211
If OpenSSL were a GUI
What if OpenSSL were a GUI program? Here's what it might look like.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,439 posts.
212
WhatsApp's help pages hid LLM instructions: dont recommend a regulator
WhatsApp removed hidden notes telling AI not to recommend a regulator, and not to cite GDPR or CCPA once a lawyer came up. We quote both notes.
213
I’m Terrified of My New TV
From facial recognition to personal data collection, this thing is downright scary -- and so are the implications.
214
Megafail
In case you’ve been living under a rock the past few days, Kim Dotcom (of Megaupload infamy) has launched his new cloud storage site, Mega. Mega has an impressive sales pitch, promising secure cloud storage where only the user has the key to decrypt his or her files, and the encryption and decryption happens securely…
215
216
Key senators have voted for the anti-encryption EARN IT act
Earlier today, the Senate Judiciary Committee voted to advance the dangerous EARN IT bill. We’re disappointed to see the committee advance this misguided bill. If enacted, EARN IT will put massive legal pressure on internet companies both large and small to stop using encryption and instead scan...
217
218
Serious Chrome zero-day
The Sophos Blog
219
New German law would force ISPs to allow secret service to install trojans
A new law being proposed in Germany would see all 19 federal state intelligence agencies in Germany granted the power to spy on German citizens through
220
DuckDuckGo moves beyond search to also protect you while browsing
We're excited to launch a new browser extension and mobile app, extending DuckDuckGo's protection beyond the search box to wherever the Internet takes you.
221
SQLite Critical CVEs or LLM Slop?
The JFrog security research team recently identified a supply chain attack targeting the `xinference` package on PyPI. Versions 2.6.0, 2.6.1, and 2.6.2 were compromised and yanked by maintainers after users reported suspicious behavior. If you installed or imported these versions, you must assume your environment is…
222
Accessing Publicly Available Information on the Internet Is Not a Crime
EFF is fighting another attempt by a giant corporation to take advantage of our poorly drafted federal computer crime statute for commercial advantage—without any regard for the impact on the rest of us. This time the culprit is LinkedIn. The social networking giant wants violations of its...
223
Data accidentally exposed by Microsoft AI researchers
Wiz Research found a data exposure incident on Microsoft’s AI GitHub repository, including over 30,000 internal Microsoft Teams messages – all caused by one misconfigured SAS token
224
Chrome users beware: Manifest v3 is deceitful and threatening
Like FLoC and Privacy Sandbox before it, Google Chrome’s Manifest V3 is another example of the inherent conflict of interest that comes from Google controlling both the dominant web browser and one of the largest internet advertising networks.
225
Asking the U.S. to allow Google to publish more national security request data
This morning we sent the following letter to the offices of the Attorney General and the Federal Bureau of Investigation.
226
With SESTA/FOSTA, lawmakers failed to separate good intentions from bad law
In Passing SESTA/FOSTA, Lawmakers Failed to Separate Their Good Intentions from Bad LawToday was a dark day for the Internet.The U.S. Senate just voted 97-2 to pass the Allow States and Victims to Fight Online Sex Trafficking Act (FOSTA, H.R. 1865), a bill that silences online speech by forcing...
227
French bar owners arrested for offering free WiFi but not keeping logs
At least five bar owners in Grenoble, France have been arrested for providing WiFi at their businesses without keeping logs. The bar owners were arrested
228
Universal SSL
The team at CloudFlare is excited to announce the release of Universal SSL™. Beginning today, we will support SSL connections to every CloudFlare customer, including the 2 million sites that have signed up for the free version of our service.
229
European digital ID wallets rely on safety services of Google and Apple
European governments are rolling out digital identity wallets, which are to be used by citizens to access services, and to verify their age online. There is a serious problem with this: these wallets rely on safety services of Google and Apple.
230
231
You are committing a crime right now
Are you reading this blog? If so, you are committing a crime under 18 USC 1030(a) (better known as the “ Computer Fraud & Abus...
232
RSA is a fragile cryptosystem
Here at Trail of Bits we review a lot of code. From major open source projects to exciting new proprietary software, we’ve seen it all. But one common denominator in all of these systems is that for some inexplicable reason people still seem to think RSA is a good cryptosystem to use. Let me save […]
233
Exposed DeepSeek database leaking sensitive information, including chat history
A publicly accessible database belonging to DeepSeek allowed full control over database operations, including the ability to access internal data. The exposure includes over a million lines of log streams with highly sensitive information.
234
235
236
EUCLEAK Side-Channel Attack on the YubiKey 5 Series
Download the Writeup Illustration Romain Flamand – Flamingo Studio – flamandromain@gmail.com Abstract Secure elements are small microcontrollers whose main purpose is to generate/store secrets and then execute cryptographic operations. They undergo the highest level of security evaluations that exists (Common…
237
No More Deceptive Download Buttons
Posted by Lucas Ballard, Safe Browsing Team In November , we announced that Safe Browsing would protect you from social engineering attack...
238
EmDash – A spiritual successor to WordPress that solves plugin security
Today we are launching the beta of EmDash, a full-stack serverless JavaScript CMS built on Astro 6.0. It combines the features of a traditional CMS with modern security, running plugins in sandboxed Worker isolates.
239
240
Tim Hortons app violated laws in collection of ‘vast amounts’ of location data
GATINEAU, QC , June 1, 2022 – People who downloaded the Tim Hortons app had their movements tracked and recorded every few minutes of every day, even when their app was not open, in violation of Canadian privacy laws, a joint investigation by federal and provincial privacy authorities has found.