5371
WormGPT – The Generative AI Tool Cybercriminals Are Using
Protect sensitive data from phishing and social engineering with Varonis Interceptor, AI-native email security with 99.9% detection and real-time response.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,769 posts.
5372
Secret iOS business; what you don’t know about your apps
In the beginning, there was the web and you accessed it though the browser and all was good. Stuff didn’t download until you clicked on something; you expected cookies to be tracking you and you always knew if HTTPS was being used. In general, the casual observer had a
5373
Adventures in reverse engineering Broadcom NIC firmware
For some time now, I've been reverse engineering the firmware of the Broadcom BCM5719 Ethernet NIC chip, so that open source firmware can be produced for it. The BCM5719 is a PCIe chip which provides up to four Gigabit Ethernet ports, and is mainly intended for use in server applications. It can be used with the Linux…
5374
5375
Bills Introduced by Congress Fail to Fix Unconstitutional NSA Spying
In the past two weeks Congress has introduced a slew of bills responding to the Guardian's publication of a top secret court order using Section 215 of the PATRIOT Act to demand that Verizon Business Network Services give the National Security Agency (NSA) a record of every customer's call history...
5376
When Will We See Collisions for SHA-1?
On a NIST-sponsored hash function mailing list, Jesse Walker (from Intel; also a member of the Skein team) did some back-of-the-envelope calculations to estimate how long it will be before we see a practical collision attack against SHA-1. I’m reprinting his analysis here, so it reaches a broader audience. According…
5377
Time protection: the missing OS abstraction
Time protection: the missing OS abstraction Ge et al., EuroSys’19 Ever since the prominent emergence of timing-based microarchitectural attacks (e.g. Spectre, Meltdown, and friends) I’ve been…
5378
Perfctl: Stealthy malware targeting Linux servers
Perfctl is particularly elusive and persistent malware employing several sophisticated techniques
5379
When Your Smart ID Card Reader Comes With Malware
Millions of U.S. government employees and contractors have been issued a secure smart ID card that enables physical access to buildings and controlled spaces, and provides access to government computer networks and systems at the cardholder’s appropriate security level. But many government employees aren’t issued an…
5380
Attempts to Censor AntiPolygraph.org
AntiPolygraph.org has received a rather unpleasant letter from James D’Loughy, a lawyer representing NITV Federal Services, LLC (NITV), which markets a scientifically baseless voice-based lie detector called the “Computer Voice Stress Analyzer,” and its president, self-described “Renaissance Man” “Dr.” Charles Humble…
5381
The Drunken Bishop Algorithm
There’s a tradition in my family that everyone takes a turn stirring a secret wish into the yearly christmas pudding . It’s important that the wishes remain secret to the wisher or the pudding magics wont work so since moving to America I’ve implemented a new way of hashing my wish so it can be stirred in via text…
5382
Earn $200K by fuzzing for a weekend: Part 1
By applying well-known fuzzing techniques to a popular target, I found several bugs that in total yielded over $200K in bounties. In this article I will demonstrate how powerful fuzzing can be when applied to software which has not yet faced sufficient testing.
5383
Role-based access control like it was meant to be
Learn about role-based access control, its use cases and benefits.
5384
5385
How to weaponize the Yubikey (2019)
Michael Allen // A couple of years ago, I had a YubiKey that was affected by a security vulnerability, and to fix the issue, Yubico sent me a brand new […]
5386
The Internet Archive Pushes Back on “Notice and Staydown”
The US Copyright Office sought comments in its ongoing study of the Digital Millennium Copyright Act (DMCA) Section 512 safe harbor study. They are generally looking to find out how well the notice and takedown system is working for everyone—Internet platforms and users, as well as creators and copyright holders. We…
5387
Tetsuji: Remote Code Execution on a GameBoy Colour 22 Years Later
Introduction It’s that time of year again - the Binary Golf Grand Prix is back for a third year running! You can also check out my entries to the first and second times this amazing competition ran. The theme this year was to produce a binary that crashes a given program. Bonus points for hijacking execution…
5388
Librem Tunnel Is Leaving iOS
Purism makes premium phones, laptops, mini PCs and servers running free software on PureOS. Purism products respect people's privacy and freedom while protecting their security.
5389
Refuse to let your doctor record you
By: Emily M. Bender and Decca Muldowney At a recent appointment, Emily’s physical therapist (who knows some about her research) said, “Before we get started,...
5390
My Mac contacted 63 different Apple owned domains in an hour, while not is use
During a one hour period today, my computer contacted 63 different Apple domains while i was not logged on and using it. I have been trying to minimize to the extent possible the reach of big tech into my life. A full 25% of the DNS queries from one of my computers (M2 MBA with macOS 15.4) are to Apple owned domains …
5391
5392
5393
5394
Experts fear crooks are cracking keys stolen in LastPass breach
In November 2022, the password manager service LastPass disclosed a breach in which hackers stole password vaults containing both encrypted and plaintext data for more than 25 million users. Since then, a steady trickle of six-figure cryptocurrency heists targeting security-conscious people throughout the tech…
5395
Discord just killed anonymity
It finally happened. After months of speculation, Discord dropped the hammer: mandatory age verification for all users is rolling out next month. The era of anonymous gaming chats is officially over.
5396
Me on Covid-19 contact tracing apps
I was quoted in BuzzFeed: “My problem with contact tracing apps is that they have absolutely no value,” Bruce Schneier, a privacy expert and fellow at the Berkman Klein Center for Internet & Society at Harvard University, told BuzzFeed News. “I’m not even talking about the privacy concerns, I mean the efficacy. Does…
5397
Improving DNS Privacy in Firefox
Domain Name Service (DNS) is one of the oldest parts of internet architecture, and remains one that has largely been untouched by efforts to make the web safer and more ...
5398
5399
1,741 "informed" consents with one click? GDPR complaint filed
dict.cc requests users to consent to the tracking by 1,741 "partner" companies. This makes it impossible for people to know what happens to their data
5400
San Francisco: Don't Fall for Industry Defense of Surveillance Pricing
The concept of “surveillance pricing” is just one part of a much larger problem and business model: corporations maximizing their profits by invading our privacy. The all-too-common business model is to systematically harvest, collate, and store as much of our personal data as possible, and then...