3931
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,768 posts.
3932
PyPI now supports digital attestations
Announcing support for PEP 740 on the Python Package Index
3933
3934
3935
Security Keys
Security Keys are (generally) USB-connected hardware fobs that are capable of key generation and oracle signing. Websites can “enroll” a security key by asking it to generate a public key bound to an “appId” (which is limited by the browser based on the site's origin). Later, when a user wants to log in, the website…
3936
3937
3938
Firefox 143 for Android to introduce DoH
All web browsing starts with a DNS query to find the IP address for the desired service or website. For much of the internet’s history, this query is sen
3939
3940
Most laser printer printed pages have tracking watermark
<br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><a href="http://brahmsyellowdots.blogspot.com/2008/10/it-begins.html">About This Blog</a>
3941
3942
Better-performing “25519” elliptic-curve cryptography
Automated reasoning and optimizations specific to CPU microarchitectures improve both performance and assurance of correct implementation.
3943
Tor's Fall Harvest: The Next Generation of Onion Services
We are hyped to present the next generation of onion services! We've been working on this project non-stop for the past 4 years and we officially launched it two weeks ago by publishing our first alpha releases. All in all, the new system is a well needed improvement that fixes many shortcomings of the old design, and…
3944
We want Texans to know their rights
Last May, EFF reported that a sheriff’s office in Texas searched data from more than 83,000 automated license plate reader (ALPR) cameras to track down a woman suspected of self-managing an abortion. ALPRs are promoted as tools for keeping communities safe by finding missing persons and locating...
3945
3946
How to harden GitHub Actions
Build resilient GitHub Actions workflows with insights from real attacks, missteps to avoid, and security tips GitHub’s docs don’t fully cover.
3947
When coding style survives compilation: De-anonymizing programmers from binaries
In a recent paper, we showed that coding style is present in source code and can be used to de-anonymize programmers. But what if only compiled binaries are available, rather than source code? Today we are releasing a new paper showing that coding style can survive compilation. Consequently, we can utilize these…
3948
Analysis and Exploitation of a Linux Kernel Vulnerability
FortiMail Workspace Security secures user-facing apps from advanced threats that target Email, Browsers, Collaboration Tools and Cloud Storage Apps.
3949
Cyberespionage Using SS7 via Circles
Circles is a surveillance firm that reportedly exploits weaknesses in the global mobile phone system to snoop on calls, texts, and the location of phones around the globe, and is affiliated with NSO Group, which develops the oft-abused Pegasus spyware. Using Internet scanning, we found a unique signature associated…
3950
How to request removal of your contact info from Google search results
A new tool in Google Search can help you easily control whether your personally-identifiable information can be found in Search results.
3951
3952
Total security in a PostgreSQL database
The technologies used to build or run their apps
3953
Microsoft 365 Copilot – Arbitrary Data Exfiltration via Mermaid Diagrams
When Microsoft 365 Copilot (M365 Copilot) was asked to summarize a specially crafted Microsoft Office document, an indirect prompt injection payload triggered the execution of arbitrary instructions to fetch sensitive tenant data, such as “recent emails” and hex encode the fetched output. M365 Copilot then generated a…
3954
Hacking the Nintendo DSi Browser
I managed to exploit the Nintendo DSi browser 15 years after it was released in Japan. This post will go over the journey and the technical details.
3955
Attacking Merkle Trees with a second preimage attack
Hacking, hardware, software, and general curiosities of computing machinery! Docendo discumus.
3956
PiFex: JTAG Hacking with a Raspberry Pi
With this blog post, we'll introduce the PiFex, a basic companion board for the Raspberry Pi designed to teach users the basics of hardware hacking and embedded protocols. We will then demonstrate how to use the PiFex to access a JTAG tap on an undocumented SSD, allowing memory reads and GDB access to the SSD CPU.
3957
Passwordless: a different kind of hell?
It's no secret that authenticating into services is an unresolved topic. With time, we have managed
3958
The Now-Defunct Firms Behind 8chan, QAnon
Some of the world’s largest Internet firms have taken steps to crack down on disinformation spread by QAnon conspiracy theorists and the hate-filled anonymous message board 8chan . But according to a California-based security researcher, those seeking to de-platform these communities may have overlooked a simple legal…
3959
Gab Has Been Breached
I've investigated hundreds of data breaches over the years (there are 514 of them in Have I Been Pwned [https://haveibeenpwned.com/] as I write this), and for the most part, the situation with Gab is just another day on the internet. But Gab is also different, having grown
3960
I can't use my number pad for 2FA codes
This has to be the most infuriating bug report I've ever submitted. I went to type in my 2FA code on a website - but no numbers appeared on screen. Obviously, I was an idiot and had forgotten to press the NumLock button. D'oh! I toggled it on and typed again. No numbers appeared. I switched to another tab, my numbers…