541
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 642 posts.
542
Is macOS Look Up Destined for CSAM?
Remember Apple’s failed attempt to detect CSAM in images? Would that have been similar to the way that Visual Look Up works? Is this the thin end of the wedge?
543
Abuse prevention is tradecraft
It’s sunday evening; there’s a lot to be said for being a stay-at-home-dad, and honestly I actually like having stuff like meal-prep and laundry to do, after 35+ years of “All Uni…
544
545
546
CalyxOS now supports Pixel 6 and Pixel 6 Pro
Android 12, Pixel 6
547
High-Throughput, Formal-Methods-Assisted Fuzzing for LLVM
Mutation-based fuzzing is based on the idea that new, bug-triggering inputs can often be created by randomly modifying existing, non-bug-triggering inputs. For example, if we wanted to find bugs in a PDF reader, we could grab a bunch of PDF files off the web, mutate them by flipping a few bits or something, and feed…
548
Top-500 NPM package maintainers now require 2FA
Two-Factored Authentication (2FA) is now enforced for maintainers of the top-500 packages, by dependents, on the npm registry. To learn more about configuring 2FA, see Configuring two-factor authentication. To learn…
549
Apple Reneged on OCSP Privacy
In the current version of macOS, Monterey, on every system update on a system containing an M1 chip, such as all the new shiny/fast ARM (“Apple Silicon”) macs, the update process phones home to Apple to obtain a special boot signature, known in Apple jargon as a “ticket”.
550
SSO should be table stakes
Withholding security for money feels a little gray-hat.
551
New Linux vulnerability affecting cgroups: can containers escape?
CVE-2022-0492 is the third recent kernel vulnerability that allows malicious containers to escape. We offer root cause analysis and mitigations.
552
Attackers exploit flaw in web’s security to steal $2M in cryptocurrency
By Henry Birge-Lee, Liang Wang, Grace Cimaszewski, Jennifer Rexford and Prateek Mittal On Thursday, Feb. 3, 2022, attackers stole approximately $2 million worth of cryptocurrency from users of the Korean crypto exchange KLAYswap. This theft, which was detailed in a Korean-language blog post by the security firm S2W…
553
“Downthem” DDoS-for-hire boss gets 2 years in prison
A 33-year-old Illinois man was sentenced to two years in prison today following his conviction last year for operating services that allowed paying customers to launch powerful distributed denial-of-service (DDoS) attacks against hundreds of thousands of Internet users and websites.
554
Exploring Google Hangouts' easter eggs
Web developer and cybersecurity researcher
555
Gambling and Adult content DNS blocking using Mullvad VPN
We have expanded our DNS blocking service with Gambling and Adult content filters!
556
Retrofitting Temporal Memory Safety on C++
Eliminating use-after-frees vulnerabilities in Chrome with heap scanning.
557
Zooming in on Zero-Click Exploits
Posted by Natalie Silvanovich, Project Zero Zoom is a video conferencing platform that has ...
558
559
Kaspersky: Poorly detected backdoor targeting governments and NGOs around globe
Kaspersky experts have brought to light a poorly detected SessionManager backdoor that was set up as a malicious module within the Internet Information Services (IIS), a popular web server edited by Microsoft. Once propagated, SessionManager enables a wide range of malicious activities, starting from collecting emails…
560
A Yubico FAQ about passkeys
Delve into Yubico's comprehensive guide about passkeys, a term encapsulating FIDO/WebAuthn credentials that offer a secure, passwordless experience.
561
NSA's Warrantless Wiretaps (2012)
ACKNOWLEDGMENTS I thank Kent Gladstone, Science Applications International Corporation (SAIC), for a critical reading of both manuscripts. Many critical comments and corrections from Brad Howard have made the Mini-Tutorial a better adventure for anyone who follows his path.
562
A New Life for Certificate Revocation Lists
This month, Let’s Encrypt is turning on new infrastructure to support revoking certificates via Certificate Revocation Lists. Despite having been largely supplanted by the Online Certificate Status Protocol for over a decade now, CRLs are gaining new life with recent browser updates. By collecting and summarizing CRLs…
563
Security experts declare all Proton apps secure after security audit
All our apps (Proton Mail, Proton Drive, etc) are open source and independently audited. Anyone can inspect our software and confirm our encryption works.
564
EFF about EU: EIDAS 2.0 Sets a Dangerous Precedent for Web Security
The Council of the European Union this week adopted new language for regulations governing internet systems that may put the security of your browser at greater risk.The new language affects the EU’s electronic identification, authentication and trust services (eIDAS) rules, which are supposed to...
565
Introducing passkeys in Chrome
We announced in October that passkey support was available in Chrome Canary. Today, we are pleased to announce that passkey support is now ...
566
MongoDB Releases Queryable Encryption Preview
Today we are announcing the preview release of Queryable Encryption which allows customers to encrypt sensitive data from the client side, store it as fully randomized encrypted data on the database server side, and run expressive queries on the encrypted data. Learn more.
567
Deceiving Windows Defender: The Big Stack Bypass
Defeating Windows Defender detection on Windows 10 by creating a large (>2MB) payload allocated on the stack
568
Google Zanzibar Through Our Eyes
Understanding Google's Zanzibar paper the way the Authzed team does.
569
Process behaviour anomaly detection using eBPF and unsupervised learning
Hello everybody, I hope you’ve been enjoying this summer after two years of Covid and lockdowns :D In this post I’m going to describe how to use eBPF syscall t…
570
Peter Eckersley, co-creator of Let’s Encrypt, dies at just 43
The Sophos Blog