5281
Tor project decides to fork Firefox
In a random bar about two years ago, a Google Chrome developer asked me why Torbutton didn't...
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,769 posts.
5282
A Guide to Threat Modelling for Developers
Threat modeling is a risk based approach to cyber security requirements analysis.
5283
5284
Fuzzing rust-minidump for Embarrassment and Crashes – Part 2
For the last year, we've been working on the development of rust-minidump. The final part in this series takes you through fuzzing rust-minidump.
5285
Data-Free Disneyland
(Note: This is the companion post to my article at Public Books about evading data detection at Disneyland. For the…
5286
Phishers Love New TLDs Like .shop, .top and .xyz
Phishing attacks increased nearly 40 percent in the year ending August 2024, with much of that growth concentrated at a small number of new generic top-level domains (gTLDs) — such as .shop , .top , .xyz — that attract scammers with rock-bottom prices and no meaningful registration requirements, new research finds…
5287
America's Cyber Defense Agency Is Burning Down and Nobody's Coming to Put It Out
CISA lost a third of its staff and its acting leader uploaded sensitive docs to public ChatGPT, while China sits inside U.S. critical infrastructure.
5288
I quit infosec and I couldn't be happier
This article aims at providing you some insights about the experience I had in the “infosec world” for the past few years. I had an amazing journey and grateful for everything that happened. Don’t get me wrong with the title, even if the road was sometimes “bumpy” (aka ‘bad’ experiences), I got some good lessons…
5289
The facts around Zoom and encryption for meetings/webinars
Learn more about how to use each Zoom product to connect with coworkers, customers, businesses, and more with insights and best practices.
5290
Apple silently uploads your passwords and keeps them
This is a follow-up to my blog post macOS Sonoma silently enabled iCloud Keychain despite my precautions from five months ago. The TL;DR of that blog post is that when you have iCloud enabled but not iCloud Keychain, updating from Ventura to Sonoma causes iCloud Keychain to be silently enabled. (I don't know yet…
5291
Please Sell My Personal Information
I accidentally clicked the "do not sell my personal information" link at the bottom of your website.
5292
Proton.B: What this Mac malware does
Eliminate active threats with 24/7/365 threat detection, investigation, and response.
5293
Compiler Bug Causes Compiler Bug: How a 12-Year-Old G++ Bug Took Down Solidity
A subtle G++ bug from 2012, C++20’s new comparison rules, and legacy Boost code can collide to crash Solidity’s compiler on valid code. We unpack the surprising chain reaction and how to fix it.
5294
Improved fraud prevention with Radar 2.0
Radar 2.0 improves machine learning performance and reduces fraud by up to an additional 25%.
5295
5296
5297
Fail2ban – Remote Code Execution
Securitum is a pure pentesting company specialising in the security of IT systems. We have experience in performing security audits (including penetration tests) - mainly for financial/e-commerce/industrial sectors. We have performed penetration tests and cyber security services for leading European banks (see…
5298
5299
Cell Phone Guide For US Protesters, Updated 2014 Edition
Update: Our recently updated Surveillance Self-Defense guide includes more background and detail on security threats facing mobile phone users. Check out the guide, and pay particular attention to The Problem With Mobile Phones. With major protests in the news again, we decided it's time to update...
5300
DarkPulsar
After the “Lost in Translation” leak was revealed, we noticed that this leak contained a tool in the “implants” category called DarkPulsar. We analyzed it and understood that it is not a backdoor itself, but the administrative part only.
5301
PyPI package 'secretslib' drops fileless Linux malware to mine Monero
Sonatype identified a 'secretslib' PyPI package that covertly installs cryptominers on Linux systems.
5302
The Frequency of Known Vulnerabilities in JavaScript
An interesting whitepaper was released at the 2017 NDSS Symposium discussing a large-scale attempt at determining just how vulnerable client-side JavaScript libraries are. We wanted to share some of our thoughts on the report.
5303
5304
Peek Inside a Professional Carding Shop
Over the past year, I’ve spent a great deal of time trolling a variety of underground stores that sell “dumps” — street slang for stolen credit card data that buyers can use to counterfeit new cards and go shopping in big-box stores for high-dollar merchandise that can be resold quickly for cash. By way of explaining…
5305
Adding Client-Side Scanning Breaks End-to-End Encryption
Recent attacks on encryption have diverged. On the one hand, we’ve seen Attorney General William Barr call for “lawful access” to encrypted communications, using arguments that have barely changed since the 1990’s. But we’ve also seen suggestions from a different set of actors for more purportedly...
5306
5307
Hundreds of Thousands of Google Apps Domains’ Private WHOIS Leaked
This post was authored by Nick Biasini, Alex Chiu, Jaeson Schultz, and Craig Williams. Special thanks to William McVey for his contributions to this post.
5308
Dropbox Smeared in Week of Megabreaches
Last week, LifeLock and several other identity theft protection firms erroneously alerted their customers to a breach at cloud storage giant Dropbox.com — an incident that reportedly exposed some 73 million usernames and passwords. The only problem with that notification was that Dropbox didn’t have a breach; the data…
5309
Someone used my IPFS gateway for phishing
At 02:43 this morning, I received an abuse complaint email. It was sent by PhishLabs to DigitalOcean, and DigitalOcean forwarded it to me.
5310
Don't fall for the latest changes to the dangerous Kids Online Safety Act
The authors of the dangerous Kids Online Safety Act (KOSA) unveiled an amended version this week, but it’s still an unconstitutional censorship bill that continues to empower state officials to target services and online content they do not like.