3271
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,768 posts.
3272
TSA Plans to Use Face Recognition to Track Americans Through Airports
The “PreCheck” program is billed as a convenient service to allow U.S. travelers to “speed through security” at airports. However, the latest proposal released by the Transportation Security Administration (TSA) reveals the Department of Homeland Security’s greater underlying plan to collect face...
3273
CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit
In this report, we present a UEFI firmware rootkit that we called CosmicStrand and attribute to an unknown Chinese-speaking threat actor.
3274
GPT-4 vision prompt injection
Learn what GPT-4 Vision Prompt Injection is, and discover effective strategies to protect your models and data from vulnerabilities.
3275
NSA and IETF: Can an attacker purchase standardization of weakened cryptography?
It's normal for post-quantum cryptography to be rolled out as an extra layer of security on top of traditional pre-quantum cryptography, rather than as a replacement .
3276
Judge Releases Information about Police Use of Stingray Cell Phone Trackers
A Florida judge has sided with the ACLU to order release of information about police use of “stingrays,” which are invasive surveillance devices that send out powerful signals to trick cell phones into transmitting their locations and identifying information. The Tallahassee judge’s pro-transparency decision stands in…
3277
Introducing DNS Resolver for Tor
As was mentioned in the original 1.1.1.1 blog post, our policy is to never write client IP addresses to disk and wipe all logs within 24 hours. Still some folks might not want to reveal their IP address to the resolver at all. This is why we are launching a Tor hidden service for our resolver.
3278
Keeping secrets out of logs (2024)
There's no silver bullet, but if we put some "lead" bullets in the right places, we have a good shot at keeping sensitive data out of logs.
3279
HIPAA 101 for Software Development Teams
Everything you need to know about HIPAA compliance, from the basics to infrastructure requirements to building with AI.
3280
Microsoft ruined passwords, now aims for a passwordless future
Purism makes premium phones, laptops, mini PCs and servers running free software on PureOS. Purism products respect people's privacy and freedom while protecting their security.
3281
Why are McDonald’s Self Service Kiosks so hackable?
McDonalds in Australia do a decent cup of coffee. It’s not great but it’s consistently decent so I often start my day with a cup. Due to my travels around Australia in a decked out van I have seen how many McDonalds operate and just how many of
3282
3283
Meta Accounts: A New Login for VR
Today we’re introducing Meta accounts: a new way for people to log into their VR headsets that doesn’t require a Facebook account. When we announced that we would start requiring people to log into Meta Quest using a Facebook account, we received a lot of feedback from the Quest community. We took that feedback into…
3284
You might not need to store plaintext email addresses
Earlier this year, when I went from having only Facebook-login on Wishy.gift to allow registrations with email address and password, one of my concerns was how to implement this is a way that protects the data and privacy of my users. I don’t have any ads or analytics on the site, the users can select whatever display…
3285
Germany opposes client-side scanning planned by EU
Germany opposes client-side scanning planned by EU - it would create an unprecedented surveillance monster that violates fundamental rights.
3286
Digital surveillance technologies to fight pandemic must respect human rights
The COVID-19 pandemic is a global public health emergency that requires a coordinated and large-scale response by governments worldwide. However, States’ efforts to contain the virus must not be...
3287
3288
9th Circuit rejects TSA claim of impunity for checkpoint staff who rape traveler
Last December, we attended and reported on oral argument before the 9th Circuit Court of Appeals in a case in which the Transportation Security Administration (TSA) argued that TSA checkpoint staff have absolute immunity from lawsuits for assault, even sexual assault or rape, committed against travelers they are…
3289
Counterfeit Macbook charger teardown: convincing outside but dangerous inside
What's inside a counterfeit Macbook charger? After my Macbook charger teardown , a reader sent me a charger he suspected was counterfeit. ...
3290
Storing Passwords Securely
Why "SHA 256-bits enterprise-grade password encryption" is only slightly better than storing passwords in plain text, and better ways to do it.
3291
Why offer an Onion Address rather than just encourage browsing-over-Tor?
There are a bunch of reasons to launch an onion site, and a bunch of benefits, all of which have provided value to platforms such as Facebook, the BBC or NYT Onions. The first benefits are authenti…
3292
Congress passes Take It Down act despite major flaws
It would give the powerful a dangerous new route to manipulate platforms into removing lawful speech that they simply don't like, with President Trump himself saying that he would use the law to censor his critics. The bill passed the Senate in February, and it now heads to the president's desk.
3293
Fine-grained personal access tokens for GitHub
Fine-grained personal access tokens offer enhanced security to developers and organization owners, to reduce the risk to your data of compromised tokens.
3294
I Can Crack Your App With Just A Shell (And How To Stop Me)
Hi, I'm Kenneth. I’m a Swiss transplant in San Francisco. I’m an angel investor, and an engineer at AngelList & CSC. Previously, I was co-founder of FreshPay and the architect behind Chartboost. When I'm not working, you can find me either photographing some remote corner of the world, or hacking away on an…
3295
Exploiting IndexedDB API information leaks in Safari 15
Discover how a software bug in Safari 15's IndexedDB API can track your online activity and reveal your identity.
3296
3297
Behind the 6-digit code: Building HOTP and TOTP from scratch
Personal website of Doğaç Eldenk.
3298
OpenSSH 10.6p2 Critical workaround for alpine without PAM
OpenSSH release notes
3299
No, Safari 14 does not block Google Analytics
This article aims to subdue the rumors that Safari 14 will block Google Analytics (and other similar libraries) by default. It will not.
3300
Reauthorizing mass surveillance shouldn't be tied to funding the government
Section 702 is the controversial and much-abused mass surveillance authority that expires in December unless Congress renews it. EFF and others have been working hard to get real reforms into the law and have opposed a renewal, and now, we’re hearing about a rushed attempt to tie renewal to funding...