3991
What’s going on with security at PayPal?
PayPal's one-time login codes are a security disaster. Your account is at severe risk; remove your data or close your account immediately.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,768 posts.
3992
3993
More malicious extensions in Chrome Web Store
So far I discovered 18 malicious extensions with 55 million users in total. Most popular ones are: Autoskip for Youtube, Crystal Ad block and Brisk VPN. They have been active for two years, undetected by Google.
3994
3995
EFF: forced disclosure of encryption password violates 5th Amendment
San Francisco - The Electronic Frontier Foundation (EFF) urged a federal court in Colorado today to block the government's attempt to force a woman to enter a password into an encrypted laptop, arguing in an amicus brief that it would violate her Fifth Amendment privilege against self-incrimination...
3996
3997
What’s Hiding in Your PDF?
PDFs hold information you may not know about. Discover different forms of metadata and where to look for them.
3998
Harvesting LinkedIn data for fun and profit
A few years ago, before the GDPR era, I was involved in a stealth marketing startup. We went out of
3999
EU Court of Justice: Censorship in Name of Copyright Violates Fundamental Rights
Paris, November 24th, 2011 — The European Court of Justice just rendered a historic decision in the Scarlet Extended case, which is crucial for the future of rights and freedoms on the Internet. The Court ruled that forcing Internet service providers to monitor and censor their users' communications
4000
Holy War on Sites That Demand Pinboard Passwords
Over two years ago I introduced an API authentication method so people could authorize outside third-party websites to add things to their Pinboard account without sharing their Pinboard password.
4001
All ProtonVPN apps are now open source and audited
Users can have more trust in ProtonVPN because all our apps are open source and independently audited for security. Learn about Proton VPN’s open source apps.
4002
Critical cross-account vulnerability in Microsoft Azure automation service
AutoWarp is a critical vulnerability in Microsoft Azure Automation Service that allows unauthorized access to other customer accounts using the service.
4003
Let's Encrypt Root and Intermediate Certificates
The keys and certificates that will underlie Let’s Encrypt have been generated. This was done during a key ceremony at a secure facility today. The following objects were created: Key pair and self-signed cert for the ISRG root Key pair and certificate for the ISRG root’s OCSP Key pairs and certificates for two Let’s…
4004
4005
Why Aren't There More Terrorist Attacks?
As the details of the Times Square car bomb attempt emerge in the wake of Faisal Shahzad’s arrest Monday night, one thing has already been made clear: Terrorism is fairly easy. All you need is a gun or a bomb, and a crowded target. Guns are easy to buy. Bombs are easy to make. Crowded targets—not only in New York, but…
4006
Using lots of little tools to aggressively reject the bots
Or using lots of little tools to aggressively reject the bots
4007
4008
4009
Security keys are now supported for SSH Git operations
You can now use FIDO2 security keys to authenticate over SSH for remote Git operations, providing a higher level of account security.
4010
AI agents find $4.6M in blockchain smart contract exploits
On a benchmark of real exploited contracts, AI agents found vulnerabilities worth a combined $4.6 million, underscoring the need for AI-powered defense.
4011
Apple in China: who holds the keys?
Last week Apple made an announcement describing changes to the iCloud service for users residing in mainland China. Beginning on February 28th, all users who have specified China as their country/r…
4012
4013
Class Action Targets Experian over Account Security
A class action lawsuit has been filed against big-three consumer credit bureau Experian over reports that the company did little to prevent identity thieves from hijacking consumer accounts. The legal filing cites liberally from an investigation KrebsOnSecurity published in July, which found that identity thieves were…
4014
It seems that OpenAI is scraping [certificate transparency] logs
lol. I minted a new TLS cert and it seems that OpenAI is scraping CT logs for what I assume are things to scrape from, based on the near instant response from ...
4015
Lessons learned from cracking 2 million LinkedIn passwords
A community of security professionals discussing IT security and compliance topics and collaborating with peers.
4016
Charlie Stross on Girls Around Me
There is an app, currently on the Apple app store as a free download, called Girls Around Me .
4017
Preparing to Issue 200M Certificates in 24 Hours
On a normal day Let’s Encrypt issues nearly two million certificates. When we think about what essential infrastructure for the Internet needs to be prepared for though, we’re not thinking about normal days. We want to be prepared to respond as best we can to the most difficult situations that might arise. In some of…
4018
The No CAPTCHA problem
When I read about No CAPTCHA for the first time I was really excited. Did we finally find a better solution? Hashcash? Or what? Finally it...
4019
Keeping the Internet fast and secure: introducing Merkle Tree Certificates
Cloudflare is launching an experiment with Chrome to evaluate fast, scalable, and quantum-ready Merkle Tree Certificates, all without degrading performance or changing WebPKI trust relationships.
4020
Troubling Arguments from the Government in Smith v. Obama
We’ve filed our reply brief in the appeal of Smith v. Obama, our case challenging the NSA’s mass telephone records collection on behalf of Idaho nurse Anna Smith. The case will be argued before the Ninth Circuit Court of Appeal on December 8, 2014 in Seattle, and the public is welcome to attend....