1411
Tor Browser 9.5
Tor Browser 9.5 is now available from the Tor Browser download page and also from our distribution directory.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,440 posts.
1412
1413
Nearly half of LG smart TV apps contain residential proxy SDKs
Spur scanned 6,038 LG and Samsung smart TV apps and found 2,058 with residential proxy SDKs, exposing privacy and home network risks.
1414
HTTPS Everywhere will sunset in January 2023
You no longer need HTTPS Everywhere to set HTTPS by default! Major browsers now offer native support for an HTTPS only mode. Learn how to turn it on.Read more about the sunset of HTTPS Everywhere.Since we started offering HTTPS Everywhere, the battle to encrypt the web has made leaps and bounds....
1415
MacOS monitoring the open source way
Dash knows your context, your team, and your work, so your team can stay organized, easily find and share knowledge, and keep projects secure, all from one place.
1416
Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos
tj-actions/changed-files
1417
1418
EasyDNS threatened with criminal complaint if client data not disclosed
UPDATE (as of Sept 2021): This post seems to be the de facto clearing house for people receiving these threats from Fechner and crew all over the world. Here is everything you need to know: You can ignore it Nobody has actually been sued We recently received a copyright notice…
1419
You’ve Got 0-Click Mail: Unassisted iOS Attacks RCE via Mobilemail/Maild
October is Cybersecurity Awareness Month! How is your cybersecurity practice going?
1420
Reverse-Engineering the Intel Management Engine
Purism makes premium phones, laptops, mini PCs and servers running free software on PureOS. Purism products respect people's privacy and freedom while protecting their security.
1421
Meta's legal team abandoned its ethical duties
From Big Tobacco to Menlo Park — and the collapse of legal ethics
1422
Make your electronics tamper-evident
If the police ever have physical access to an electronic device like a laptop, even for five minutes , they can install hardware keyloggers, create images of the storage media, or otherwise trivially compromise it at the hardware, firmware, or software level. One way to minimize this risk is to make devices…
1423
NPM security update: Attack campaign using stolen OAuth tokens
npm's impact analysis of the attack campaign using stolen OAuth tokens and additional findings.
1424
1425
1426
57% Fear Government Will Use NSA Data to Harass Political Opponents
There is little public support for the sweeping and unaccountable nature of the National Security Agency surveillance program along with concerns about how the data will be used.Fifty-seven percent (57%) of voters nationwide believe it is likely the NSA data will be used by other government agencies to harass…
1427
RCE over ham radio – Reverse shell via WinAPRS memory corruption bug
This installment will review and demonstrate functional exploits for WinAPRS on both Windows XP SP3 and Windows 10.
1428
Attack Matrix for Kubernetes
While Kubernetes has many advantages, it also brings new security challenges.
1429
Remote code execution in OpenSSH’s forwarded SSH-agent
CVE-2023-38408 is a remote code execution flaw in OpenSSH’s forwarded ssh-agent. Get full exploit details, impact analysis, and Qualys detection guidance.
1430
Police Have Used License Plate Readers at Least 14x to Stalk Romantic Interests
This article was updated on September 3, 2026. For a more comprehensive and up-to-date tally of ALPR abuse, check out IJ’s database of ALPR abuse. […]
1431
Log4j 2.15.0 – Previously suggested mitigations may not be enough
Log4j 2.15.0 and previously suggested mitigations may not be enough, Author: Renato Marinho
1432
A Developer’s Guide to Responding to National Security Letters
When the FBI Shows Up at Your Office with an NSL When you receive thousands of requests from law enforcement each year, it’s actually not a surprise wh
1433
HackedThat: Breaking in to a hardened server via the back door
Earlier this summer, the team atInversoft published a comprehensive andsophisticatedguide to user data security. Theguide spans from hardening servers from p...
1434
In Memoriam: John L. Young, Cryptome Co-Founder
John L. Young, who died March 28 at age 89 in New York City, was among the first people to see the need for an online library of official secrets, a place where the public could find out things that governments and corporations didn’t want them to know. He made real the idea – revolutionary in its...
1435
Tailscale doesn't want your password
Tailscale ditches passwords for passkeys, offering a secure, phishing-resistant, and convenient way to authenticate. Learn how passkeys work, why they’re better than passwords, and how to set them up on your tailnet.
1436
Germany: Data retention to be abolished
According to the German Minister of Justice data retention or "the storage of telecommunications data without any reason" could soon come to an end.
1437
uBlock, I exfiltrate: exploiting ad blockers with CSS
Ad blockers like uBlock Origin are extremely popular, and typically have access to every page a user visits. Behind the scenes, they're powered by community-provided filter lists - CSS selectors that
1438
Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure
Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619. The exploit attempt originated from an IP address associated with a commercial anonymization network. While the vulnerability…
1439
Container Isolation Gone Wrong
A detailed troubleshooting story that covers both simple and complex tales of container isolation. Read this terrific guide for insight from A-Z.
1440