151
HTTP/2 rapid reset attack impacting Nginx products
Deliver modern applications with NGINX. Explore high-performance load balancing, API gateways, and web server solutions trusted by top global enterprises.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 317 posts.
152
Updating our inactive account policies
Starting later this year, we are updating our inactivity policy for Google Accounts to 2 years across our products.
153
Snoop unto them as they snoop unto you
The official videos from DEFCON 31 have been posted! Below you can watch our talk “Snoop unto them as they snoop unto you”. The talk, slides, files
154
A tale of Phobos – How we almost cracked a ransomware using CUDA
For the past two years we've been tinkering with a proof-of-concept decryptor for the Phobos family ransomware. It works, but is impractical to use for reasons we'll explain here. Consequently, we've been unable to use it to help a real-world victim so far. We've decided to publish our findings and tools, in hope that…
155
Authentication on meet.jit.si
What’s going on? Starting on August 24th, we will no longer support the anonymous creation of rooms on meet.jit.si, and will require the use of an account (we will be supporting Google, GitHub and Facebook […]
156
Microsoft Outlook Blocking All Email from Tutanota.com Domain as Spam
Update: Emails from Tutanota.com no longer go to Spam in Outlook.
157
1.1.1.1 lookup failures on October 4th, 2023
On 4 October 2023, Cloudflare experienced DNS resolution problems. Some users may have received SERVFAIL DNS responses to valid queries. In this blog, we’re going to talk about what the failure was, why it occurred, and what we’re doing to make sure this doesn’t happen again
158
Server-side sandboxing: Containers and seccomp
An overview of containers and seccomp as sandboxing primitives
159
160
Iraq Blocks Telegram, Leaks Blackhole BGP Routes
This past weekend, the government of Iraq blocked the popular messaging app Telegram, citing the need to protect Iraqi’s personal data. However, when an Iraqi government network leaked out a BGP hijack used for the block, it became yet another BGP incident that was both intentional, but also accidental. Thankfully…
161
Hardening cellular basebands in Android
Posted by Ivan Lozano and Roger Piqueras Jover Android’s defense-in-depth strategy applies not only to the Android OS running on the Appl...
162
Firefox rolls out Total Cookie Protection by default to more users
Updated Aug. 28, 2024. Take back your privacy Firefox is rolling out Total Cookie Protection by default to more Firefox users worldwide, making Firefox the
163
164
Starlink's User Terminal Firmware
This blog post presents an overview of Starlink's User Terminal runtime internals, focusing on the communications that happen within the device and with user applications and some tools that can help further research on the same topic.
165
GPU.zip: side channel attack that exposes visual data processed on the GPU
On the Side-Channel Implications of Hardware-Based Graphical Data Compression
166
Google AMP – The Newest of Evasive Phishing Tactic
Author: Dylan DuncanA new phishing tactic utilizing Google...
167
168
Email Authentication: A Developer's Guide
Learn the importance of SPF, DKIM, DMARC, and BIMI in ensuring email delivery.
169
Temporary ban on behavioural advertising on Facebook and Instagram
The Norwegian Data Protection Authority imposes a ban on Meta carrying out behavioural advertising based on the surveillance and profiling of users in Norway. The ban will initially apply until October
170
Case study: fake hardware cryptowallet
Fake hardware cryptowallet, and how bitcoins were stolen from it.
171
Learnings from kCTF VRP's 42 Linux kernel exploits submissions
Tamás Koczka, Security Engineer In 2020 , we integrated kCTF into Google's Vulnerability Rewards Program (VRP) to support researchers evalu...
172
Pixel Binary Transparency: verifiable security for Pixel devices
Jay Hou, Software Engineer, TrustFabric (transparency.dev) Pixel Binary Transparency was originally announced in 2021; the following blog ...
173
174
175
Spyware vendors use 0-days and n-days against Android, iOS and Chrome
Google’s Threat Analysis Group (TAG) tracks actors involved in information operations (IO), government backed attacks and financially motivated abuse. For years, TAG has…
176
RFC 9420 a.k.a. Messaging Layer Security
Messaging Layer Security has been published. MLS is the first standardized, fully specified, freely accessible end-to-end encryption protocol.
177
Deploying key transparency at WhatsApp
WhatsApp has launched a new cryptographic security feature to automatically verify a secured connection based on key transparency. The feature requires no additional actions or steps from users an…
178
Cloudflare mitigates record-breaking 71M request-per-second DDoS attack
This was a weekend of record-breaking DDoS attacks. Over the weekend, Cloudflare detected and mitigated dozens of hyper-volumetric DDoS attacks. The majority of attacks peaked in the ballpark of 50-70 million requests per second (rps) with the largest exceeding 71 million rps
179
TKey is a RISC-V computer in a USB-C case, that can run security applications
Introduction # The Tillitis TKey is a small computer in a USB stick form factor that can run small device applications that are loaded onto it. The purpose of the TKey is to be a secure environment for applications that provide some kind of security function. Some examples of such security functions are: Time-based…
180
Scammers can exploit email forwarding flaws to impersonate high-profile domains
Sending an email with a forged address is easier than previously thought, due to flaws in the process that allows email forwarding, according to a research team led by computer scientists at the University of California San Diego.