1891
HTTP security headers
Appcanary makes sure you never run vulnerable software on your servers. Like our blog? Subscribe to our newsletter or podcast . Browse the archive , or follow us on twitter , github or rss .
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,440 posts.
1892
Important Allies Join the Fight Against NSA Internet Backbone Surveillance
Last week, the ACLU filed a welcome additional challenge to the NSA’s warrantless Internet backbone surveillance (aka “Upstream” surveillance) on behalf of Wikimedia and a number of other media and human rights organizations. We applaud all of those involved in bringing the case. It adds another...
1893
TSA considers new system for flyers without ID
According to a solicitation to potential contractors published last week, the Transportation Security Administration (TSA) wants to outsource its current questioning of airline passengers without ID , and its decisions about which travelers without ID to allow to travel and which to prevent from flying , to a…
1894
Los Angeles Cops Argue All Cars in LA Are Under Investigation
Do you drive a car in the greater Los Angeles Metropolitan area? According to the L.A. Police Department and L.A. Sheriff’s Department, your car is part of a vast criminal investigation. The agencies took a novel approach in the briefs they filed in EFF and the ACLU of Southern California’s...
1895
Coordinated disclosure of XML roundtrip vulnerabilities in Go’s standard library
We have identified three independently exploitable vulnerabilities in Go's encoding/xml. Read more about their impact to Mattermost users.
1896
Exploitable vulnerabilities found in Kaspersky Anti-Virus
Posted by the notorious Tavis Ormandy.We’ve talked before about how we use Google scale to ...
1897
Hardening the Kernel in Android Oreo
News and insights on the Android platform, developer tools, and events.
1898
EFF Sues to Invalidate FOSTA, an Unconstitutional Internet Censorship Law
We are asking a court to declare the Allow States and Victims to Fight Online Sex Trafficking Act of 2017 (“FOSTA”) unconstitutional and prevent it from being enforced. The law was written so poorly that it actually criminalizes a substantial amount of protected speech and, according to experts,...
1899
GitHub will require 2FA by the end of 2023
GitHub will require all users who contribute code on GitHub.com to enable one or more forms of two-factor authentication (2FA) by the end of 2023.
1900
Combating abuse in Matrix – without backdoors
Matrix, the open protocol for secure decentralised communications
1901
Australian PM Calls for End-To-End Encryption Ban
"The laws of mathematics are very commendable but the only law that applies in Australia is the law of Australia", said Australian Prime Minister Malcolm Turnbull today. He has been rightly mocked for this nonsense claim, that foreshadows moves to require online messaging providers to provide law...
1902
1903
1904
How to Delete Your 23andMe Data
This week, the genetic testing company 23andMe filed for bankruptcy, which means the genetic data the company collected on millions of users is now up for sale. If you don't want your data included in any potential sale, it’s a good time to ask the company to delete it.
1905
Internet of Crappy Things
There is a flood of appliances which could be connected - and some are connected - without a second thought as to whether or not it’s necessary or secure.
1906
Handshake: Decentralizing DNS to Improve the Security of the Internet
News and announcements from Namebase.
1907
Estonian Electronic Identity Card: Security Flaws in Key Management
Arnis Parsovs, Software Technology and Applications Competence Center and University of Tartu
1908
Over 30% of Official Images in Docker Hub Contain Security Vulnerabilities
Docker Hub is a central repository for Docker developers to pull and push container images. We performed a detailed study on Docker Hub images to understand how vulnerable they are to security threats. Surprisingly, we found that more than 30% of images in official repositories are highly susceptible to a variety of…
1909
What web developers should know about SSL
The most common questions we get from developers who already know their stuff
1910
FISA Court Rejects Catch-22 Secrecy Argument in FOIA Case
In the first publicly known victory by a non-government party before the Foreign Intelligence Surveillance Court (FISC), the secret court today granted a motion filed by EFF related to an ongoing Freedom of Information Act lawsuit. The FISC gave its OK to the public disclosure of an earlier opinion...
1911
How to Spoof PDF Signatures
One year ago, we received a contract as a PDF file. It was digitally signed. We looked at the document - ignoring the "certificate is not tr...
1912
(Very) Basic Intro to Elliptic Curve Cryptography
Learn cryptography in Go by building ciphers, hashes, password security, and encryption tools. Understand security beneath the library call.
1913
Data-at-Rest Encryption in DuckDB
DuckDB 1.4 ships database encryption capabilities. In this blog post, we dive into the implementation details of the encryption, show how to use it, and demonstrate its performance implications.
1914
1915
OpenAI DayBreak – GPT-5.5-Cyber
OpenAI introduces new Daybreak tools, including Codex Security and GPT-5.5-Cyber, to help organizations find, validate, and patch vulnerabilities at scale.
1916
Yes, All DRM
Everybody knows that the digital locks of DRM on the digital media you own is a big problem. If you’ve bought a digital book, album, or movie, you should be able to do what you want with it—whether that’s enjoying it wherever you want to, or making it more accessible by changing the font size or...
1917
We can't check the app permissions on Google Play anymore
Yep, Google removed the permissions list from Play Store, and we can no longer check the app permissions on it.
1918
Behind the Masq: Yet More DNS and DHCP Vulnerabilities
Posted by Fermin J. Serna, Staff Software Engineer, Matt Linton, Senior Security Engineer and Kevin Stadmeyer, Technical Program Manager O...
1919
Securing a DoD contractor: Finding a multi-tenant authorization vulnerability
Zero tenant isolation, exposed military training data, and a five-month responsible disclosure timeline.
1920
The Lie Behind the Lie Detector
5th Edition of The Lie Behind the Lie Detector Released