91
GitHub’s database of security advisories is now open source
Anyone can now provide additional information and context to further the community’s understanding and awareness of security advisories.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 350 posts.
92
LastPass: Notice of Security Incident
Please refer to the latest article for updated information.nbs[..]
93
French court: refusing to disclose mobile passcode to law enforcement is a crime
The French Court of Cassation has ruled that people who are suspected or accused of a crime are obliged to reveal the passcode of their mobile phone to the investigative authorities.
94
NPM package compromised by author: erases files on RU / BY computers on install
Vue.js users using the dependency “node-ipc” are experiencing a supply chain attack protesting the invasion of Ukraine, from a package named “peacenotwar”.
95
96
How Go mitigates supply chain attacks
Go tooling and design help mitigate supply chain attacks at various stages.
97
Portmaster 1.0 – Open-Source Network Monitor and Privacy Firewall
Portmaster is a free and open-source application that puts you back in charge over all your computer's network connections. Increase your privacy and security. Get peace of mind.
98
The GNU Name System
This document provides the GNU Name System (GNS) technical specification. GNS is a decentralized and censorship-resistant domain name resolution protocol that provides a privacy-enhancing alternative to the Domain Name System (DNS) protocols. This document defines the normative wire format of resource records…
99
Austria's data protection authority has found that Google Analytics is illegal
Using Google Analytics in a legally compliant way is still possible in Europe. Here we explain how.
100
101
Making an SSH client the hard way
Explore Tailscale SSH Console, a web-based SSH client that simplifies connecting to your devices. Learn how Tailscale integrates WebAssembly, WireGuard, and SSH for secure, password-free access right from your browser."
102
103
I recorded user behaviour on my competitor’s websites (2018)
A test that hijacked the Chrome back button to send visitors to a fake Google results page, then to mirrored competitor pages where heatmaps, sessions and typing were recorded. Google de-indexed the whole domain.
104
The complete guide to protecting your APIs with OAuth2
OAuth2 is one of the most popular specifications for API authentication today, though wrapping your head around it can be a challenge.
105
Dutch schools must stop using Google's email and cloud due to privacy concerns
Dutch Personal Data Authority raised concerns about Google's GDPR compliance.
106
Android Chrome 99 expands Certificate Transparency, breaking all MitM dev tools
Certificate transparency is superb improvement to HTTPS certificate security on the web that's great for users and businesses, but on Android it creates a huge...
107
Tor Browser: a legacy of advancing private browsing innovation
In this post, we want to share a little bit of Tor Browser history with you, the origins of our features and designs, and how many of our innovative privacy and security features have been adopted by other browsers.
108
109
Put an io_uring on it: Exploiting the Linux kernel
How much do you know about system calls and how they introduce security risks? We shed light on these interactions and how security teams monitor them.
110
Attack campaign involving stolen OAuth tokens issued to third-party integrators
On April 12, GitHub Security began an investigation that uncovered evidence that an attacker abused stolen OAuth user tokens issued to two third-party OAuth integrators, Heroku and Travis-CI, to download data from dozens of organizations, including npm. Read on to learn more about the impact to GitHub, npm, and our…
111
Someone is impersonating us in a recruiting scam
Our startup was recently the center of an elaborate recruiting scam. What do other companies do if they realize that someone is impersonating them to attack vulnerable job seekers? This article gives advice to job seekers and shares our story.
112
113
SSH Agent Restriction (new in OpenSSH 8.9)
OpenSSH agent restriction
114
HTTPS Everywhere will sunset in January 2023
You no longer need HTTPS Everywhere to set HTTPS by default! Major browsers now offer native support for an HTTPS only mode. Learn how to turn it on.Read more about the sunset of HTTPS Everywhere.Since we started offering HTTPS Everywhere, the battle to encrypt the web has made leaps and bounds....
115
NPM security update: Attack campaign using stolen OAuth tokens
npm's impact analysis of the attack campaign using stolen OAuth tokens and additional findings.
116
RCE over ham radio – Reverse shell via WinAPRS memory corruption bug
This installment will review and demonstrate functional exploits for WinAPRS on both Windows XP SP3 and Windows 10.
117
NSA's Backdoor of the PX1000-Cr
In 1983, the PX-1000 pocket telex used DES encryption. But with help of Philips, the NSA managed to replace DES with an alternative (weaker) algorithm that they could break. That NSA algorithm is now broken.
118
Real-world stories of how we’ve compromised CI/CD pipelines
Cutting-edge cyber security research from NCC Group. Find public reports, technical advisories, analyses, & other novel insights from our global experts.
119
Shutting down our unencrypted public DNS service
On the 16th January 2023 we will shut down our legacy public DNS service, currently reachable from this IP: 193.138.218.74
120
