2011
Secure Access to 100 AWS Accounts
Explore technical topics, solutions, and resources for building with Twilio – and beyond.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,441 posts.
2012
Remote Prompt Injection in Gitlab Duo Leads to Source Code Theft
The Legit research team unearthed vulnerabilities in GitLab Duo.
2013
How SAML 2.0 Authentication Works
At its core, Security Assertion Markup Language (SAML) 2.0 is a means to exchange authorization and authentication information between services. Learn how saml works.
2014
2015
Officials Don't Get to Choose Who Gets to Receive, Comment, and Reply to Tweets
We’ve taken a stand for the First Amendment rights of individuals to receive and comment on social media posts from governmental officials and agencies. We’ve received a lot of good questions about why we believe that public servants—mayors, sheriffs, senators, even President Donald Trump—can’t...
2016
Adding a security key to Gmail
Your primary email (the one you give to banks, social media sites, etc.) is the most important online account you have. If an attacker can take over your primary email account, they can reset passwords on every other service that uses that email for account recovery.
2017
Kali Linux 2020.3
Its that time of year again, time for another Kali Linux release! Quarter #3 - Kali Linux 2020.3. This release has various impressive updates, all of which are ready for immediate download or updating. A quick overview of what’s new since the last release in May 2020: New Shell - Starting the process to switch from…
2018
Cryptographic coin flipping, now in Keybase
You're reading the Keybase blog. There are more posts . When you're done, you can install Keybase .
2019
Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate
If you're using Chrome 53, which was released last week, you might find that some websites which worked under Chrome 52 now fail with "Your connection is not private" with an error code of NET::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED . For example, choosemyreward.chase.com shows the following error as of publication…
2020
A recent security incident involving Dropbox Sign
Information on a security incident involving Dropbox Sign.
2021
New Tools for Detecting HTTPS Interception
The practice of HTTPS interception continues to be commonplace on the Internet. This blog post discusses types of monster-in-the-middle devices and software, and how to detect them.
2022
2023
Open-sourcing Riskquant, a library for quantifying risk
Netflix has a program in our Information Security department for quantifying the risk of deliberate (attacker-driven) and accidental…
2024
Electronic Frontier Foundation Uncovers Widespread FBI Intelligence Violations
EFF has uncovered widespread violations stemming from FBI intelligence investigations from 2001 - 2008. In a report released today, EFF documents alarming trends in the Bureau’s intelligence investigation practices, suggesting that FBI intelligence investigations have compromised the civil...
2025
Starlink's User Terminal Firmware
This blog post presents an overview of Starlink's User Terminal runtime internals, focusing on the communications that happen within the device and with user applications and some tools that can help further research on the same topic.
2026
Binary SMS – The old backdoor to your new thing
A Accenture oferece oportunidades que surgem a partir da disrupção tecnológica em todas as indústrias, em todos os países, todos os dias. Saiba mais!
2027
GPU.zip: side channel attack that exposes visual data processed on the GPU
On the Side-Channel Implications of Hardware-Based Graphical Data Compression
2028
2029
YouTube ads in Safari: you see them now, will you see them in the future?
Content blocking in Safari is a thing in and of itself, and it's not good. One of the consequences is ads appearing in YouTube. Why does it happen and can it be prevented?
2030
AWS Single Sign-On
Discover more about what's new at AWS with Announcing AWS Single Sign-On (SSO)
2031
Tailscale SSH is now Generally Available
Tailscale SSH is now generally available, offering seamless SSH authentication and authorization with SSO, MFA, and ACLs. Enjoy robust security, zero trust remote access, and tools like session recording and VS Code integration.
2032
Preventing Tracking Prevention Tracking
This blog post covers enhancements to Intelligent Tracking Prevention (ITP) included in Safari on iOS and iPadOS 13.3, Safari 13.0.4 on macOS Catalina, Mojave, and High Sierra.
2033
We ditched Google Analytics
We asked ourselves if it was time to switch to a less invasive analytics app than Google Analytics; one...
2034
Think twice before encrypting your HFS+ volumes on High Sierra
Advanced backup and copying for macOS. Schedule automated backups, take snapshots, and restore your Mac with confidence. Download a free 30-day trial.
2035
Google Public DNS's approach to fight against cache poisoning attacks
Tianhao Chi and Puneet Sood, Google Public DNS The Domain Name System (DNS) is a fundamental protocol used on the Internet to translate hum...
2036
2037
Announcing OSS-Fuzz: Continuous Fuzzing for Open Source Software
By Mike Aizatsky, Kostya Serebryany (Software Engineers, Dynamic Tools); Oliver Chang, Abhishek Arya (Security Engineers, Google Chrome); an...
2038
VeraCrypt to be audited
OSTIF is proud to announce that we have come to an agreement to fully fund an audit of VeraCrypt. Using funds that were donated by DuckDuckGo and VikingVPN , we plan to hire QuarksLab to go over the code and search for vulnerabilities and backdoors.
2039
A New Future for GnuPG
It has been quite some time since my last status report on GnuPG. I have been quite busy working on the project but unfortunately rarely active on the usual channels. So, here is a new report telling what we did over the last two or three years. Please read at least the last section.
2040
Memory Safe Context Switching
This document describes how Fil-C supports longjmp , setjmp , setcontext , getcontext , makecontext , and swapcontext in a totally memory-safe way. In particular, no misuse of those APIs in Fil-C can lead to stack corruption or any other violation of Fil-C's capability model.