Topics /
The most popular blog posts about security & privacy on Hacker News. 4,440 posts.
Today, Ireland’s Data Protection Commission (DPC) has announced a major GDPR probe into “suspected infringement” by Google’s DoubleClick/Authorized Buyers advertising business. The probe was triggered by a formal complaint from Dr Johnny Ryan, Chief Policy Officer at Brave, the private web browser.
We found three cases where a Claude model reached the internet from an evaluation environment and accessed real systems. We share what happened and what we're changing.
Austrian Supreme Court may refer case to Court of Justice, questioning the basis of Facebook's business model in Europe.
The Department of Justice’s Office of the Inspector General (OIG) last week released a new report that supports what EFF has long suspected: that the FBI’s legal fight with Apple in 2016 to create backdoor access to a San Bernardino shooter’s iPhone was more focused on creating legal precedent than...
We are thrilled to announce that we have begun to enable HTTPS on NYTimes.com, an effort that helps protect the privacy of our readers and ensures the authenticity of our content.
Mini Shai-Hulud malware was injected into keyv and eight related npm packages on August 4, 2026 after an attacker compromised the maintainer's GitHub account
The “PreCheck” program is billed as a convenient service to allow U.S. travelers to “speed through security” at airports. However, the latest proposal released by the Transportation Security Administration (TSA) reveals the Department of Homeland Security’s greater underlying plan to collect face...
In this report, we present a UEFI firmware rootkit that we called CosmicStrand and attribute to an unknown Chinese-speaking threat actor.
Learn what GPT-4 Vision Prompt Injection is, and discover effective strategies to protect your models and data from vulnerabilities.
A Florida judge has sided with the ACLU to order release of information about police use of “stingrays,” which are invasive surveillance devices that send out powerful signals to trick cell phones into transmitting their locations and identifying information. The Tallahassee judge’s pro-transparency decision stands in…
As was mentioned in the original 1.1.1.1 blog post, our policy is to never write client IP addresses to disk and wipe all logs within 24 hours. Still some folks might not want to reveal their IP address to the resolver at all. This is why we are launching a Tor hidden service for our resolver.
Everything you need to know about HIPAA compliance, from the basics to infrastructure requirements to building with AI.
Purism makes premium phones, laptops, mini PCs and servers running free software on PureOS. Purism products respect people's privacy and freedom while protecting their security.
Today we’re introducing Meta accounts: a new way for people to log into their VR headsets that doesn’t require a Facebook account. When we announced that we would start requiring people to log into Meta Quest using a Facebook account, we received a lot of feedback from the Quest community. We took that feedback into…
Germany opposes client-side scanning planned by EU - it would create an unprecedented surveillance monster that violates fundamental rights.
The COVID-19 pandemic is a global public health emergency that requires a coordinated and large-scale response by governments worldwide. However, States’ efforts to contain the virus must not be...
Last December, we attended and reported on oral argument before the 9th Circuit Court of Appeals in a case in which the Transportation Security Administration (TSA) argued that TSA checkpoint staff have absolute immunity from lawsuits for assault, even sexual assault or rape, committed against travelers they are…
It would give the powerful a dangerous new route to manipulate platforms into removing lawful speech that they simply don't like, with President Trump himself saying that he would use the law to censor his critics. The bill passed the Senate in February, and it now heads to the president's desk.
Fine-grained personal access tokens offer enhanced security to developers and organization owners, to reduce the risk to your data of compromised tokens.
Discover how a software bug in Safari 15's IndexedDB API can track your online activity and reveal your identity.
OpenSSH release notes
Section 702 is the controversial and much-abused mass surveillance authority that expires in December unless Congress renews it. EFF and others have been working hard to get real reforms into the law and have opposed a renewal, and now, we’re hearing about a rushed attempt to tie renewal to funding...
Arti 1.0.0 is released and ready for download.
KeePassXC Password Manager
The moment an agent needs to deploy something, it slams face-first into a wall built for humans. Today we're rolling out Temporary Accounts on Cloudflare Workers. Any agent can now run wrangler deploy — temporary and get a live Worker in seconds.
EFF filed an amicus brief today in support of Apple's fight against a court order compelling the company to create specific software to enable the government to break into an iPhone. The brief is written on behalf of 46 prominent technologists, security researchers, and cryptographers who develop...
