3841
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,768 posts.
3842
3843
Why can't Apple decrypt your iPhone?
Last week I wrote about Apple’s new default encryption policy for iOS 8. Since that piece was intended for general audiences I mostly avoided technical detail. But since some folks (and appar…
3844
How to Delete Your 23andMe Data
This week, the genetic testing company 23andMe filed for bankruptcy, which means the genetic data the company collected on millions of users is now up for sale. If you don't want your data included in any potential sale, it’s a good time to ask the company to delete it.
3845
Tracking the WhatsApp habits of random smartphones
Scaling the WhatsApp online-status hack from a single contact to 5000 random phone numbers — what the data says about phone usage habits.
3846
Formal Verification: The Gap Between Perfect Code and Reality
Thanks to Vlad Brown and Drawings Team for Russian and Uzbek translations. In Fall 2017, I took MIT’s 6.826, Principles of Computer Systems, taught by Turing Award-winner Butler Lampson, Nickolai Z
3847
Internet of Crappy Things
There is a flood of appliances which could be connected - and some are connected - without a second thought as to whether or not it’s necessary or secure.
3848
Whose code am I running in GitHub Actions?
I wanted to know what third-party code I was using in my GitHub Actions. I was able to use standard text processing tools and shell pipelines to get a quick tally.
3849
Handshake: Decentralizing DNS to Improve the Security of the Internet
News and announcements from Namebase.
3850
Estonian Electronic Identity Card: Security Flaws in Key Management
Arnis Parsovs, Software Technology and Applications Competence Center and University of Tartu
3851
Over 30% of Official Images in Docker Hub Contain Security Vulnerabilities
Docker Hub is a central repository for Docker developers to pull and push container images. We performed a detailed study on Docker Hub images to understand how vulnerable they are to security threats. Surprisingly, we found that more than 30% of images in official repositories are highly susceptible to a variety of…
3852
Multi-modal prompt injection image attacks against GPT-4V
GPT4-V is the new mode of GPT-4 that allows you to upload images as part of your conversations. It’s absolutely brilliant. It also provides a whole new set of vectors …
3853
More on the NSA Commandeering the Internet
If there’s any confirmation that the U.S. government has commandeered the Internet for worldwide surveillance, it is what happened with Lavabit earlier this month. Lavabit is—well, was—an e-mail service that offered more privacy than the typical large-Internet-corporation services that most of us use. It was a small…
3854
Tarsnap: No heartbleed here
There's a few reasons for this. First, the Tarsnap client-server protocol does not use TLS; instead, it uses a protocol which is about 100x simpler (in terms of the number of pages of documentation required to define it). This means there's less code and far fewer edge cases where bugs can lurk without being triggered…
3855
What web developers should know about SSL
The most common questions we get from developers who already know their stuff
3856
3857
macOS Zero-Day Used Against Hong-Kong Activists
Google researchers discovered a MacOS zero-day exploit being used against Hong Kong activists. It was a “watering hole” attack, which means the malware was hidden in a legitimate website. Users visiting that website would get infected. From an article: Google’s researchers were able to trigger the exploits and study…
3858
FISA Court Rejects Catch-22 Secrecy Argument in FOIA Case
In the first publicly known victory by a non-government party before the Foreign Intelligence Surveillance Court (FISC), the secret court today granted a motion filed by EFF related to an ongoing Freedom of Information Act lawsuit. The FISC gave its OK to the public disclosure of an earlier opinion...
3859
How to Spoof PDF Signatures
One year ago, we received a contract as a PDF file. It was digitally signed. We looked at the document - ignoring the "certificate is not tr...
3860
(Very) Basic Intro to Elliptic Curve Cryptography
Learn cryptography in Go by building ciphers, hashes, password security, and encryption tools. Understand security beneath the library call.
3861
Welcoming the Nepalese Government to Have I Been Pwned
Today, we welcome the 47th government onboarded to Have I Been Pwned’s free gov service: Nepal. Their National Cyber Security Centre now has access to monitor Nepalese government domains against the data in HIBP. This gives the NCSC the ability to identify exposure across government email addresses and respond
3862
3863
3864
Data-at-Rest Encryption in DuckDB
DuckDB 1.4 ships database encryption capabilities. In this blog post, we dive into the implementation details of the encryption, show how to use it, and demonstrate its performance implications.
3865
3866
Inside the failed attempt to backdoor SSH globally that got caught by chance
Why the threat actor rushed deployment.
3867
OpenAI DayBreak – GPT-5.5-Cyber
OpenAI introduces new Daybreak tools, including Codex Security and GPT-5.5-Cyber, to help organizations find, validate, and patch vulnerabilities at scale.
3868
Phish-friendly domain registry ".top" put on notice
The Chinese company in charge of handing out domain names ending in “ .top ” has been given until mid-August 2024 to show that it has put in place systems for managing phishing reports and suspending abusive domains, or else forfeit its license to sell domains. The warning comes amid the release of new findings that…
3869
Yes, All DRM
Everybody knows that the digital locks of DRM on the digital media you own is a big problem. If you’ve bought a digital book, album, or movie, you should be able to do what you want with it—whether that’s enjoying it wherever you want to, or making it more accessible by changing the font size or...
3870
Can We Stop Pretending SMS Is Secure Now?
SMS text messages were already the weakest link securing just about anything online, mainly because there are tens of thousands of employees at mobile stores who can be tricked or bribed into swapping control over a mobile phone number to someone else. Now we’re learning about an entire ecosystem of companies that…