access information used internally by the Dota client that wasn't visible during normal gameplay, giving the cheater an unfair advantage. While fixing the…
Today, we open sourced our Zero-Knowledge Proof (ZKP) libraries, fulfilling a promise and building on our partnership with Sparkasse to support EU age assurance.
Anonymity technologies are becoming a legal requirement for public agency and corporate anti-corruption compliance.
We put a lot of effort into developing an experimental browser extension that could meet all the requirements of Manifest V3 (Chrome's new extension API) and block ads properly within its tight confines. Read the article to find out what we went through and what we achieved.
Today we are announcing our intent to phase out non-secure HTTP. There's pretty broad agreement that HTTPS is the way forward for the web. In recent months, there have been ...
Microsoft Team's link preview feature is susceptible to spoofing and vulnerable to Server-Side Request Forgery. Team's Android users can be DoS'ed and, in the past, their IP address could be leaked.
Results from AI agent permission game: which attacks beat human reviewers, and which safe commands got blocked instead.
*On August 10, 2017, we updated this post with additional National Security Letters (NSLs) we received where, either through litigation or legislation, we have been free…
In my previous blog posts, Azure’s Weakest Link? and Azure’s Weakest Link - Full Cross-Tenant Compromise, I gave an overview of the severely insecure architecture behind API Connections in Azure, a part of Azure Logic Apps, and an instance of a full cross-tenant compromise using these inherent flaws. Now I am back…
