121
Supreme Court asked to strike down immunity for police who brutally beat student
ARLINGTON, Va.—A new cert petition before the United States Supreme Court asks the Justices to strike down an immunity recognized by a lower court for […]
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 317 posts.
122
Google Introduces Passkey Authentication
By: Arnar Birgisson and Diana K Smetters, Identity Ecosystems and Google Account Security and Safety teams Starting today , you can create a...
123
Security audit of account and payment services
Assured AB were contracted to perform a security assessment of our account and payment services between 2022-11-07 and 2022-11-29.
124
EU chat control law will ban open source operating systems
Update: Open source OSes might be saved from being covered depending on the interpretation of EU regulation 2019/1150 2.2.c.
125
Why TSA's Implementation of Facial Recognition Is More Dangerous Than You Think
Facial recognition is an invasive and dangerous surveillance technology. When the government moves forward with pilot programs that will, if fully implemented, subject millions of people on a daily basis to the technology that should give us all pause.
126
Target's EasySweep – Simplifying Skimmer Detection
An article by Anonymous : Target's patented EasySweep device protects guests' data from skimmers.
127
AI browser extensions are a security nightmare
AI-powered browser extensions come with alarming security risks, but most companies still don't have policies for how their employees can use them.
128
Chrome pushes forward with plans to limit ad blockers in the future
Google has set a date for the introduction of Manifest V3 which will hurt the capabilities of many ad blockers.
129
How to turn off Google's "privacy sandbox" ad tracking, and why you should
Google has rolled out "Privacy Sandbox," a Chrome feature first announced back in 2019 that, among other things, exchanges third-party cookies—the most common form of tracking technology—for what the company is now calling "Topics." Topics is a response to pushback against Google’s proposed...
130
Google open-sources Rust crate audits
We hope that by sharing our work with the open-source community, we can make the Rust ecosystem even safer and more secure for everyone.
131
Adtech surveillance and government surveillance are often the same
In the absence of comprehensive federal privacy legislation in the United States, the targeted advertising industry, fueled by personal information harvested from our cell phone applications, has run roughshod over our privacy. Worse, the boundaries between corporate surveillance and government...
132
Article 45 of eIDAS 2.0 will roll back web security by 12 years
The EU is poised to pass a sweeping new regulation, eIDAS 2.0. Buried deep in the text is Article 45, which returns us to the dark ages of 2011, when certificate authorities (CAs) could collaborate with governments to spy on encrypted traffic—and get away with it. Article 45 forbids browsers from...
133
GPT-4 vision prompt injection
Learn what GPT-4 Vision Prompt Injection is, and discover effective strategies to protect your models and data from vulnerabilities.
134
Germany opposes client-side scanning planned by EU
Germany opposes client-side scanning planned by EU - it would create an unprecedented surveillance monster that violates fundamental rights.
135
9th Circuit rejects TSA claim of impunity for checkpoint staff who rape traveler
Last December, we attended and reported on oral argument before the 9th Circuit Court of Appeals in a case in which the Transportation Security Administration (TSA) argued that TSA checkpoint staff have absolute immunity from lawsuits for assault, even sexual assault or rape, committed against travelers they are…
136
Reauthorizing mass surveillance shouldn't be tied to funding the government
Section 702 is the controversial and much-abused mass surveillance authority that expires in December unless Congress renews it. EFF and others have been working hard to get real reforms into the law and have opposed a renewal, and now, we’re hearing about a rushed attempt to tie renewal to funding...
137
Slack's Google Drive App can share your private Docs and Drive files
In 2017, Slack launched a popular Google Drive integration that makes it easy to embed, share, and get notified about new items added to Google Drive, including files, images, docs, and more. We use it daily here at Kapwing, an online video editing startup, since we run internally on top
138
A surprisingly simple way to foil car thieves
Skyrocketing vehicle theft rates in some U.S. cities have drawn attention to an inconvenient truth: the increasing amount of technology in our vehicles can make them increasingly vulnerable to hacking or theft.
139
EU Chat Control Bill Postponed
The EU Regulation to Prevent and Combat Child Sexual Abuse, first published in May 2022, has become the "most criticized law of all time". Here's how to stop it now!
140
CloudFlare’s last Warrant Canary was published over a year ago
A warrant canary is a method by which a communications service provider informs users that it has NOT been served with a secret government subpoena.
141
Pwning the all Google phone with a non-Google bug
It turns out that the first “all Google” phone includes a non-Google bug. Learn about the details of CVE-2022-38181, a vulnerability in the Arm Mali GPU. Join me on my journey through reporting the vulnerability to the Android security team, and the exploit that used this vulnerability to gain arbitrary kernel code…
142
Encrypted Client Hello
We're excited to announce a contribution to improving privacy for everyone on the Internet. Encrypted Client Hello, a new standard that prevents networks from snooping on which websites a user is visiting, is now available on all Cloudflare plans.
143
NilAway: Practical nil panic detection for Go
Uber has widely adopted Golang (Go for short) as a primary programming language for implementing backend services and libraries due to its high performance. The Go monorepo is the largest codebase at Uber, comprising 90 million lines of code (and growing). This makes tooling for writing reliable Go code a critical…
144
Oh-Auth – Abusing OAuth to take over millions of accounts
OAuth Account Takeover. Salt Labs shows how hackers could abuse OAuth to take over millions of accounts on Grammarly, Vidio, and Bukalapak.
145
Reasons to Prefer Blake3 over Sha256
This post is a copy of tweets by Zooko Wilcox-O'Hearn . SHA256 was designed by the NSA. BLAKE (the original) and BLAKE3 were designed by Jean-Philippe Aumasson
146
Malvertising on Google Ads
Criminals are disguising malware as popular software, so users need to think twice before clicking the download button.
147
Beginners guide to building a hardware hacking lab
VSS Hardware Hacking Wiki and Blog Entries
148
“Fractureiser” malware in popular Minecraft mods and modpacks
Malware is being distributed through Minecraft mods and modpacks mainly through CurseForge
149
Data exfiltration from Writer.com with indirect prompt injection
Authors: PromptArmor and Kai Greshake
150
CS:GO: From Zero to 0-Day
We identified three independent remote code execution (RCE) vulnerabilities in the popular Counter-Strike: Global Offensive game. Each vulnerability can be triggered when the game client connects to our malicious python CS:GO server. This post details our journey through the CS:GO binary and conducts a technical deep…