2701
How to weaponize the Yubikey (2019)
Michael Allen // A couple of years ago, I had a YubiKey that was affected by a security vulnerability, and to fix the issue, Yubico sent me a brand new […]
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,441 posts.
2702
The Internet Archive Pushes Back on “Notice and Staydown”
The US Copyright Office sought comments in its ongoing study of the Digital Millennium Copyright Act (DMCA) Section 512 safe harbor study. They are generally looking to find out how well the notice and takedown system is working for everyone—Internet platforms and users, as well as creators and copyright holders. We…
2703
Librem Tunnel Is Leaving iOS
Purism makes premium phones, laptops, mini PCs and servers running free software on PureOS. Purism products respect people's privacy and freedom while protecting their security.
2704
My Mac contacted 63 different Apple owned domains in an hour, while not is use
During a one hour period today, my computer contacted 63 different Apple domains while i was not logged on and using it. I have been trying to minimize to the extent possible the reach of big tech into my life. A full 25% of the DNS queries from one of my computers (M2 MBA with macOS 15.4) are to Apple owned domains …
2705
2706
Improving DNS Privacy in Firefox
Domain Name Service (DNS) is one of the oldest parts of internet architecture, and remains one that has largely been untouched by efforts to make the web safer and more ...
2707
2708
1,741 "informed" consents with one click? GDPR complaint filed
dict.cc requests users to consent to the tracking by 1,741 "partner" companies. This makes it impossible for people to know what happens to their data
2709
San Francisco: Don't Fall for Industry Defense of Surveillance Pricing
The concept of “surveillance pricing” is just one part of a much larger problem and business model: corporations maximizing their profits by invading our privacy. The all-too-common business model is to systematically harvest, collate, and store as much of our personal data as possible, and then...
2710
Mozilla Announces Experimental Partnership with ProtonVPN
Mozilla has long played an important role in the online world, and we’re proud of the impact we’ve had. But we want to do even more, and that means exploring ...
2711
United Kingdom to introduce security labelling on connected devices
In a press release from the UK government on January 27th 2020 called “Government to strengthen security of internet-connected products”, the new law and i
2712
Regin: Top-tier espionage tool enables stealthy surveillance
Broadcom Community - VMTN, Mainframe, Symantec, Carbon Black
2713
Trigger.dev customer environment variables exposed
An attacker gained unauthorized access to environment variables for a subset of organizations. We've blocked the exploit and emailed all impacted account owners with steps to mitigate.
2714
2715
2716
Flash-Free Clipboard for the Web
As part of our effort to grow the Web platform and make it accessible to new devices, we are trying to reduce the Web's dependence on Flash. As part of ...
2717
Security Through Transparency
Posted by Ryan Hurst and Gary Belvin, Security and Privacy Engineering Encryption is a foundational technology for the web. We’ve spent a l...
2718
2719
Kr00k vuln in WiFi chips that allows unauthorized decryption of traffic
Kr00k – formally known as CVE-2019-15126 – is a vulnerability in Broadcom and Cypress Wi-Fi chips that allows unauthorized decryption of some WPA2-encrypted traffic.
2720
TSA announces “biometrics vision for all commercial aviation travelers”
Today the US Transportation Security Administration released a detailed TSA Biometric Roadmap for Aviation Security & the Passenger Experience , making explicit the goal of requiring mug shots (to be used for automated facial recognition and image-based surveillance and control) as a condition of all domestic or…
2721
An Update on Our Plans to Restrict Data Access on Facebook
Two weeks ago we promised to take a hard look at the information apps can use when you connect them to Facebook as well as other data practices. Today, we want to update you on the changes we're making to better protect your Facebook information.
2722
Void captures over a million Android TV boxes
Doctor Web experts have uncovered yet another case of an Android-based TV box infection. The malware, dubbed <a href="https://vms.drweb.com/search/?q=Android.Vo1d&lng=en"><b>Android.Vo1d</b></a>, has infected nearly 1.3 million devices belonging to users in 197 countries. It is a backdoor that puts its components in…
2723
Android RNG Weakness Renders Bitcoin Wallets Insecure
We recently learned that a component of Android responsible for generating secure random numbers contains critical weaknesses , that render all Android wallets generated to date vulnerable to theft. Because the problem lies with Android itself, this problem will affect you if you have a wallet generated by any Android…
2724
WhatsApp alternatives that respect privacy
WhatsApp may be secure but it’s not private. Learn about the best alternatives to WhatsApp that genuinely respect your privacy.
2725
Online Behavioral Ads Fuel the Surveillance Industry
Each time you see a targeted ad, your personal information is exposed to thousands of advertisers and data brokers through a process called “real-time bidding” (RTB). This process does more than deliver ads—it fuels government surveillance, poses national security risks, and gives data brokers easy access to your…
2726
TLS 1.3 Is an Opportunity for Amazon, Google and Microsoft to End Censorship
A new standard for cryptography is on the horizon, called Transport Level Security 1.3 (TLS 1.3). TLS 1.3 is a major update to cryptography, and
2727
WTF is a KDF?
Earlier this week a letter from an activist imprisoned in France was posted to the internet. Contained within Ivan Alococo’s dispatch from the Villepinte prison
2728
2729
Amtrak police use of passenger data
[Passenger Name Record (PNR) view from Amtrak “Police GUI”. Click image for larger version.]
2730
Microsoft Windows RCE Vulnerability Gives an Attacker Complete Control
Synack Red Team breaks down a Windows RCE vulnerability enabling full remote code execution and complete attacker control — exploitation techniques and real-world security analysis.