4291
Domain-validated SSL will soon be free from the large CAs
Upcoming plans revealed from two of the largest commercial CAs
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,768 posts.
4292
How I lost control of our bank accounts to a phone scammer
Yesterday, instead of having a productive afternoon at home, I had the privilege of sitting at the bank for a couple of hours, resolving a problem completely of my own doing: I fell for a phone scammer. My wife and I had to close our accounts—which were in excess of 25 years old—and set up new ones. I then spent hours…
4293
Titled Tuesday Cheating
Fantastic Cheaters and Where to Find Them
4294
An aggressive, stealthy web spider operating from Microsoft IP space
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
4295
Tracking users via CSS
I try to be a friendly citizen of the web. I try to keep my site in good shape. It should load quickly, track nothing beyond your basic server logs, not hassle you about cookies, GDPR or my newsletter. I do have a newsletter but it won't pop up in your face here. I try to stay firmly on the side of friendly and a good…
4296
Civil Liberties Groups Speak Out Against CISPA in Lead Up to Hearings
On Monday, EFF and over 30 other Internet rights organizations sent a letter to members of Congress demanding they vote no on the "cybersecurity" bill known as CISPA. The letter starts off a week in which Congress will hold three different hearings about CISPA and computer and network security. In...
4297
I scanned all of GitHub's "oops commits" for leaked secrets
GitHub Archive logs every public commit, even the ones developers try to delete. Force pushes often cover up mistakes like leaked credentials by rewriting Git history. GitHub keeps these dangling commits, from what we can tell, forever. In the archive, they show up as “zero-commit” PushEvents.
4298
At least 11 cities use automated surveillance in the EU
At least 11 local police forces in Europe use computer vision to automatically analyze images from surveillance cameras. The risks of discrimination run high but authorities ignore them.
4299
Blackmail fail
In which the author receives surprising offers from kind strangers
4300
Recovering redacted information from pixelated videos
We explore the history of image unblurring and present a simple yet effective technique to get a high-resolution image from a pixelated video in order to recover redacted information (with no guessing involved).
4301
TrustTunnel: AdGuard VPN protocol goes open-source
Today is a big day for us, and for everyone who cares about transparency, privacy, and having full control over their own traffic. We’re finally open-sourcing the protocol that powers AdGuard VPN. And it now has a name: TrustTunnel.
4302
Some thoughts on Spectre and Meltdown
The story of these attacks starts in late 2004. I had submitted my doctoral thesis and had a few months before flying back to Oxford for my defense, so I turned to some light reading: Intel's latest "Optimization Manual", full of tips on how to write faster code. (Eking out every last nanosecond of performance has…
4303
Potent malware that hid for six years spread through routers
While analyzing some memory dumps suspicious of being infected with a keylogger, we identified a library containing strings to interact with a virtual file system. This turned out to be a malicious loader internally named “Slingshot”.
4304
4305
DHS Asserting Unconstitutional Authority to Search Travelers’ Phones and Laptops
BOSTON — The Electronic Frontier Foundation (EFF) and the ACLU today asked a federal court to rule without trial that the Department of Homeland Security violates the First and Fourth Amendments by searching travelers’ smartphones and laptops at airports and other U.S. ports of entry without a...
4306
EFF Relaunches Surveillance Self-Defense Guide
We’re thrilled to announce the relaunch of Surveillance Self-Defense (SSD), our guide to defending yourself and your friends from digital surveillance by using encryption tools and developing appropriate privacy and security practices. The site launches today in English, Arabic, and Spanish, with...
4307
Hacking an ATM
At the Black Hat conference in 2010, an ATM designed and built by my employer was setup on stage, and a security researcher demonstrated an ...
4308
Vulnerability in Bumble dating app reveals any user's exact location
The vulnerability in this post is real. The story and characters are obviously not.
4309
SecureDrop
SecureDrop is an open-source whistleblower support system, originally written by Aaron Swartz and now run by the Freedom of the Press Foundation. The first instance of this system was named StrongBox and is being run by The New Yorker. To further add to the naming confusion, Aaron Swartz called the system DeadDrop…
4310
No, PGP is not broken, not even with the Efail vulnerabilities
Recently, news broke about potential vulnerabilities in PGP, dubbed Efail. However, despite reports to the contrary, PGP is not actually broken, as we will explain in this post.
4311
How SHA-2 works step-by-step (SHA-256)
Learn to code from scratch with hands-on lessons, a structured curriculum, and real projects. Stop watching tutorials, start writing code for free now.
4312
A researcher’s tale of defeating traps, tricks, and complex virtual machines
Office 365 Advanced Threat Protection (Office 365 ATP) blocked many notable zero-day exploits in 2017. In our analysis, one activity group stood out: NEODYMIUM. This threat actor is remarkable for two reasons: FinFisher is such a complex piece of malware that, like other researchers, we had to devise special methods…
4313
ISPs in AU and NZ start censoring the internet without legal precedent
Several websites including Voat, ZeroHedge, Archive.is, LiveLeak, and others have been blocked in Australia and New Zealand in direct contravention to
4314
The Right to Lie and Google’s “Web Environment Integrity”
This is a fundamental principle of free and open source software. The World Wide Web abides by this principle, although we don’t often think of it that way. The Web is just an agreed-on set of programmatic interfaces: if you send me this, I’ll send you that. Your computer can construct the “this” by whatever means it…
4315
Android's theft protection features
Android rolls out theft protection features to safeguard your data before, during and after a theft incident.
4316
Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators
Why you should be opting for local tooling when working with sensitive data, even Non-Production ones.
4317
4318
OpenSSL Licensing Update
The following is a press release that we just released, with the cooperation and financial support of the Core Infrastructure Initiative and the Linux Foundation.
4319
Price of a bot army revealed across online platforms
The first global index tracking real-time prices for buying fake account verifications on 500+ online platforms in every country has been launched by a team at the University of Cambridge.
4320
We X-Rayed a Suspicious FTDI USB Cable
That cheapo cable you bought online? Probably a counterfeit. We x-rayed a suspicious cable to show you exactly what that means, and why counterfeits work worse and wear out faster.