121
Firefox 83 introduces HTTPS-Only Mode
Security on the web matters. Whenever you connect to a web page and enter a password, a credit card number, or other sensitive information, you want to be sure ...
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,439 posts.
122
Chrome 56 will mark HTTP pages with password fields as non-secure
Posted by Emily Schechter, Chrome Security Team [Updated on 12/5/16 with instructions for developers] Developers : Read more about how to ...
123
There were BGP anomalies during the Venezuela blackout
The Low Orbit Security Radar is a weekly security newsletter from an offensive practitioner's perspective. One idea, curated news, and links worth your time. News: There Were BGP Anomalies During The Venezuela Blackout When watching the situation in Venezuela unfold, the phrase "It was dark, the lights of Caracas
124
NSO Group iMessage Zero-Click Exploit Captured in the Wild
While analyzing the phone of a Saudi activist infected with NSO Group’s Pegasus spyware, we discovered a zero-day zero-click exploit against iMessage. The exploit, which we call FORCEDENTRY, targets Apple’s image rendering library, and was effective against Apple iOS, MacOS and WatchOS devices.
125
Privacy Pass Authentication for Kagi Search
Today we are announcing a new privacy feature coming to Kagi Search. Privacy Pass is an authentication protocol first introduced by Davidson et al., in [1], and recently standardized by the IETF as RFCs [2—4]. Our...
126
This shouldn't have happened: A vulnerability postmortem
Posted by Tavis Ormandy, Project Zero Introduction This is an unusual blog post. I normally wri...
127
We found a stable Firefox identifier linking all your private Tor identities
We discovered a privacy vulnerability in Firefox Private Browsing and Tor Browser that allows websites to fingerprint and track users across origins using IndexedDB database ordering, even after closing all private windows.
128
French govt. says users of uBlock Origin, Signal etc. are potential terrorists
This article was written on the basis of information related to the so-called "8 December" case (see the footnotes for a global overview of the case, we focus on the "numerical part" of it in this article<fn>For a summary of the 8 December affair see in particular the testimonies available in thi
129
Hidden backdoor API to root privileges in Apple OS X
TL;DR The Admin framework in Apple OS X contains a hidden backdoor API to root privileges. It’s been there for several years (at least since 2011), I found it in October 2014 and it can be exploite…
130
Deconstructing Google’s excuses on tracking protection
By Jonathan Mayer and Arvind Narayanan. Blocking cookies is bad for privacy. That’s the new disingenuous argument from Google, trying to justify why Chrome is so far behind Safari and Firefox in offering privacy protections. As researchers who have spent over a decade studying web tracking and online advertising, we…
131
Notepad++ hijacked by state-sponsored actors
Following the security disclosure published in the v8.8.9 announcement https://notepad-plus-plus.org/news/v889-released/ the investigation has continued in collaboration with external experts and with the full involvement of my (now former) shared hosting provider.
132
Chat Control 1.0 and 2.0 Explained
What is the difference between Chat Control 1.0 and Chat Control 2.0? A clear overview of both EU laws, their timelines, and where things stand today.
133
EFF sues Proctorio on behalf of student falsely DMCA'd
Phoenix, Arizona—The Electronic Frontier Foundation (EFF) filed a lawsuit today against Proctorio Inc. on behalf of college student Erik Johnson, seeking a judgment that he didn’t infringe the company’s copyrights when he linked to excerpts of its software code in tweets criticizing the software...
134
An even worse anti-encryption bill than EARN IT
On Tuesday, June 23, Senators Graham (R-SC), Cotton (R-AR), and Blackburn (R-TN) introduced a bill that is a full-frontal nuclear assault on encryption in the United States. You can find the bill text here. It's been formally introduced as Senate bill 4051, which you can
135
Germany: New government plans 'right to encryption'
The coalition contract of the newly elected German government contains right to encryption.
136
Leaving Beta, New Sponsors
Let’s Encrypt is leaving beta today. We’re also excited to announce that founding sponsors Cisco and Akamai have renewed their Platinum sponsorships with 3-year commitments, Gemalto is joining as our newest Gold sponsor, and HP Enterprise, Fastly, Duda and ReliableSite.net are our newest Silver sponsors. Since our…
137
Any sufficiently advanced uninstaller is indistinguishable from malware
The common pattern of trying to delete yourself.
138
Polyfill supply chain attack hits 100K+ sites
The new Chinese owner of the popular Polyfill JS project injects malware into more than 100 thousand sites.
139
The New York Times Is Now Available as a Tor Onion Service
Updated: March 4, 2025
140
Why Do Keynote Speakers Keep Suggesting That Improving Security Is Possible?
Some people enter the technology industry to build newer, more exciting kinds of technology as quickly as possible. My keynote will savage these people and will burn important professional bridges, likely forcing me to join a monastery or another penance-focused organization. In my keynote, I will explain why the…
141
Firefox rolls out Total Cookie Protection by default to all users
Updated Aug. 28, 2024. Take back your privacy Firefox is rolling out Total Cookie Protection by default to more Firefox users worldwide, making Firefox the
142
Facial recognition: It’s time for action
In July, we shared our views about the need for government regulation and responsible industry measures to address advancing facial recognition technology. As we discussed, this technology brings important and even exciting societal benefits but also the potential for abuse. We noted the need for broader study and…
143
Remote Code Execution on a Facebook server
I regularly search for vulnerabilities on big services that allow it and have a Bug Bounty program. Here is my first paper which covers a vulnerability I discovered on one of Facebook’s servers.
144
145
146
147
Claude Cowork exfiltrates files
Claude Cowork is vulnerable to file exfiltration attacks via indirect prompt injection as a result of known-but-unresolved isolation flaws in Claude's code execution environment.
148
How I Hacked Facebook and Found Someone's Backdoor Script
Bug Bounty Hunting from Pentest View, and How to Find Remote Code Execution and Someone's Backdoor on Facebook Server...
149
150
Every Mac comes with an (undocumented) family member classifier
Every Mac since macOS 13 (2022) ships a pair of daemons whose only purpose in life is to build a graph about who you are, who you know, how those people are related to you and to each other, how you communicate with them, where you go, what you do and when. In this post, we look into how this system works and give you…