571
CCPA Scam – Human subject research study conducted by Princeton University
Get ready for the CCPA compliance scams from Princeton.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,333 posts.
572
FBI Probes Service Selling 153M+ Drivers Licenses
A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphoning images collected by…
573
TP-Link firmware sends six DNS requests and one NTP query every 5 seconds
A design flaw in TP-Link Wi-Fi repeater firmware causes it to waste an excessive amount of bandwidth on NTP timekeeping. DDoS’ed public NTP servers in the process.
574
You don’t want to be on Cloudflare’s naughty list
My home IP ended up on Cloudflare’s naughty list for six days. Most websites and many apps loaded slowly, partially, or not at all. Just had to wait it out.
575
I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M
Datatilsynet just fined Elkjop NOK 20 million (€1.8m) for the forced consent in its loyalty club — five years after I told their DPO it was unlawful.
576
Reversing UK mobile rail tickets
The UK has used small credit-card sized tickets to pay for train travel for years and years, since long before I was born — originally theAPTIS ticket1,which...
577
578
“Stylish” browser extension steals all your internet history
Before it became a covert surveillance tool disguised as an outstanding browser extension, Stylish really was an outstanding browser extension. It bestowed upon its users nothing less than the power to change the appearance of the internet. Its extensive bank of user-made skins gave bright websites a dark background…
579
A better zip bomb
This article shows how to construct a non-recursive zip bomb that achieves a high compression ratio by overlapping files inside the zip container. "Non-recursive" means that it does not rely on a decompressor's recursively unpacking zip files nested within zip files: it expands fully after a single round of…
580
15,000 lines of verified cryptography now in Python
In November 2022, I opened issue 99108 on Python’s GitHub repository, arguing that after a recent CVE in its implementation of SHA3, Python should embrace verified code for all of its hash-related infrastructure.
581
Motorola cell phones are regularly phoning home
If you have a Motorola Android device, there is a good chance it is silently sending a great deal of your personal information (including email addresses and passwords) to Motorola.
582
I Inspected My Take-Home Interview Project. It Was a Whole Operation
Appaji, a Computer Science graduate from IIT Patna and former intern at Arista Networks, is a Software Engineer at Infinite Reality. Passionate about building innovative web experiences, with a strong interest in sustainable and customer-focused startups.
583
De-Googling my phone
I’ve been a professional Free Software developer in the GNU/Linux area for 14 years now, and a hobbyist developer and user for much longer. For some reason that never extended much to the smartphone world, beyond running LineageOS on my older phones (my current Sony Xperia is still under warranty and I’m fine with the…
584
585
Truecrypt report
A few weeks back I wrote an update on the Truecrypt audit promising that we’d have some concrete results to show you soon. Thanks to some hard work by the NCC Crypto Services group, soon is n…
586
587
Reverse engineering a camera protocol for fun and profit
Way back in late 2019 , I dissected a Reolink B800 IP camera to demonstrate the various parts of an embedded Linux system. It’s fairly nice hardware, actually—it has a 4K video sensor, a microphone, power over Ethernet, and is nominally waterproof. And yes, it runs Linux.
588
Secret Dots from Printer Outed NSA Leaker
Today, The Intercept released documents on election tampering from an NSA leaker. Later, the arrest warrant request for an NSA contractor ...
589
Secure Secure Shell
No ads, no tracking. Ever.<br/> <strong>blog.stribik.technology</strong> is completely static, without cookies or javascript.<br/> <strong>comments.stribik.technology</strong> uses javascript and local storage, it's loaded when you click
590
Vendors must start adding physical on/off switches to devices that can spy on us
Update (May 15, 2019): This post was linked and its author quoted as a source in this Fast Company article on the same subject. Where's my webcam's off switch? Have you ever noticed that your webcam doesn't have an "off" switch? I looked on Amazon, and I couldn't find any webcams for sale that
591
CISA Admin Leaked AWS GovCloud Keys on GitHub
Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems. Security experts said the public archive included files…
592
eBay is port scanning visitors to their website
Websites are scanning for open ports on your PC to help fight fraud, but this data also flows into a massive, global tracking database.
593
594
Always-on Processor magic: How Find My works while iPhone is powered off
Wireless and firmware hacking, PhD life, Technology
595
Microsoft buys corp.com so bad guys can’t
In February, KrebsOnSecurity told the story of a private citizen auctioning off the dangerous domain corp.com for the starting price of $1.7 million . Domain experts called corp.com dangerous because years of testing showed whoever wields it would have access to an unending stream of passwords, email and other…
596
FBI, DHS, HHS Warn of Imminent Ransomware Threat Against U.S. Hospitals
On Monday, Oct. 26, KrebsOnSecurity began following up on a tip from a reliable source that an aggressive Russian cybercriminal gang known for deploying ransomware was preparing to disrupt information technology systems at hundreds of hospitals, clinics and medical care facilities across the United States. Today…
597
Why I use Firefox
I’m interested in HTML, CSS, and making the web less annoying
598
Identity thieves bypassed Experian security to view credit reports
Identity thieves have been exploiting a glaring security weakness in the website of Experian , one of the big three consumer credit reporting bureaus. Normally, Experian requires that those seeking a copy of their credit report successfully answer several multiple choice questions about their financial history. But…
599
600
Bitwarden design flaw: Server side iterations
Bitwarden is a hot candidate for a LastPass replacement. Looking into how they encrypt data, it doesn’t do things that much better however.