5071
How We Deliver Global SSL with Let's Encrypt
News, tips, and tricks from the team at Fly
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,768 posts.
5072
The RubyGems "Security Incident"
Ruby Central posted an extremely concerning “Incident Response Timeline” today, in which they make a number of exaggerated or purely misleading claims. Here’s my effort to set the record straight. First, and most importantly: I was a primary operator of RubyGems.org, securely and successfully, for over ten years. Ruby…
5073
5074
Service drains competitor's Adwords budget
The longer one lurks in the Internet underground, the more difficult it becomes to ignore the harsh reality that for nearly every legitimate online business there is a cybercrime-oriented anti-business. Case in point: Today’s post looks at a popular service that helps crooked online marketers exhaust the Google…
5075
5076
Australia’s Proposed Surveillance Laws Will Break the Trust Tech Depends On
In the last few years, we’ve discovered just how much trust — whether we like it or not — we have all been obliged to place in modern technology. Third-party software, of unknown composition and security, runs on everything around us: from the phones we carry around, to the smart devices with...
5077
5078
Apple EFI firmware passwords and the SCBO myth
My original goal when I started poking around Apple’s EFI implementation was to find a way to reset a MacBook’s firmware password. My preliminary research found references to a “magical” SCBO file that could be loaded onto a USB flash drive and booted to remove the password. The normal process workflow is to first…
5079
From object transition to RCE in the Chrome renderer
In this post, I'll exploit CVE-2024-5830, a type confusion in Chrome that allows remote code execution (RCE) in the renderer sandbox of Chrome by a single visit to a malicious site.
5080
5081
Microsoft Edge (Chromium) – Elevation of Privilege to Potential RCE
With some luck and a couple of XSS bugs I was able to break the new Edge
5082
Iran blocks Tor; Tor releases same-day fix
The short version: Tor relays and bridges should upgrade to Tor 0.2.2.33 or Tor 0.2.3.4-alpha so...
5083
5084
Reverse Engineering a Xinjiang Police Mass Surveillance App
This report presents new evidence about the surveillance state in Xinjiang, where the government has subjected 13 million Turkic Muslims to heightened repression as part of its “Strike Hard Campaign against Violent Terrorism.” Between January 2018 and February 2019, Human Rights Watch was able to reverse engineer the…
5085
An Illustrated Guide to Elliptic Curve Cryptography Validation
Cutting-edge cyber security research from NCC Group. Find public reports, technical advisories, analyses, & other novel insights from our global experts.
5086
Update: The Swedish authorities answered our protocol request
Since the events of the search warrant by the Swedish police at Mullvad’s office in Gothenburg, we have tried to get hold of documents and protocols tied to the operation. This is what the authorities came back with.
5087
Technology in Hostile States: Ten Principles for User Protection
This blog post is meant to generate a conversation about best practices for using cryptography...
5088
5089
5090
Microsoft Dependency Has Risks
There was a recent incident where Microsoft somehow allegedly blocked a mailbox of a sanctioned individual . Any organization highly depending on MS products that might come into the crosshair should ask - can this happen to me? What would be the cost? How much I invest into prevention of this scenario? In this…
5091
Clubhouse doesn’t value privacy, security or accessibility
It is tempting to excuse Clubhouse’s flaws as growing pains, but the app’s design and rollout illustrate just how little Silicon Valley and its venture capital backers have learned.
5092
Telegram: No-SIM Signup, Auto-Delete All Chats, Topics 2.0 and more
With this update, you can have a Telegram account without a SIM card and set up a global timer to automatically delete messages in all new chats. Topics in groups are now even more powerful – and available for groups with 100+ members.
5093
Apple’s macOS Ventura – New Security Changes
With macOS 13, Apple have made some bold and potentially disruptive changes to Mac security. We explore them here.
5094
The /unblock API from Browserless: dodging bot detection as a service
The /unblock API clears away bot fingerprints at the CDP level, to truly humanize your Puppeteer automations.
5095
5096
A few thoughts on Fuchsia security
I want to say a few words about my current adventure. I joined the Fuchsia project at its inception and worked on the daunting task of buil...
5097
5098
5099
The xz backdoor thing reminds me of a story
This xz backdoor thing reminds me of a story I heard from friends that worked at a tech company that made cell phones. They had a great coder that worked on the project, he had put in work as a contractor for a few months, and due to the quality of his work he was hired in full time. After two months he simply stopped…
5100
PureVPN IPv6 Leak
Two findings in PureVPN on Ubuntu 24.04. After a reconnect the system takes a default IPv6 route outside the tunnel, and the ip6tables OUTPUT policy is still ACCEPT, so traffic leaves in the clear while the client reports connected.