4531
Leaking silhouettes of cross-origin images
This blog post is one of several guest blog posts, where we invite participants of our bug bounty program to write about bugs they've reported to us. This is a ...
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,768 posts.
4532
What We Learned About the Hemisphere Program After Suing the DEA
As the year draws to a close, so has EFF’s long-running Freedom of Information Act lawsuit against the Drug Enforcement Agency about the mass phone surveillance program infamously known as “Hemisphere.” We won our case and freed up tons of records. (So did the Electronic Privacy Information Center...
4533
Everything I Know About the XZ Backdoor
Please note: This is being updated in real-time. The intent is to make sense of lots of simultaneous discoveries
4534
A Go implementation of Poly1305 that makes sense
Cryptography code could be understandable if only we commented it. This Poly1305 implementation is an attempt to prove it. It should be readable with just an idea of what MACs are for, a beginner level of Go, and high school math.
4535
Kubernetes Security Best Practices
By Connor Gilbert, product manager at StackRox Last month, the Kubernetes ecosystem was shaken by the discovery of the first major security flaw in Kubernetes, the world’s most popular container…
4536
Elixir/Erlang Secure Coding and Deployment Hardening Guidelines
Documentation, specifications and code from the Security Working Group of the Erlang Ecosystem Foundation
4537
Ubuntu Systemd Vulnerability
Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things.
4538
A thought on JavaScript "proof of work" anti-scraper systems
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
4539
VS Code – What's the deal with the telemetry?
VS Code collects telemetry data to help understand Microsoft how to improve the product. Is it above board? Can I turn it off completely?
4540
4541
4542
4543
MSI's (in)Secure Boot
Before we start, maybe I will quickly explain what Secure Boot is. It is a security feature, which allows our computer to decline booting operating systems that have not been signed by a key that the firmware trusts.
4544
Facial Recognition’s Threat to Privacy Is Worse Than Anyone Thought
Before all of this ever went down In another place, another town You were just a face in the crowd You were just a face in the crowd Out in the street walking around A face in the crowd -Tom Petty If we don’t speak up now, the days when we can walk around with our heads held high without fear of...
4545
4546
Why I don't like smartcards, HSMs, YubiKeys, etc.
This is a rant about smartcards with some digression into ranting about the integrated circuit industry.
4547
EFF to FinCEN: Stop Pushing for More Financial Surveillance
Today, EFF submitted comments to the Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) opposing the agency’s proposal for new regulations of cryptocurrency transactions. As we explain in our comments, financial records can be deeply personal and revealing, containing a...
4548
Noyb aims to end “cookie banner terror” and issues more than 500 GDPR complaints
Today, noyb.eu sent over 500 draft complaints to companies who use unlawful cookie banners - making it the largest wave of complaints since the GDPR came into force.
4549
LLMs could control their host machines by exploiting inference engines
| Read on LessWrong | Comment on HN | Large language models often take actions running on one computer (via an agentic harness such as Claude Code or Codex), however the LLMs’ responses to prompts are computed on a different computer with GPU access.
4550
4551
LLMs and coding agents are a security nightmare
Things are about to get wild
4552
Improving Git protocol security on GitHub
We’re changing which keys are supported in SSH and removing unencrypted Git protocol. If you’re an SSH user, read on for the details and timeline.
4553
Popular Chinese iOS apps compromised in malware attack
自2011年以来用技术对抗审查。我们使用AI监控审查并在全球范围内扩大言论自由。
4554
On the new Dutch intelligence and security law
13th of June UPDATE: The Dutch government has failed to hire and house the promised new 10 oversight staff. Yet, the new law will be enacted July 1st, passing oversight to people that don’t exist. I surely enjoyed living under the rule of law, but it appears it was a passing thing. “The Netherlands hosts some of the…
4555
4556
PrivateStorage.io: A secure and privacy-focused cloud storage solution
Announcing a cloud storage solution where you are in control of all your data with client-side encryption and no data or vendor lock-in.
4557
Compromising Angular via expired NPM publisher email domains
A Hacker's Blog of Unintended Use and Insomnia.
4558
The Day Google Decided HttpWatch Was ‘Unwanted Software’
This blog post isn’t about HTTP performance or HttpWatch itself but you may find it useful if you advertise a software product with Google Adwords. Hopefully, you’ll also find our conversation with Google amusing! What Happened ? We received an email like this: Subject: Your AdWords account: Ads...
4559
Backdoors and other vulnerabilities in HiSilicon based hardware video encoders
Serious vulnerabilities (including a backdoor) in IPTV/H.264/H.265 video encoders based on HiSilicon hi3520d hardware.
4560
The perils of the “real” client IP
This post ended up being incredibly long comprehensive. I’m afraid that many people won’t read enough to get everything that’s important, so here are the key points: