4411
An agent used DNS to reach an external chatbot
Research on aligning AI with human values and intent, and reports documenting model failures.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,768 posts.
4412
4413
Matrix.org Will Migrate to MAS
Matrix, the open protocol for secure decentralised communications
4414
VMs won't contain cyber-capable agents
You can no longer assume a mere VM will contain a sufficiently advanced AI agent.
4415
Pixel Security
Posted by Paul Crowley, Senior Software Engineer and Paul Lawrence, Senior Software Engineer [Cross-posted from the Android Developers Blog...
4416
Spoofing the Samsung Smart TV Internet Check
So it looks like Samsung is offline this morning . This shouldn't bother me - I don't work for them and their network isn't my problem. However it turns out that my Samsung Smart TV thinks there's no internet if there's no www.samsung.com :( - using tcpdump I started looking at what the TV was trying to contact when I…
4417
Your Android Phone Is a Security Key
Now, your phone running Android 7+ can be your security key, protecting you against phishing. Use it to protect your personal and work Google Accounts.
4418
How to Escape a Container
Panoptica by Outshift delivers advanced cloud-native security insights to help teams protect modern applications and infrastructure at scale.
4419
4420
The TSA's Selective Laptop Ban
Last Monday, the TSA announced a peculiar new security measure to take effect within 96 hours. Passengers flying into the US on foreign airlines from eight Muslim countries would be prohibited from carrying aboard any electronics larger than a smartphone. They would have to be checked and put into the cargo hold. And…
4421
4422
4423
Edward Snowden and Gen Y: a sign of leaks to come?
(Before I begin: there are participants in the discourse who would say that we're supposed to natter on about Edward Snowden , and not the contents of his disclosures, because turning it into a personal issue rather than a political one is useful to the machineries of state. But the point I'm about to make here is…
4424
Emails a browser extension developer gets from scammers
SponsorBlock is a crowdsourced browser extension to skip sponsor segments in YouTube videos.
4425
Setting Up an Ad-Blocking VPN with WireGuard and Pihole
This guide will walk you through the setup of a remote machine that will act as a personal VPN server at the cost of 3 to 5 USD per month. We will also configure it to act as a DNS resolver that will automatically block spam, tracking, advertising and malware domains on all of your connected devices.
4426
90-year-old Cryptanalytic Efforts Must Stay Secret, says NSA
The National Security Agency is withholding 90-year-old information on early American cryptanalytic efforts against Russia and the Soviet Union from a 20-year-old document on the grounds that relea…
4427
Codecov Bash Uploader compromised
Update 4/29/2021 3PM PT : Through our investigation, we now have additional information concerning what environment variables may have been obtained without authorization and how they may have been used. Affected users can view details within the Codecov application. Additionally, we have posted our most up-to-date…
4428
TeleSign profiles half of the world’s mobile phone users
TeleSign generates a “reputation score” and sells it to various clients. TeleSign secretly received the mobile phone data from BICS, a Belgian company that provides interconnection services
4429
Representing SHA-256 Hashes as Avatars
How to turn 256 bits of entropy into a beautiful, avatar-friendly circular SVG: the Hashvatar.
4430
Supabase Vault
Today we're announcing Vault, a Postgres extension for managing secrets and encryption inside your database.
4431
Extracting content from an LCP “protected” ePub
As Cory Doctorow once said "Any time that someone puts a lock on something that belongs to you but won't give you the key, that lock's not there for you." But here's the thing with the LCP DRM scheme; they do give you the key! As I've written about previously, LCP mostly relies on the user entering their password (the…
4432
No boundaries: Exfiltration of personal data by session-replay scripts
This is the first post in our “No Boundaries” series, in which we reveal how third-party scripts on websites have been extracting personal information in increasingly intrusive ways. [0] by Steven Englehardt, Gunes Acar, and Arvind Narayanan Update: we’ve released our data — the list of sites with session-replay…
4433
Understanding Docker Container Escapes
Trail of Bits recently completed a security assessment of Kubernetes, including its interaction with Docker. Felix Wilhelm’s recent tweet of a Proof of Concept (PoC) “container escape” sparked our interest, since we performed similar research and were curious how this PoC could impact Kubernetes. Quick and dirty way…
4434
4435
Nazar: Analyzing malware that was uncovered in leaked NSA files
In mid-2017, The Shadow Brokers exposed NSA files in a leak known as "Lost In Translation".Recently, researcher uncovered "Nazar", a previously-unknown APT that was mentioned in the leak.We decided to dive into each and every one of the components and share our technical analysis. What we found out, is far from being…
4436
How Dropbox hacks your mac
Update: also see Discovering how Dropbox hacks your mac If you have Dropbox installed, take a look at System Preferences > Security & Privacy > Accessibility tab (see …
4437
HTTPS as a ranking signal
Cross-posted from the Webmaster Central Blog Security is a top priority for Google. We invest a lot in making sure that our services us...
4438
Current MFA fatigue attack campaign targeting Microsoft Office 365 users
We provide around-the-clock threat detection and incident response, backed by expert consulting to keep your organization secure.
4439
Six day and IP address certificate options in 2025
Update: January 15, 2026 Six-day and IP address certificates are now generally available. See 6-day and IP Address Certificates are Generally Available for details. This year we will continue to pursue our commitment to improving the security of the Web PKI by introducing the option to get certificates with six-day…
4440
