91
Open-Sourcing ClusterFuzz
The latest news from Google on open source releases, major projects, events, and outreach programs for early career developers.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 316 posts.
92
Verified by Twilio
Twilio posts cloud communications trends, customer stories, and tips for building scalable voice and SMS applications with Twilio's APIs.
93
94
Firefox’s Test Pilot Program Returns
Like a cat, the Test Pilot program has had many lives. It originally started as an Add-on before we relaunched it three years ago. Then in January, we anno
95
AMP for email is bad
The US antitrust complaint against Google shows that the claim 'to improve speed with AMP' was false from the start. It is simply a measure to increase ad revenue.
96
PIA open-sources and announces audit plans
The VPN industry looks just like the world of religion - everyone has their different beliefs on who to trust. However, even the diamond in the rough lied
97
The Many Possibilities of iMessage File Vulnerability
Posted by Natalie Silvanovich, Project ZeroCVE-2019-8646 is a somewhat unusual vulnerability I re...
98
99
EasyDNS threatened with criminal complaint if client data not disclosed
UPDATE (as of Sept 2021): This post seems to be the de facto clearing house for people receiving these threats from Fechner and crew all over the world. Here is everything you need to know: You can ignore it Nobody has actually been sued We recently received a copyright notice…
100
101
The StingRay Is Why the 4th Amendment Was Written (2017)
The drafters of the Constitution recognized that restricting the government from violating privacy is essential for a free society. That's why the Fourth Amendment exists. The StingRay clearly violates these standards.
102
103
Privacy Sandbox – Open standards to enhance privacy on the web
Chrome is announcing a new initiative to explore how to evolve the web in a way that advances privacy, while supporting publishers, and free and open content.
104
Unencrypted patient medical information is being broadcast across Vancouver
The Open Privacy Research Society is a non-profit Canadian group based in Vancouver, British Columbia. We believe that moral systems enable consent. Our society exists to invent, create, build, test, publish, deploy, promote, and to encourage the development of such systems
105
Biometric YubiKey
Learn more about what's happening within the tech and cybersecurity industry and the developments in our business and security keys within our Yubico Blog.
106
Cname cloaking, a disguise of third-party trackers
An in-depth exploration of a new method used by tracking companies to disguise their third-party trackers as first-party trackers.
107
Drilling open a smart door lock in 4 seconds
The BBC asked us to have a look at some smart locks for a TV show recently. We didn’t have much prep time, but were genuinely shocked by just how easy this one was to compromise. Usually, we spend time looking at Bluetooth/RF, the mobile app, the API and then move on to hardware. This […]
108
Enabling developers and organizations to use differential privacy
Whether you're a city planner, a small business owner, or a software developer, gaining useful insights from data can help make services work better and answer important questions. But, without strong privacy protections, you risk losing the trust of your citizens, customers, and users.
109
Getting 2FA Right in 2019
Since March, Trail of Bits has been working with the Python Software Foundation to add two-factor authentication (2FA) to Warehouse, the codebase that powers PyPI. As of today, PyPI members can enable time-based OTP (TOTP) and WebAuthn (currently in beta). If you have an account on PyPI, go enable your preferred 2FA…
110
111
NPM lockfiles can be a security blindspot for injecting malicious modules in PRs
In this post, we show you how easy it is to introduce back doors that are easily missed by project owners… leaving your code insecure.
112
Google faces first investigation by its European lead authority over GDPR
Today, Ireland’s Data Protection Commission (DPC) has announced a major GDPR probe into “suspected infringement” by Google’s DoubleClick/Authorized Buyers advertising business. The probe was triggered by a formal complaint from Dr Johnny Ryan, Chief Policy Officer at Brave, the private web browser.
113
Notifying administrators about unhashed password storage
Google’s policy is to store your passwords with cryptographic hashes that mask those passwords to ensure their security. However, we recently notified a subset of our enterprise G Suite customers that some passwords were stored in our encrypted internal systems unhashed. This is a G Suite issue that affects business…
114
Reasons not to reveal your DNA
With over two decades of global impact, Mozilla Foundation continues to lead the movement for a better technology future—powered by people, open by design, and fueled by imagination.
115
Google’s Nest fiasco harms user trust and invades their privacy
Last month, Google announced that its Nest Secure would be updated to work with Google Assistant software. The problem? Google never told users its product had a microphone to begin with. Simple oversight or invasion of privacy? We break it down.
116
If you care about user privacy, don’t use Facebook JavaScript SDK
With email aliases , you can be anonymous online and protect your inbox against spams and phishing.
117
I exploited TLS-SNI-01 issuing Let's Encrypt SSL-certs for any domain (2018)
The original research reports on security issues found in ACME TLS-SNI-01 which caused Let's Encypt to sunset it.
118
Tor Browser 9.0
We want everyone in the world to be able to enjoy the privacy and freedom online Tor provides, and that's why over the past couple years, we've been working hard to boost our UX and localization efforts, with the biggest gains first visible in Tor Browser 8.0. In Tor Browser 9.0, we continue to build upon those…
119
Support for U2F security keys
You can now use U2F-compatible security keys as a second factor for your 1Password account.
120
Defence Against the Docker Arts
Recently, we expanded Heroku’s industry-shaping primitives, adding support for client-side browser apps, composed of HTML, CSS, and JavaScript. This built-in support for static web apps joins the existing Heroku Buildpacks: Ruby, Python, Go, Java, Clojure, Scala, Node.js, PHP, and .NET.