Topics /
The most popular blog posts about security & privacy on Hacker News. 8,768 posts.
“We value your privacy…”, the clichéd beginning of many a privacy notice. I legitimately do value my own online privacy, and whenever I read that phrase as part of a website consent banner it sounds like lip service at best. Consent banners ostensibly exist to give users control over their data & personal privacy. Far…
Announcing and explaining our intention to support DNS over HTTPS in future versions of Windows
A dive into how we share IPs between VMs while making SSH work.
Phones are so full of ads that you don’t even notice them anymore. Suggestions and notifications you didn’t ask for, tracking mechanisms you don’t even know are there, services over which you have no control. It’s absurd how much smartphones, a large extension of our private and social lives, are controlled and…
Cutting-edge cyber security research from NCC Group. Find public reports, technical advisories, analyses, & other novel insights from our global experts.
In this article I demonstrate a software only attack that allows an operating system to set the PCRs of a discrete TPM device to arbitrary values and unseal any secret that uses a PCR based sealing policy (such as disk encryption keys used by unattended unlock TPM FDE schemes).
Lots of the CVE world seems to focus on “security bugs” but I’ve found that it is not all that well known exactly how the Linux kernel security process works. I gave a talk about this back in 2023 and at other conferences since then, attempting to explain how it works, but I also thought it would be good to explain…
KeePassXC Password Manager
Apple recently announced an upcoming feature for their new Apple Watches called “Audio Intelligence,” which will always be listening to a...
This article describes my nginx configuration and strategy on how to prevent web crawlers from putting down my instance while still serving most people with minimal amount of friction.
A post outlining tricks for firewall privilege escalation
Today we filed 422 + 36 complaints on "cookie banners" with ten European Data Protection Authorities.
With the recent release of Ubuntu 24.04, we at Snyk Security Labs thought it would be interesting to examine the latest version of this Linux distribution to see if we could find any interesting privilege escalation vulnerabilities.
A summary of a Codethink sponsored project which implements a cryptographically secure bootloader, written in Rust, for RISC-V.
Do you trust links? Well, you shouldn’t. Do you trust this link: Twitter says this link should take you to Uniswap, nobody would be none-the-wiser because we…
San Francisco—School children are being spied on by tech companies through devices and software used in classrooms that often collect and store kids’ names, birth dates, browsing histories, location data, and much more—often without adequate privacy protections or the awareness and consent of...
There’s a concept from computer security known as a class break. It’s a particular security vulnerability that breaks not just one system, but an entire class of systems. Examples might be a vulnerability in a particular operating system that allows an attacker to take remote control of every computer that runs on…
A core value CloudFlare is that security information should be shared between organizations to make the entire Internet safer. That is how CloudFlare's systems work: if one site is attacked, data about that attack is immediately shared with the rest of the network so other sites can be safe.
I recently had solar panels and a battery storage system from GivEnergy installed at my house. A major selling point for me was that they have a local network API which can be used to monitor and…
Digital platforms play an ever-increasing role in structuring and influencing public debate. Civil society watchdogs, researchers and journalists need to be able to hold them to account. But Facebook is increasingly fighting those who try. It shut down New York University’s Ad Observatory last week, and went after…
News and updates from the RubyGems team — releases, security advisories, and project announcements.
