511
YouTube starts to require a credit card or ID to verify the age in EU (2020)
We’ve taken important steps to make YouTube a safer place for families. We’re announcing a continuation of these efforts.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 678 posts.
512
EU legislation allows emails, messages and other communications to be scanned
On 6 July, the European Parliament adopted in a final vote the derogation to the main piece of EU legislation protecting privacy, the ePrivacy Directive, to allow Big Tech to scan your emails, messages and other online communications.
513
Why Did Satoshi Decide to Use Secp256k1 Instead of Secp256r1?
Secp256k1 and secp256r1 are two commonly used curves. Hyperledger / Fabric developed by IBM is using secp256r1 while Bitcoin is using secp256k1. What is the difference between these two and why did Satoshi decide to use secp256k1 which is considered as a surprising choice at the time?
514
515
A Declaration of the Independence of Cyberspace (1996)
by John Perry Barlow Governments of the Industrial World, you weary giants of flesh and steel, I come from Cyberspace, the new home of Mind. On behalf of the future, I ask you of the past to leave us alone. You are not welcome among us. You have no sovereignty where we gather.We have no elected...
516
Cryptography behind the top cryptocurrencies
This table is based on research at Nash for work expanding our MPC protocol to secure wallets on new blockchains. We took a snapshot of rankings by market cap in early February 2021. In summary, 74 coins use ECDSA and the secp256k1 curve, including Bitcoin, Ethereum, and 48 ERC20 tokens. 10 coins use EdDSA and…
517
Representing SHA-256 Hashes as Avatars
How to turn 256 bits of entropy into a beautiful, avatar-friendly circular SVG: the Hashvatar.
518
Software Verification and Analysis Using Z3
Cutting-edge cyber security research from NCC Group. Find public reports, technical advisories, analyses, & other novel insights from our global experts.
519
Facebook sues two Chrome extension devs for scraping user data
Today we filed a lawsuit against two individuals for violating our Terms of Service and Portugal’s Database Protection Law.
520
521
OpenBSD's Pledge and Unveil from Python
Years ago, OpenBSD gained two new security system calls, pledge(2) (originally tame(2) ) and unveil . In both, an application surrenders capabilities at run-time. The idea is to perform initialization like usual, then drop capabilities before handling untrusted input, limiting unwanted side effects. This feature is…
522
How I accidentally took down GitHub Actions (2019)
Last December, I was invited to a private bug bounty program to test a beta version of GitHub Actions. GitHub Actions is a workflow automation tool integrated with GitHub. One common use case of GitHub Actions is for CI builds – a project can fairly easily start up a Docker container every time they push a commit…
523
Building a WebAuthn Click Farm
How I built a click farm to “bypass” Cloudflare’s CAPTCHA killer with some cheap USB security keys, an Arduino, and a bit of python.
524
Digging into Linux namespaces – part 1
Process isolation is a key component for containers. One of the key underlying mechanisms are namespaces. We will explore what they are, and how they work, to build our own isolated container and better understand each piece.
525
Increasing HTTPS Adoption
When a browser connects to websites over HTTPS (vs. HTTP), eavesdroppers and attackers on the network can't intercept or alter the data that...
526
527
Anonymized data is rarely anonymous
Justin Sherman for Wired points out the farce that is anonymized data: Data on hundreds of millions of Americans’ races, genders, ethnicities, religions, sexual orientations, political beliefs, int…
528
Pasco County’s Sheriff Must End Its Targeted Child Harassment Program
In September 2020, the Tampa Bay Times revealed a destructive “data-driven” policing program run by the Pasco County, Florida Sheriff's Office. The program is misleadingly called “Intelligence-Led Policing” (ILP), but in reality, it's nothing more than targeted child harassment by police. Young...
529
Bombs vs. Bugs
I’ll be taking some time in the next months to talk about the newly hostile-by-default nature of technology, and how I deal with it.
530
Imaging mounted disk volumes under duress
Backups are critical. If you are lucky and organised you have a set of useful backup primitives, such as Point in Time snapshots on your Infrastructure As A Service (IaaS), your disk array controller, or volume manager. However there always seems to be some critical machine in my life that does not fall into these…
531
Faking a Positive Covid Test
True cyber security combines advanced technology and best practice. Get tips and read articles on how to take your online security even further.
532
533
NitroPhone – Pixel 4a phone with GrapheneOS
Nitrokey launches the NitroPhone, the most secure Android smartphone on the planet. Based on Pixel 6 and GrapheneOS with no Google, no backdoors and hardware security.
534
535
Probably Are Gonna Need It: Application Security Edition
My list of “Probably Are Gonna Need It” security features for your web app – things that you should build up-front, not wait until you need them (when it’s already too late).
536
Disinformation-for-hire in Kenya
Mozilla Fellows Odanga Madung and Brian Obilo reveal that Kenyan journalists, judges, and other members of civil society are facing coordinated disinformation campaigns on Twitter — and the site is doing very little to stop it.
537
Dangerous bug in Chrome’s ‘New Tab’ page bypassed security features
We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.
538
I Read the Entire Cybersecurity Executive Order; Here's What You Need to Know
Cybersecurity is hard enough. Doing it across federal agencies is a mammoth task.
539
I could send any text message from Indian government IDs
Sometimes, you don’t necessarily need to hack a system to exploit it.
540
Kernel Pwning with eBPF: A Love Story
How are low-level vulnerabilities exploited and detected in the modern age? This expert guide walks you through the ins and outs of eBPF and Kernel security.