5251
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,769 posts.
5252
Briar is in maintenance mode
This is a quick update about the status of Briar. Short version: the project is still active but we’re only making essential security updates and bugfixes for now. Long version: For several years we’ve been trying to find solutions to some of the longstanding issues with Briar, such as high battery usage and…
5253
5254
Why you should never use hash functions for message authentication
The general thrust of this post is: use a MAC function like HMAC to sign data, don’t use hash functions. Although not all hash functions suffer from the problem I’m going to illustrate, in general using a hash function for message authentication comes with a lot of potential problems because those functions aren’t…
5255
DoS attacks against my online game
DDraceNetwork is an open source online game I’ve been running since 2013 with a community of volunteers. The game is available for free, I’m hosting servers for it in many countries around the world so that we have trusted official ranks . The servers are paid for by donations , which I stop collecting once the cost…
5256
The Power to Revoke Lies with the Certificate Authority
For those that read my blog often you may have seen me talk about EV certificates before. From a technical perspective there are many things that I don't agree with about EV certificates and from a non-technical perspective there are many things I don't like about the
5257
5258
Teardown of a Failed Linux LTS Spectre Fix
An in-depth analysis of the journey of a Spectre fix into the upstream LTS kernels that left its users with nothing more than a false sense of security.
5259
How to defeat Ed25519 and EdDSA using faults
The Latest News from Research at Kudelski Security
5260
Beware of hacked ISOs if you downloaded Linux Mint on February 20th
We were exposed to an intrusion today. It was brief and it shouldn’t impact many people, but if it impacts you, it’s very important you read the information below.
5261
APFS encrypted plaintext password found in another log file
UPDATE: PLEASE HELP ME TEST At some point you just need to stop looking and be blissfully ignorant...this was not one of those days. In and update to my previously updated blog article , I have found another instance where the plaintext password was written to system logs. Thi
5262
Proposed UN cybercrime treaty has evolved into an expansive surveillance tool
EFF has joined forces with 110 NGOs today in a joint statement delivered to the United Nations Ad Hoc Committee, clearly outlining civil society non-negotiable redlines for the proposed UN Cybercrime Treaty, and asserting that states should reject the proposed treaty if these essential changes are...
5263
Rustls Server-Side Performance
In past years, the Rustls project has been happy to receive substantial investments from the ISRG. One of our goals has been to improve performance without compromising on safety. We last posted about our performance improvements in October of 2024, and we're back to talk about another round of improvements. What is…
5264
Secure yourself, Part 1: Air-gapped computer, GPG and smartcards
This blog entry is part of a series covering: Logging into your laptop and decrypting it automatically Encrypting and decrypting any passwords or secure info you have Sending and receiving encrypted mails Providing 2-step authentication codes for your web logins Doing all of the above on your mobile phone…
5265
Schneier: The Dishonest Minority: Security and its Role in Modern Society
Three months ago, I announced that I was writing a book on why security exists in human societies. This is basically the book’s thesis statement: All complex systems contain parasites. In any system of cooperative behavior, an uncooperative strategy will be effective—and the system will tolerate the uncooperatives—as…
5266
Double encryption: Analyzing the NSA/GCHQ arguments against hybrids
In 2019, Google and Cloudflare ran an experiment where they upgraded HTTPS for many "real users’ connections" to use post-quantum encryption. They then reported statistics on how affordable this was. Google had also run a similar experiment in 2016: "While it's still very early days for quantum computers, we're…
5267
5268
Amazonbot is finally respecting robots.txt
Thanks for giving me a viable business model Amazon!
5269
5270
5271
How to date a recording using background electrical noise
Three men were accused of selling firearms to South London gangs. At their 2012 trial in Croydon Crown Court, the prosecution played the jury a recording, taken undercover, of the trio allegedly arranging a sale. But the men’s lawyers claimed that the recording was a fake, and that the police had fabricated it by…
5272
PureBoot, the High Security Boot Process
Purism makes premium phones, laptops, mini PCs and servers running free software on PureOS. Purism products respect people's privacy and freedom while protecting their security.
5273
Fog Revealed: A guided tour of how cops can browse your location data
In Part 1 of our series on Fog Data Science, we saw how when you give some apps permission to view your location, it can end up being packaged and sold to numerous other companies. Fog Data Science is one of those companies, and it has created a sleek search engine called Fog Reveal that allows cops to browse through…
5274
Hyperlight: Virtual machine-based security for functions at scale
The Microsoft Azure Core Upstream team is excited to announce the Hyperlight project, an open-source Rust library you can use to create very small VMs for embedded functions. Learn more.
5275
Court Opinion Finding NSA Surveillance Unconstitutional to be released
Update: In response to EFF's FOIA lawsuit, the government has released the 2011 FISA court opinion ruling some NSA surveillance unconstitutional. For over a year, EFF has been fighting the government in federal court to force the public release of an 86-page opinion of the secret Foreign...
5276
Format string vulnerability found in 'sudo'
A flaw exists in the debugging code in sudo versions 1.8.0 through 1.8.3p1 that can be used to crash sudo or potentially allow an unauthorized user to elevate privileges. Sudo versions affected: 1.8.0 through 1.8.3p1 inclusive. Older versions of sudo are not affected. CVE ID: This vulnerability has been assigned…
5277
5278
5279
Hacking Team and a case of BGP hijacking
After just a few hours the Hacking Team emails archive has already provided many tasty leaks. I want to focus on a routing security issue since this is my main research activity for this year.
5280
