Topics /
The most popular blog posts about security & privacy on Hacker News. 8,768 posts.
‘Re-education’, forced labour and surveillance beyond Xinjiang. What’s the problem? The Chinese government has facilitated the mass transfer of Uyghur and other ethnic minority1 citizens from the far west region of Xinjiang to factories across the country. Under conditions that strongly suggest forced labour, Uyghurs…
This is going to be a highly opinionated blog post. I think AWS is great and use it daily, but their implementation of IAM is unnecessarily complicated.
Read on to understand how Google currently evaluates the threat landscape related to post-quantum cryptography, and what implications this has for migrating from classical cryptographic algorithms to PQC.
In the absence of comprehensive federal privacy legislation in the United States, the targeted advertising industry, fueled by personal information harvested from our cell phone applications, has run roughshod over our privacy. Worse, the boundaries between corporate surveillance and government...
What is arguably the most powerful of the U.S. government’s surveillance authorities is also the most secretive, and it operates with the least amount of oversight.
Your digital camera may embed metadata into photographs with the camera's serial number or your location. Your printer may be incorporating a secret code on every page it prints which could be used to identify the printer and potentially the person who used it. If Apple puts a particularly creepy...
In a groundbreaking decision, the Austrian Data Protection Authority has decided on a model case by noyb that the continuous use of Google Analytics violates the GDPR.
I found myself in somewhat of a unique position last week: I’d made the Ashley Madison data searchable for verified subscribers of Have I been pwned? [https://haveibeenpwned.com/] (HIBP) and now – perhaps unsurprisingly in retrospect – I was being inundated with email. I mean hundreds of emails every day
Ethical Hacking, Malware Analysis, Disinfection Techniques, Information Security, Pentesting Techniques and all related with Computer Security.
Cloud hosting provider iNSYNQ says it is trying to recover from a ransomware attack that shut down its network and has left customers unable to access their accounting data for the past three days. Unfortunately for iNSYNQ, the company appears to be turning a deaf ear to the increasingly anxious cries from its users…
The Software Freedom Law Center provides legal representation and other law related services to protect and advance Free and Open Source Software.
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
If you want to be really evil, however, *.google.com is the wrong SSL certificate to forge. The right one? ssl.google-analytics.com .
Today we're launching Capture the Flag: Web Edition, a security contest where you can try your hand at discovering and exploiting vulnerabilities in mock web applications.
Wiz Research uncovers vulnerabilities in SAP AI Core, allowing malicious actors to take over the service and access customer data.
We can't let the FBI keep the public in the dark about its ability to gain access to information stored on our personal mobile devices.
As the popularity of Bitcoins has increased, government officials are concerned about criminal activity associated with the virtual currency. But a recent subpoena issued by the New Jersey Division of Consumer Affairs to 19-year-old Bitcoin developer and MIT student Jeremy Rubin goes too far, and...
Before adding a dependency to one of my software projects, I do some basic vetting of the dependency. Among the things I check are:
This is a story about a security vulnerability in Google that allowed me to run arbitrary code on the computers of 50+ Google employees. Although Google initially considered my finding a serious security incident, later on, it changed its mind and stated that my finding is not, in fact, a vulnerability, but the…
We, along with the security industry and our partners, continue to investigate the extent of the Solorigate attack. While investigations are underway, we want to provide the defender community with intel to understand the scope and impact, remediation guidance, and detections and protections we have built as a result.
The EU is poised to pass a sweeping new regulation, eIDAS 2.0. Buried deep in the text is Article 45, which returns us to the dark ages of 2011, when certificate authorities (CAs) could collaborate with governments to spy on encrypted traffic—and get away with it. Article 45 forbids browsers from...
Let’s Encrypt is a revolutionary new certificate authority that provides free certificates in a completely automated process. These certificates are …
The hacked digital advertiser was caught serving malicious ads that allowed hackers to steal a victim's cryptocurrency.
