91
NL Judge: Meta must respect user's choice of recommendation system
Bits of Freedom komt op voor internetvrijheid door de online grondrechten op communicatievrijheid en privacy te beschermen.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 308 posts.
92
Lotusbail npm package found to be harvesting WhatsApp messages and contacts
Secure the modern software stack with Koi. Gain visibility, context, and real-time protection over extensions, MCPs, and autonomous AI agent endpoints.
93
Firefox expands fingerprint protections
With Firefox 145, we’re rolling out major privacy upgrades that take on browser fingerprinting — a pervasive and hidden tracking technique that lets we
94
GrapheneOS migrates server infrastructure from France
The GrapheneOS project has announced on X that they are ceasing all operations in France, asserting that the country is no longer safe for "open source projects"
95
96
New USPTO Memo Makes Fighting Patent Trolls Even Harder
The U.S. Patent and Trademark Office (USPTO) just made a move that will protect bad patents at the expense of everyone else. In a memo released February 28, the USPTO further restricted access to inter partes review, or IPR—the process Congress created to let the public challenge invalid patents...
97
The Policy Puppetry Attack: Novel bypass for major LLMs
HiddenLayer’s latest research uncovers a universal prompt injection bypass impacting GPT-4, Claude, Gemini, and more, exposing major LLM security gaps.
98
Sign in as anyone: Bypassing SAML SSO authentication with parser differentials
Critical authentication bypass vulnerabilities were discovered in ruby-saml up to version 1.17.0. See how they were uncovered.
99
100
A Postmark backdoor that’s downloading emails
Secure the modern software stack with Koi. Gain visibility, context, and real-time protection over extensions, MCPs, and autonomous AI agent endpoints.
101
Nvidia Security Team: “What if we just stopped using C?” (2022)
Today I want to share a great story about why many NVIDIA products are now running formally verified SPARK code. This blog post is in part a teaser for…
102
Memory safety for web fonts
Learn how and why the Chrome team has replaced FreeType with Skrifa.
103
Google spoofed via DKIM replay attack: A technical breakdown
Learn how a Google spoof used a DKIM replay attack to bypass email security and trick users with a fake subpoena in this real-world phishing case.
104
HTTPS by default
One year from now, with the release of Chrome 154 in October 2026, we will change the default settings of Chrome to enable “Always Use Secure Connections”. This means Ch…
105
How cops can get your private online data
Can the cops get your online data? In short, yes. There are a variety of US federal and state laws which give law enforcement powers to obtain information that you provided to online services. But, there are steps you as a user and/or as a service provider can take to improve online privacy.Law...
106
SystemD Service Hardening
Discover additional security options for systemd units, to include quadlets. These options are everything from system permissions, time manage, BPF, syscall & seccomp filters, etc., all to make your system more secure.
107
Public secrets exposure leads to supply chain attack on GitHub CodeQL
An exposed GitHub token could have been used to launch a supply chain attack on GitHub CodeQL, resulting in source code exposure and repository tampering of CodeQL users.
108
Brave blocks Microsoft Recall by default
Starting in version 1.81 for Windows users, Brave browser will block Microsoft Recall from automatically taking screenshots of your browsing activity.
109
Zero-day flaws in authentication, identity, authorization in HashiCorp Vault
Check Point's AI Security Solutions deliver AI-driven threat prevention and unified security management for advanced protection across enterprise networks.
110
How we’re responding to The NYT’s data demands in order to protect user privacy
OpenAI is fighting a court order at the demands of The New York Times and plaintiffs, which involves retention of consumer ChatGPT and API user data indefinitely. Learn how we’re working to uphold user privacy, address legal requirements, and stay true to our data protection commitments.
111
XBOW, an autonomous penetration tester, has reached the top spot on HackerOne
Learn how XBOW achieved #1 performance in autonomous penetration testing by validating real exploits and outperforming human pentesters in speed and accuracy.
112
Popular GitHub Action tj-actions/changed-files is compromised
Popular GitHub Action tj-actions/changed-files has been compromised with a payload that appears to attempt to dump secrets, impacting thousands of CI pipelines.
113
Rubygems.org AWS Root Access Event – September 2025
As part of standard incident-response practice, Ruby Central is publishing the following post-incident review to the public. This document summarizes the September 2025 AWS root-access event, what occurred, what we verified, and the actions we’ve taken to strengthen our security processes.
114
The cryptography behind passkeys
This post will examine the cryptography behind passkeys, the guarantees they do or do not give, and interesting cryptographic things you can do with them, such as generating cryptographic keys and storing certificates.
115
Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH
OPKSSH (OpenPubkey SSH) is now open-sourced as part of the OpenPubkey project. This enables users and organizations to configure SSH to work with single sign-on technologies like OpenID Connect, removing the need to manually manage & configure SSH keys without adding a trusted party other than your IdP.
116
Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos
tj-actions/changed-files
117
In Memoriam: John L. Young, Cryptome Co-Founder
John L. Young, who died March 28 at age 89 in New York City, was among the first people to see the need for an online library of official secrets, a place where the public could find out things that governments and corporations didn’t want them to know. He made real the idea – revolutionary in its...
118
Emulating an iPhone in QEMU
From black screens and boot issues to rendering quirks and PAC puzzles, here’s what we learned getting iOS to finally say hello.
119
Did 5G kill the IMSI catcher?
Understand the mechanics, risks, and the future of IMSI catching (a.k.a. stealing your cellular ID) in 2025. Read our primer on this niche form of hacking.
120
How Cloudflare blocked a monumental 7.3 Tbps DDoS attack
In mid-May 2025, blocked the largest DDoS attack ever recorded: a staggering 7.3 terabits per second (Tbps).