5881
What, if anything, should I do about using Mozilla's Firefox
I have used it for a long time - 20 years now, including for a while the IceWeasel variant - and I like it as a browser.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,770 posts.
5882
Tencent WeChat is now a GitHub secret scanning partner
GitHub secret scanning protects users by searching repositories for known types of secrets. By identifying and flagging these secrets, our scans help prevent data leaks and fraud. We have partnered…
5883
1Password and the Crypto Wars
A series of debates, civil disobedience, and cryptographic developments have come to be known as “The Crypto Wars”. Learn how 1Password can help you protect your data.
5884
Bring Your Own Password Manager: Portable BitWarden on a Pi Zero
BYOPM is a self hosted portable Password Manager implementation based on BitWarden and Raspberry PI Zero.
5885
Trustworthy Chrome Extensions, by default
Incredibly, it’s been nearly a decade since we launched the Chrome extensions system. Thanks to the hard work and innovation of our deve...
5886
StartSSL domain validation vulnerability
StartSSL certificate authority is well known for offering free domain validated SSL certificates, and also sells organisation and extended v...
5887
IP address errors lead to wrongful arrests
The Sophos Blog
5888
CNN, NYTimes, Mashable all vulnerable to XSS
Pretending innocence, I ask why all these high profile websites have their homepages covered in spinning images? CNN (screenshot) The New York Times (screenshot) Mashable (screenshot) Fox News (screenshot) Okay, obviously enough, I’m messing with them. But how can I do that? The answer is cross site scripting (“XSS”)…
5889
How the Syrian Electronic Army Hacked The Onion
This is a write-up of how the Syrian Electronic Army hacked The Onion. In summary, they phished Onion employees’ Google Apps accounts via 3 …
5890
The curious tale of a fake Carrier.app
Posted by Ian Beer, Google Project Zero NOTE: This issue was CVE-2021-30983 was fixed in iOS 15...
5891
CloudFlare enabling free SSL by mid-October
As of today, there are only about 2 million websites that support HTTPS. That's a shamefully low number. Two things are about to happen that we at CloudFlare are hopeful will begin to change that and make everyone love locks (at least on the web!).
5892
5893
5894
An unexpected Redis sandbox escape affecting Debian-based distros
This post describes how I broke the Redis sandbox, but only for Debian and Debian-derived Linux distributions. Upstream Redis is not affected. That makes it a Debian vulnerability, not a Redis one. The culprit, if you will, is dynamic linking, but there will be more on that later.
5895
Radicle: Disclosure of Vulnerability in the Network Protocol
Sovereign code infrastructure.
5896
Lawmakers Want to Block Pornography at the Expense of Free Speech and Privacy
More than 15 state legislatures are considering the “Human Trafficking Prevention Act” (HTPA). But don’t let the name fool you: this bill would do nothing to address human trafficking. Instead, it would only threaten your free speech and privacy in a misguided attempt to block and tax online...
5897
Keybase iOS Has a Backdoor?
Keybase’s iOS client has received a backdoor. It seems that Stellar, the extremely well-funded and well-marketed cryptocurrency, has struck a deal with Keybase…
5898
When root meets immutable: OpenBSD chflags vs. log tampering
Rafael Sadowski
5899
5900
Rustls Outperforms OpenSSL and BoringSSL
ISRG has been investing heavily in the Rustls TLS library over the past few years. Our goal is to create a library that is both memory safe and a leader in performance. Back in January of this year we published a post about the start of our performance journey. We've come a long way since then and we're excited to…
5901
Qubes OS 3.1 has been released
I’m happy to announce that today we’re releasing Qubes OS 3.1! The major new architectural feature of this release has been the introduction of the Qubes Management infrastructure, which is based on the popular Salt management software. In Qubes 3.1, this management stack makes it possi...
5902
The Karma connection in Chrome Web Store
A bunch of malicious extensions in Chrome Web Store have hidden affiliate fraud functionality, collect users’ browsing profiles, or both. These extensions appear to be connected to the Karma shopping assistant, developed by Karma Shopping Ltd. which is not a small company.
5903
5904
5905
Access Now and EFF Condemn the Arrest of Tor Node Operator Dmitry Bogatov
This post was written in collaboration with Amie Stepanovich at Access Now. On April 6, Russian math instructor Dmitry Bogatov was arrested in Moscow and charged with “preparing to organize mass disorder” and making “public calls for terrorist activity” due to a gross misunderstanding about the...
5906
5907
5908
Sourcehut account takeover via build logs (XSS in ansi2html)
A wormable vulnerability allowed anyone able to inject text in a build log on builds.sr.ht (or other instances) to take over accounts who viewed them
5909
5910
Let’s Encrypt Receives the Levchin Prize for Real-World Cryptography
We are honored to be recognized for the impact on the field of cryptography.