3421
Update on campaign targeting security researchers
An update on a hacking campaign targeting security researchers.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,768 posts.
3422
Microsoft Patches Six Zero-Day Security Holes
Microsoft today released another round of security updates for Windows operating systems and supported software, including fixes for six zero-day bugs that malicious hackers already are exploiting in active attacks.
3423
SHA-3 to Be Announced
NIST is about to announce the new hash algorithm that will become SHA-3. This is the result of a six-year competition, and my own Skein is one of the five remaining finalists (out of an initial 64). It’s probably too late for me to affect the final decision, but I am hoping for “no award.” It’s not that the new hash…
3424
How we turned the tables to catch my sister’s Bumble stalker
My sister’s stalker, who had used Instagram and Bumble to work out where she lived and start stalking her in real life, was recently…
3425
Become unbannable from your email
You don't own your email; you rent it. This vulnerability leaves your entire digital life at risk. Read how to seize back control of your most critical online asset by switching providers and setting up your own unbannable email server.
3426
The fake browser update scam gets a makeover
One of the oldest malware tricks in the book — hacked websites claiming visitors need to update their Web browser before they can view any content — has roared back to life in the past few months. New research shows the attackers behind one such scheme have developed an ingenious way of keeping their malware from…
3427
Free Your Android
After all the recent NSA revelations, it's been even more important to use Free Software on our mobile phones. Let me express this in another way: We should be very careful about what software we use on a device that is always on and in our pocket 24h a day. Starting from the very basic thing tha...
3428
Cloudflare keeps sending emails over a year after account was cancelled
It has been over a year since I cancelled my Cloudflare account. They keep emailing me and haven't taken me off their marketing lists despite repeated requests. Their CTO told me he would investigate, but nothing changed. Their Data Protection Office hasn't respond to my requests. Cloudflare do not appear to respect…
3429
Ten years of JSON Web Token and preparing for the future
Ten years ago this week, in May 2015, the JSON Web Token (JWT) became RFC 7519 . This was the culmination of a 4.5 year journey to create a simple JSON-based security token format and underlying JSON-based cryptographic standards. The full set of RFCs published together was:
3430
Rust and C++ Interoperability in Chrome
Chrome engineers are experimenting with Rust. For the foreseeable future, C++ is the reigning monarch in our codebase, and any use of Rust will need to fit in with C++ — not the other way around. This seems to present some C++/ Rust interoperability challenges which nobody else has faced.
3431
3432
Google’s Nest fiasco harms user trust and invades their privacy
Last month, Google announced that its Nest Secure would be updated to work with Google Assistant software. The problem? Google never told users its product had a microphone to begin with. Simple oversight or invasion of privacy? We break it down.
3433
Operation Luigi: How I hacked my friend without her noticing (2017)
My friend gave me permission to hack her, here's how I did it and how to stop it happening to you.
3434
3435
Random number generator enhancements for Linux 5.17 and 5.18
The random number generator has undergone a few important changes for Linux 5.17 and 5.18, in an attempt to modernize both the code and the cryptography used. The smaller part of these will be released with 5.17 on Sunday, while the larger part will be merged into 5.18 on Monday, which should receive its first release…
3436
US Government Continues Encryption War
Evergreen privacy guides, threat modeling, encryption, practical tutorials.
3437
Qualcomm, National Security, and Patents
The Trump administration blocked Broadcom’s acquisition of Qualcomm, and I think it was the right move. Understanding why means understanding Qualcomm and Broadcom’s plan for the compan…
3438
Swift Crypto
I’m thrilled to announce a new open-source project for the Swift ecosystem, Swift Crypto. Swift Crypto is a new Swift package that brings the fantastic APIs of Apple CryptoKit to the wider Swift community. This will allow Swift developers, regardless of the platform on which they deploy their applications, to access…
3439
How does misalignment scale with model intelligence and task complexity?
Research done as part of the first Anthropic Fellows Program during Summer 2025.
3440
3441
3442
3443
The hidden JTAG in a Qualcomm/Snapdragon device’s USB port
Learn about JTAG and EUD
3444
NilAway: Practical nil panic detection for Go
Uber has widely adopted Golang (Go for short) as a primary programming language for implementing backend services and libraries due to its high performance. The Go monorepo is the largest codebase at Uber, comprising 90 million lines of code (and growing). This makes tooling for writing reliable Go code a critical…
3445
Google Fiber Continues Awful ISP Tradition of Banning “Servers”
Update (10/16/2013): Google Fiber has made a change to their Acceptable Use Policy that clarifies that some non-commercial uses for running servers are permitted. We applaud Google for making this change, but note that there are still provisions to take issue with in the policy, such as the...
3446
What "consent" looks like for the DEA and TSA
The Drug Enforcement Agency (DEA) and the Transportation Security Administration (TSA) have been working together for years to steal travelers’ money.
3447
3448
3449
Maybe Skip SHA-3
In 2005 and 2006, a series of significant results were published against SHA-1 [ 1 ][ 2 ][ 3 ]. These repeated break-throughs caused something of a crisis of faith as cryptographers questioned whether we knew how to build hash functions at all. After all, many hash functions from the 1990's had not aged well [ 1 ][ 2…
3450
Whose Computer Is It?
Patrick Wardle highlighted a tweet by Maxwell (" Some Apple apps bypass some network extensions and VPN Apps. Maps for example can directly access the internet bypassing any NEFilterDataProvider or NEAppProxyProviders you have running "), sparking an extensive HN discussion on Apple's ham-fisted tactics (not unlike…