1651
Mixpanel Security Breach
Our response to a recent security incident The Signal Inside Mixpanel |
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,440 posts.
1652
We hid backdoors in ~40MB binaries and asked AI + Ghidra to find them
BinaryAudit benchmarks AI agents using Ghidra to find backdoors in compiled binaries of real open-source servers, proxies, and network infrastructure.
1653
Pwning the all Google phone with a non-Google bug
It turns out that the first “all Google” phone includes a non-Google bug. Learn about the details of CVE-2022-38181, a vulnerability in the Arm Mali GPU. Join me on my journey through reporting the vulnerability to the Android security team, and the exploit that used this vulnerability to gain arbitrary kernel code…
1654
No Matter What the FBI Says, Compromising Encryption Is a Technical Issue
What does the FBI want when it comes to the encryption “debate”? At an oversight hearing before the Senate Judiciary Committee today, FBI Director James Comey offered what he called the “good news” that it’s not a debate at all. In fact, he said, government and the tech industry all want the same...
1655
Confidant: an open-source secret management service
I’m pleased to announce the initial open source release of Confidant, a secret management service for AWS users, built by engineers at…
1656
What end-to-end encryption should look like
Check out our progress in end-to-end encryption calls in Jitsi. Give us your crypto knowledge feedback with the code and learn how to demo it here.
1657
AWS Organizations: Centrally Manage Multiple AWS Accounts
Today, AWS launched AWS Organizations: a new way for you to centrally manage all the AWS accounts your organization owns. Now you can arrange your AWS accounts into groups called organizational units (OUs) and apply policies to OUs or directly to accounts. For example, you can organize your accounts by application…
1658
1659
1660
France's supermarket fridges were vulnerable online for months
IPinfo scans reveal that 85% of exposed French refrigeration controllers had known security flaws before the October 2026 cyberattack.
1661
How Police Officers Seize Cash from Innocent Americans
Under civil forfeiture laws, police officers can take money from people with no proof of any wrongdoing, and without filing criminal charges. How does this work, and what happens to the money?
1662
How to stay private when using Android
Android is one of Google’s most important tools for collecting data on users. This guide will help you improve your privacy on Android devices.
1663
Reasons not to reveal your DNA
With over two decades of global impact, Mozilla Foundation continues to lead the movement for a better technology future—powered by people, open by design, and fueled by imagination.
1664
Lumo: Privacy-first AI assistant
Lumo gives you the power to solve problems big and small, while keeping your personal data confidential. Try it now.
1665
1666
Element (Matrix) launches Chatterbox, end-to-end encrypted embedded chat
We’re outrageously pleased to launch Chatterbox, an end-to-end encrypted embedded chat built on Matrix!
1667
Behind GitHub’s new authentication token formats
We’re excited to share a deep dive into how our new authentication token formats are built and how these improvements are keeping your tokens more secure. As we continue to…
1668
Securing Firefox with WebAssembly
Protecting the security and privacy of individuals is a central tenet of Mozilla’s mission. While we continue to make extensive use of both sandboxing and Rust in Firefox to address ...
1669
The First PS4 Kernel Exploit: Adieu
Now we will step back a bit and explain how we managed to jump from the browser process into the kernel such that ps4-kexec et al. are usable.
1670
Encrypted Client Hello
We're excited to announce a contribution to improving privacy for everyone on the Internet. Encrypted Client Hello, a new standard that prevents networks from snooping on which websites a user is visiting, is now available on all Cloudflare plans.
1671
Next.js version 15.2.3 has been released to address a security vulnerability
Last week, we published CVE-2025-29927 and patched a critical severity vulnerability in Next.js. Here’s our post-incident analysis and next steps.
1672
Latest Mozilla VPN features
It’s been less than a year since we launched Mozilla VPN, our fast and easy-to-use Virtual Private Network service brought to you by a trusted name in on
1673
Signal for Android: RedPhone and TextSecure in one app
Today we’ve started rolling out Signal for Android, which unites simple private messaging and simple private calling into a single app on Android. This is the culmination of our effort to combine TextSecure and RedPhone into one app, which we began on iPhone and are now bringing to completion on ...
1674
Look Up Unknown Phone Numbers Using Facebook Reset Password
This tutorial is meant to help find clues as to who is calling you when you're receiving calls from an unknown phone number (a number that is displayed on
1675
1676
Qwen3-Coder writes less secure code when told it's for a US persona
Chinese coding models write less secure code for Beijing's adversaries. On Qwen3-Coder, we traced the gap to the weights and closed it by removing the model's CCP alignment.
1677
Apple’s Dev Agreement Means No EFF Mobile App for iOS
Today we launched a new app that will make it easier for people to take action on digital rights issues using their phone. The app allows folks to connect to our action center quickly and easily, using a variety of mobile devices. Sadly, though, we had to leave out Apple devices and the folks who...
1678
Apple’s Private Relay can cause the system to ignore firewall rules
Apple’s Private Relay (Beta) feature calls home to Apple servers without respecting the firewall rules of the system, creating a leak that neither we, nor you, can stop without disabling the entire Private Relay feature.
1679
Update on campaign targeting security researchers
An update on a hacking campaign targeting security researchers.
1680
Rust and C++ Interoperability in Chrome
Chrome engineers are experimenting with Rust. For the foreseeable future, C++ is the reigning monarch in our codebase, and any use of Rust will need to fit in with C++ — not the other way around. This seems to present some C++/ Rust interoperability challenges which nobody else has faced.