361
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,762 posts.
362
The curious case of the Raspberry Pi in the network closet (2019)
Personal Blog of Christian Haschek
363
Signal partners with Microsoft to bring end-to-end encryption to Skype
In collaboration with Signal, Microsoft is introducing a Private Conversations feature in Skype, powered by Signal Protocol.
364
Every new car sold in the European Union must include a driver monitoring camera
The EU's new mandatory ADDW rules could make roads safer by altering distracted drivers, but its privacy safeguards and data handling rules remain a gray area.
365
Curl will not accept vulnerability reports during July 2026
The curl project will not accept or otherwise handle any vulnerability reports during the month of July 2026. We call it the curl summer of bliss. curl's submission form on Hackerone will be paused starting July 1, 2026. Summer of bliss starts: July 1, 2026. 00:00 CEST Submissions resume: August 3 2026. 09:00 CEST The…
366
Fingerprints can be hacked
Fingerprint authentication is a convenient alternative to passwords and PIN codes. Who wants to spend time typing in a lengthy string of numbers, letters and characters when a simple tap will suffice? Unfortunately, that convenience comes at a cost. Because, unlike a regular password, you leave your fingerprint on…
367
Latest Firefox rolls out Enhanced Tracking Protection 2.0
Today, Firefox is introducing Enhanced Tracking Protection (ETP) 2.0, our next step in continuing to provide a safe and private experience for our users. E
368
Chat Control Must Be Stopped
Chat Control is back to undermine everyone's privacy. There's an important deadline on October 14th, 2025. We must act now to stop it!
369
DarkSide ransomware gang quits after servers, Bitcoin stash seized
The DarkSide ransomware affiliate program responsible for the six-day outage at Colonial Pipeline this week that led to fuel shortages and price spikes across the country is running for the hills. The crime gang announced it was closing up shop after its servers were seized and someone drained the cryptocurrency from…
370
Cloudflare Turnstile requiring fingerprintable WebGL
Since about a week, Cloudflare Turnstile (their "Verify you're human" device verification) has been looping indefinitely in my webkit-gtk based browser . Preventing access to quite few websites ( previously , but it even went worse lately). Turns out it's because Cloudflare wants to have a fingerprint of your device…
371
Slack AI Training with Customer Data
Slack's Terms and Policies, including privacy, Terms of Service, API terms, security, and more.
372
YouTube's Anti-Adblock and uBlock Origin
Recently, YouTube has been ramping up its anti-adblock effort, and I’ve been watching this closely. This blog post is where I write down what I know. Some...
373
374
Firefox 59 to strip path information from referrer values for 3rd parties
Starting in version 59, Firefox Private Browsing will remove path data from Referrers sent to third parties. This will help prevent accidentally leaking data to third parties.
375
Reducing notification permission prompt spam in Firefox
Permission prompts are a common sight on the web today. They allow websites to prompt for access to powerful features when needed, giving users granular and contextual choice about what ...
376
Google has another secret browser
another hidden browser which is accessible by a link
377
Apple allows some iOS apps to track user locations via lists of nearby SSIDs
苹果公司自诩为用户隐私的捍卫者，然而这并非事实。 在近十年的时间里，苹果允许应用程序具备跟踪用户位置的能力，而不提供关闭此功能或引起用户对此的关注的选项。 而且这是「只有苹果可以做到的」（Only Apple Can Do）！
378
Google: Security Keys Neutralized Employee Phishing
Google has not had any of its 85,000+ employees successfully phished on their work-related accounts since early 2017, when it began requiring all employees to use physical Security Keys in place of passwords and one-time codes, the company told KrebsOnSecurity.
379
Mullvad VPN was subject to a search warrant – customer data not compromised
On April 18 at least six police officers from the National Operations Department (NOA) of the Swedish Police visited the Mullvad VPN office in Gothenburg with a search warrant. They intended to seize computers with customer data.
380
How I attacked myself using Google and I ramped up a $1000 bandwidth bill
It all started with an email. From: Amazon Web Services LLC Subject: Review of your AWS Account Estimated Month to Date Billing Charges...
381
Google Analytics: Stop feeding the beast
Google Analytics is only very superficially free. Why I removed it, what it really costs your users, and the privacy-friendly alternatives I use instead.
382
383
384
SSH hacks – a little sanity for remote workers
A few of our favorite SSH tricks and tips sure to improve your daily experience.
385
386
Smuggling arbitrary data through an emoji
With ZWJ (Zero Width Joiner) sequences you could in theory encode an unlimited amount of data in a single emoji.
387
Google Antigravity exfiltrates data via indirect prompt injection attack
An indirect prompt injection in an implementation blog can manipulate Antigravity to invoke a malicious browser subagent in order to steal credentials and sensitive code from a user’s IDE.
388
How I recorded user behaviour on my competitor’s websites
A test that hijacked the Chrome back button to send visitors to a fake Google results page, then to mirrored competitor pages where heatmaps, sessions and typing were recorded. Google de-indexed the whole domain.
389
390
ChatGPT now knows what you do on other websites via ad collector
OpenAI's ad collector at bzr.openai.com sets a cookie called __obi, scoped to .openai.com. The value is while you are on ChatGPT and tied to your ChatGPT account. __obi is then sent to OpenAI from ordinary websites you visit. Any company that buys ads on ChatGPT installs