151
ImageNet contains naturally occurring Apple NeuralHash collisions
Apple’s NeuralHash: real-world collisions, false positives, and implications for CSAM detection. See what this means for system reliability.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,439 posts.
152
Changing Our Approach to Anti-Tracking
In the near future, Firefox will -- by default -- protect users by blocking tracking while also offering a clear set of controls to give our users more choice over what information they share with sites.
153
154
Wildcard Certificates Coming January 2018
Update, March 13, 2018 Wildcard certificate support is live. Let’s Encrypt will begin issuing wildcard certificates in January of 2018. Wildcard certificates are a commonly requested feature and we understand that there are some use cases where they make HTTPS deployment easier. Our hope is that offering wildcards…
155
156
Facebook Container Extension: Take control of how you’re being tracked
Our Multi-Account Containers extension has been a game changer for many users, letting them manage various parts of their online life without intermingling
157
Firefox Multi-Account Containers
Our new Multi-Account Containers extension for Firefox means you can finally wrangle multiple email/social accounts. Maybe you’ve got two Gmail or Instag
158
Supabase MCP can leak your entire SQL database
Indirect prompt injection through support-ticket data lets an MCP-enabled assistant cross trust boundaries and query private tables with Supabase’s privileged service role.
159
Samsung embeds IronSource spyware app on phones across WANA
In recent months, we have received numerous reports from users across West Asia and North Africa (WANA) expressing alarm over a little-known but deeply intrusive bloatware application—AppCloud—pre-installed on Samsung’s A and M series smartphones. Without users’ knowledge or consent, this bloatware collects sensitive…
160
Zoom to bring end-to-end encryption to all users, including non-paying
Learn more about how to use each Zoom product to connect with coworkers, customers, businesses, and more with insights and best practices.
161
Our audit of Homebrew
This is a joint post with the Homebrew maintainers; read their announcement here! Last summer, we performed an audit of Homebrew. Our audit’s scope included Homebrew/brew itself (home of the brew CLI), and three adjacent repositories responsible for various security-relevant aspects of Homebrew’s operation…
162
Do Not Turn Child Protection into Internet Access Control
Age verification turns the open internet into a permission system and pushes control away from families, schools, and users.
163
We are under attack
Fighting censorship with technology since 2011. We use AI to monitor censorship and expand free speech worldwide.
164
Multiple Russia-aligned threat actors actively targeting Signal Messenger
Russia state-aligned threat actors target Signal Messenger accounts used by individuals of interest to Russia's intelligence services.
165
FCC: TikTok is unacceptable security risk and should be removed from app stores
According to the FCC commissioner, TikTok is a video app in "sheep's clothing", suggesting a wolf hides underneath those funny videos.
166
DNS traffic can leak outside the VPN tunnel on Android
We were recently made aware of multiple potential DNS leaks on Android. They stem from bugs in Android itself, and only affect certain apps.
167
Chat Control: Incompatible with Fundamental Rights (2022)
The EU Commission's draft regulation on chat control is currently being negotiated in the European Parliament and the Council of Ministers. With the fight against sexual violence against children, the draft pursues an objective that is essential for the protection of children and their rights and can justify…
168
8M users' AI conversations sold for profit by "privacy" extensions
Secure the modern software stack with Koi. Gain visibility, context, and real-time protection over extensions, MCPs, and autonomous AI agent endpoints.
169
170
The DDoS that almost broke the Internet
The New York Times this morning published a story about the Spamhaus DDoS attack and how CloudFlare helped mitigate it and keep the site online. The Times calls the attack the largest known DDoS attack ever on the Internet.
171
172
Grand jury subpoena for Signal user data
In the “first half of 2016” (the most specific we’re permitted to be), we received a subpoena from the Eastern District of Virginia. The subpoena required us to provide information about two Signal users for a federal grand jury investigation. We’ve designed the Signal service to minimize the dat...
173
Social engineering takeovers of open source projects
By Robin Bender Ginn, Executive Director, OpenJS Foundation; and Omkhar Arasaratnam, General Manager, Open Source Security Foundation
174
Copilot broke audit logs, but Microsoft won't tell customers
We discoverd a vulnerability in Microsoft 365 Copilot that allows users to access files without getting detected or appearing in the audit log.
175
Barcode scanner app on Google Play infects 10M users with one update
In a single update, a popular barcode scanner app that had been on Google Play for years turned into malware.
176
10 Years of Let's Encrypt
On September 14, 2015, our first publicly-trusted certificate went live. We were proud that we had issued a certificate that a significant majority of clients could accept, and had done it using automated software. Of course, in retrospect this was just the first of billions of certificates. Today, Let’s Encrypt is…
177
Today's PHP security release, and how we're strengthening security
Describing the story behind how critical security vulnerabilities were found and fixed.
178
The chat control proposal does not belong in democratic societies
The European Commission is working on a legislative proposal called chat control. If the law goes into effect, all EU citizens will have their communications monitored and audited. Now is the time to stop it.
179
Court agrees with EFF: Utah's VPN law demands a technical impossibility
In a win for digital rights, a federal judge has issued a preliminary injunction blocking Utah’s SB 73, the state’s draconian anti-VPN age verification law. The decision comes as EFF submitted our comments to the Utah Department of Commerce, detailing how forcing platforms to detect and block privacy-preserving tools…
180
Is Tor still safe to use?
This blog post is a response to an investigative news report about a large-scale law-enforcement attack that managed to de-anonymize a user of an old version of the long-retired app Ricochet. This blog post aims to provide insight into what we know so far. Nothing that the Tor Project has learned about this incident…