Topics /
The most popular blog posts about security & privacy on Hacker News. 8,768 posts.
We're all impatiently waiting on quantum-proof asymmetrical crypto algorithms to become commonplace. Until that happens, we must all live with the assumption that all currently used asymmetric crypto will be trivially decryptable once quantum computers become powerful enough. This is probably the reason why government…
The latest Signal release for Android includes support for GIF search and browsing. Signal has long supported sending and receiving GIFs, but this is an experiment that allows users to browse, search, and select popular GIFs from within Signal.
We built an AirTag clone capable of silently and continuously tracking someone. The device accomplishes this by sending just one beacon per generated public key, thereby staying invisible to tracking notifications for iOS users and Apple’s Tracker Detect Android app.
ICE is using a smartphone app called “Mobile Fortify” to scan faces and capture contactless fingerprints, instantly pulling back names and biographical data — and court filings say the same encounters are being followed by revocations of Global Entry and TSA PreCheck. That turns “trusted traveler” into chilling of…
“The devil is in the details,” they say.
[“The welcoming, friendly and visually pleasing appearance” of the TSA’s headquarters at 6595 Springfield Center Drive, Springfield, VA.]
The Keybase browser extension subverts the app's end-to-end encryption. Keybase considers that "an acceptable risk" and not worth fixing.
DISCLAIMER: data theft is a serious crime in many jurisdictions. The author does not condone or encourage anyone to break laws. The information provided here is for educational purposes only.
The story of CVE-2025-55182 (React2Shell)
We could be celebrating the New Year by ripping out the fiber optic cables that are sending copies of all our emails to the National Security Agency. But instead, Congress is planning on ringing in 2013 by re-authorizing parts of the FISA Amendments Act, the controversial 2008 bill that allows...
Back in July last year, Scott Helme and I shipped a little pet project that tracked the world's largest websites not implementing HTTPS by default [https://www.troyhunt.com/why-no-https-heres-the-worlds-largest-websites-not-redirecting-insecure-requests/] . We called it Why No HTTPS? [https://whynohttps.
Today's update brings tools to prevent others from saving content from groups and channels, the ability to delete messages for specific periods of time, new ways to manage your connected devices, post anonymously in public groups on behalf of your channel and more.
May 6, 2025 – Ubuntu 25.10 is set to adopt sudo-rs by default. Sudo-rs is a memory-safe reimplementation of the widely-used sudo utility, written in the Rust programming language.
You should read Mat Honan’s heartbreaking tale of a hack attack and the ensuing discussion on Techmeme. Much of the story is about Amazon or Apple’s security practices, but I would stil…
In reaction to the invalidation of the Privacy Shield in July 2020 by the Court of Justice of the European Union (CJEU), US President Joe Biden adopted on 7 October 2022 a new legal framework (Executive Order) to strengthen safeguards on the collection and use of personal data by US intelligence agencies.
After running this command, PID 1 is hung in the pause system call. You can no longer start and stop daemons. inetd-style services no longer accept connections. You cannot cleanly reboot the system. The system feels generally unstable (e.g. ssh and su hang for 30 seconds since systemd is now integrated with the login…
The Great Firewall of China (GFW) conducted a large-scale, unconditional block targeting TCP port 443 on August 20, 2025. This report documents the measurements and analysis we conducted of that event.
MailChimp doesn’t seem to think double opt-in is a good idea for mailing lists anymore.
Now, you don't have to download VPN extensions or pay for VPN subscriptions to access blocked websites and to shield your browsing when on public Wi-Fi.
Big Tech companies - Apple, Google, and Meta - have built a mass surveillance machine that the government can easily tap into.
If you have ever tried scanning or photocopying a banknote, you may have found that your software—such as Adobe Photoshop, or the embedded software in the photocopier—refused to let you do so. That's because your software is secretly looking for security features such as EURion dots in the...
An analysis of current and potential kernel security mitigations Posted by Jann Horn, Project ...
The good news: TLS 1.3 is available, and the protocol, which powers HTTPS and many other encrypted communications, is better and more secure than its predecessors (including SSL). The bad news: Thanks to a financial industry group called BITS, there’s a look-alike protocol brewing called ETS (or...
The Department of Justice wants access to encrypted consumer devices but promises not to infiltrate business products or affect critical infrastructure. Yet that’s not possible, because there is no longer any difference between those categories of devices. Consumer devices are critical infrastructure. They affect…
