Topics /
The most popular blog posts about security & privacy on Hacker News. 8,762 posts.
Earlier today, the Senate Judiciary Committee voted to advance the dangerous EARN IT bill. We’re disappointed to see the committee advance this misguided bill. If enacted, EARN IT will put massive legal pressure on internet companies both large and small to stop using encryption and instead scan...
Let's Encrypt is an amazing organisation doing an amazing thing by providing certificates at scale, for free. The problem though was that they were the only such organisation for a long time, but I'm glad to say that the ecosystem is changing. It's always a good idea
Were you aware of it: Microsoft is phoning home the content of your PowerPoint slides. Don't just take my word for it: open up the network monitor of your...
Many security-conscious people probably think they’d never fall for a phone-based phishing scam. But if your response to such a scam involves anything other than hanging up and calling back the entity that claims to be calling, you may be in for a rude awakening. Here’s how one security and tech-savvy reader got taken…
The Sophos Blog
TL;DR: we have discovered XMPP (Jabber) instant messaging protocol encrypted TLS connection wiretapping (Man-in-the-Middle attack) of jabber.ru (aka xmpp.ru) service’s servers on Hetzner and Linode hosting providers in Germany. The attacker has issued several new TLS certificates using Let’s Encrypt service which were…
A new law being proposed in Germany would see all 19 federal state intelligence agencies in Germany granted the power to spy on German citizens through
Spoiler: it doesn’t. But it should.
Imagine… Last night, lightning struck our house and burned it down. I escaped wearing only my nightclothes. In an instant, everything was vaporised. Laptop? Cinders. Phone? Ashes. Home server? A smouldering wreck. Yubikey? A charred chunk of gristle. This presents something of a problem. In order to recover my digital…
The last document from the Snowden archive was published on 29 May 2019. The Guardian stopped publishing documents in February 2014, Der Spiegel in January 2015, and The New York Times and ProPublica in August 2015. After that, only The Intercept was still publishing documents, with only a few exceptions, until it…
We're excited to launch a new browser extension and mobile app, extending DuckDuckGo's protection beyond the search box to wherever the Internet takes you.
The JFrog security research team recently identified a supply chain attack targeting the `xinference` package on PyPI. Versions 2.6.0, 2.6.1, and 2.6.2 were compromised and yanked by maintainers after users reported suspicious behavior. If you installed or imported these versions, you must assume your environment is…
Article removed for legal reasons, sorry. After receiving a Czech version of a cease and desist letter from a legal representative of A. F., I've removed the article. You'll find articles based on my story in “Recommended reading” below, go read them.
EFF is fighting another attempt by a giant corporation to take advantage of our poorly drafted federal computer crime statute for commercial advantage—without any regard for the impact on the rest of us. This time the culprit is LinkedIn. The social networking giant wants violations of its...
tldr: Swing VPN is using its user base to DDOS sites using its users as a an attack botnet. Introduction It all started with a friend of mine complaining that his phone was doing a request to a specific app every few seconds. Initial assumption was that the phone was infected with a virus but a 2 minute investigation…
Let me just cut straight to it: I'm going to open source the Have I Been Pwned code base. The decision has been a while coming and it took a failed M&A process to get here, but the code will be turned over to the public for the
Wiz Research found a data exposure incident on Microsoft’s AI GitHub repository, including over 30,000 internal Microsoft Teams messages – all caused by one misconfigured SAS token
Like FLoC and Privacy Sandbox before it, Google Chrome’s Manifest V3 is another example of the inherent conflict of interest that comes from Google controlling both the dominant web browser and one of the largest internet advertising networks.
Looking for an em dash I was recently trying to find an em dash character to use in a piece of writing. Since I don’t have the shortcut memorized—for future reference, shift+option+minus on Mac—I did a quick search for it. I didn’t see one on the search results page to copy, so I clicked into the first result: “The…
This morning we sent the following letter to the offices of the Attorney General and the Federal Bureau of Investigation.
Back in March, I wrote about Bitwarden doubling their Premium price — and specifically how they did it. Buried in a feature announcement. Priced in fake...
Yesterday a bipartisan group of U.S. Senators introduced a new bill called the EARN IT act. On its face, the bill seems like a bit of inside baseball having to do with legal liability for informati…
