391
See what JavaScript commands get injected through an in-app browser
I work with U.S. law firms as a non-testifying technical consulting expert on matters involving the Apple platform and iOS apps. Learn more about my litigation consulting.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,762 posts.
392
393
Google Has Removed MV2 Extensions from the Chrome Web Store, Including UBO
Google today reached the final milestone in a browser-extension transition that has been years in the making, all remaining Manifest V2 extensions were removed from the Chrome Web Store.
394
Tailscale SSH
Use this guide to setup Tailscale SSH. Learn how it transforms SSH connectivity by using your Tailscale identity for authentication. Enjoy simplified setup, added security with WireGuard®, and customizable access with ACLs. Ideal for managing secure connections across your tailnet.
395
One of the FBI’s Major Claims in the iPhone Case Is Fraudulent
“We have enormous computing power in the US government, but we need to be able to bring it to bear without the phone killing itself.” – FBI Director James Comey, March 1 , 2016.
396
Face ID and Touch ID for the Web
People often see passwords are the original sin of authentication on the web.
397
The privacy nightmare of browser fingerprinting
If you were worried about tracking cookies, you really don’t want to know about browser fingerprinting.
398
Unpacking Google’s Web Environment Integrity specification
Why Vivaldi browser thinks Google’s new proposal, the Web-Environment-Integrity spec, is a major threat to the open web and should be pushed back.
399
GDPR for lazy people: Block all European users with Cloudflare Workers
Xoilac TV là website chuyên phát sóng trực tiếp các trận bóng đá nổi tiếng với đội ngũ bình luận viên tiếng Việt hoàn toàn miễn phí. Tại đây, người xem có thể
400
401
SimulaVR Has Been Subpoenaed by Meta Platforms, Inc
A few days ago we received a large packet in the mail from Meta's legal team informing us that SimulaVR has been subpoenaed for their antitrust case FTC vs. Meta Platforms , in relation to the government's recent injunction against their acquisition of a VR fitness company.
402
403
QuadRF can spot drones and see WiFi through my wall
The QuadRF (pictured above) a phased-array radio built around a Raspberry Pi 5 and an FPGA board with picosecond-level timing. It does advanced signal processing and beamforming. It can see WiFi through walls and track drones in flight. If the open source community can come up with something like this, just imagine…
404
405
Fingerprints are the new cookies
Now open it on your phone or some other device and your nickname will be different and just as consistent.
406
The largest DDoS attack to date, peaking above 398M rps
Google Cloud stopped the largest known DDoS attack to date, which exploited HTTP/2 stream multiplexing using the new “Rapid Reset” technique.
407
Cloudflare's inaccessible browser contradicts the company's mission
About four months ago, Cloudflare launched Browser Isolation during Security Week, without ensuring that the product is accessible to blind people using screen readers. Now, four months later, this problem is still not solved. Cloudflare’s neglect of accessibility in this product raises a new barrier to employment for…
408
TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8
CVE-2026-98432 is a CVSS 9.8 remote use-after-free in Linux's IPv4 TCP handshake, fixed upstream Oct 15. RHEL has fixes; Ubuntu's are still in testing.
409
410
Who’s behind Wednesday’s epic Twitter hack?
Twitter was thrown into chaos on Wednesday after accounts for some of the world’s most recognizable public figures, executives and celebrities starting tweeting out links to bitcoin scams. Twitter says the attack happened because someone tricked or coerced an employee into providing access to internal Twitter…
411
I'm giving up on PGP
After years of wrestling GnuPG with varying levels of enthusiasm, I came to the conclusion that it’s just not worth it, and I’m giving up. At least on the concept of long term PGP keys.
412
If OpenSSL were a GUI
What if OpenSSL were a GUI program? Here's what it might look like.
413
WhatsApp's help pages hid LLM instructions: dont recommend a regulator
WhatsApp removed hidden notes telling AI not to recommend a regulator, and not to cite GDPR or CCPA once a lawyer came up. We quote both notes.
414
The Insecurity Industry
The greatest danger to national security has become the companies claiming to protect it
415
EU to legislate about Chat Control behind closed doors
Civil rights activist Dr. Patrick Breyer warns of an unprecedented "double-attack" on secure messaging ahead of critical Friday and Monday EU meetings. Ahead of a highly critical weekend for digital civil rights in Europe, former Member of the European Parliament Dr. Patrick Breyer is sounding th
416
I’m Terrified of My New TV
From facial recognition to personal data collection, this thing is downright scary -- and so are the implications.
417
OpenAI GPT–6 Astra breaks Enigma message that has resisted solution since 2005
On 15 September 2026, Carter Leffen contacted me to request validation of a break of the German Army Enigma message MVUEH of 10 July 1941. The message, which was sent by a radio station with the tactical callsign 2ny, was received by the radio station of the SS-Totenkopf Quartiermeister, Ib. Ib received the message at…
418
Megafail
In case you’ve been living under a rock the past few days, Kim Dotcom (of Megaupload infamy) has launched his new cloud storage site, Mega. Mega has an impressive sales pitch, promising secure cloud storage where only the user has the key to decrypt his or her files, and the encryption and decryption happens securely…
419
420
What happened with ASUS routers this morning?
Update on 2023/05/19: ASUS has publicly acknowledged the issue and provided an explanation and workaround of their own (rebooting, or a hard reset if the reboot doesn’t fix it). The original post is below: