31
SSH hacks – a little sanity for remote workers
A few of our favorite SSH tricks and tips sure to improve your daily experience.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 612 posts.
32
Face ID and Touch ID for the Web
People often see passwords are the original sin of authentication on the web.
33
Who’s behind Wednesday’s epic Twitter hack?
Twitter was thrown into chaos on Wednesday after accounts for some of the world’s most recognizable public figures, executives and celebrities starting tweeting out links to bitcoin scams. Twitter says the attack happened because someone tricked or coerced an employee into providing access to internal Twitter…
34
Another free CA as an alternative to Let's Encrypt
Let's Encrypt is an amazing organisation doing an amazing thing by providing certificates at scale, for free. The problem though was that they were the only such organisation for a long time, but I'm glad to say that the ecosystem is changing. It's always a good idea
35
When in doubt: hang up, look up, and call back
Many security-conscious people probably think they’d never fall for a phone-based phishing scam. But if your response to such a scam involves anything other than hanging up and calling back the entity that claims to be calling, you may be in for a rude awakening. Here’s how one security and tech-savvy reader got taken…
36
New German law would force ISPs to allow secret service to install trojans
A new law being proposed in Germany would see all 19 federal state intelligence agencies in Germany granted the power to spy on German citizens through
37
I'm Open Sourcing the Have I Been Pwned Code Base
Let me just cut straight to it: I'm going to open source the Have I Been Pwned code base. The decision has been a while coming and it took a failed M&A process to get here, but the code will be turned over to the public for the
38
Don't touch my clipboard
Looking for an em dash I was recently trying to find an em dash character to use in a piece of writing. Since I don’t have the shortcut memorized—for future reference, shift+option+minus on Mac—I did a quick search for it. I didn’t see one on the search results page to copy, so I clicked into the first result: “The…
39
40
The EARN IT act is an attack on end-to-end encryption
Yesterday a bipartisan group of U.S. Senators introduced a new bill called the EARN IT act. On its face, the bill seems like a bit of inside baseball having to do with legal liability for informati…
41
French bar owners arrested for offering free WiFi but not keeping logs
At least five bar owners in Grenoble, France have been arrested for providing WiFi at their businesses without keeping logs. The bar owners were arrested
42
WebKit will delete all local storage after 7 days
Apple will delete your data if you don’t use an app for seven days. This effectively kills offline web apps.
43
CAPTCHAs don’t prove you’re human – they prove you’re American (2017)
When I was a small child, I took an IQ test. One of the first questions I stumbled on was "A piece of candy costs 25¢. Jonny has a dime. How many nickels does he need to buy the candy?" My 7-year old brain popped. WTAF is a nickel? Or a dime for that matter? We don't have those coins in my country! We don't spend in ¢…
44
Facebook sues Namecheap
We don’t want people to be deceived, so we take legal action against misleading domains.
45
Cover Your Tracks
Today, we’re pleased to announce Cover Your Tracks, the newest edition and rebranding of our historic browser fingerprinting and tracker awareness tool Panopticlick. Cover Your Tracks picks up where Panopticlick left off. Panopticlick was about letting users know that browser fingerprinting was...
46
US Secret Service: “Massive Fraud” Against State Unemployment Insurance Programs
A well-organized Nigerian crime ring is exploiting the COVID-19 crisis by committing large-scale fraud against multiple state unemployment insurance programs, with potential losses in the hundreds of millions of dollars, according to a new alert issued by the U.S. Secret Service .
47
SolarWinds hackers were able to access Microsoft source code
As we said in our recent blog , we believe the Solorigate incident is an opportunity to work together in important ways, to share information, strengthen defenses and respond to attacks. Like other SolarWinds customers, we have been actively looking for indicators of the Solorigate actor and want to share an update…
48
Danish military intelligence uses XKEYSCORE to tap cables in co-op with the NSA
A weblog about Signals Intelligence, Communications Security and top level telecommunications equipment
49
Facebook's Hypocrisy on Apple's New iOS 14 Privacy Feature
In their latest attempt to disrupt the iOS anti-ad tracking feature, Facebook has stooped to a new low
50
I Hacked into Facebook's Legal Department Admin Panel
Alaa Abdulridha — Engineering Director at SerpApi & Cybersecurity Researcher. Expert in web application penetration testing, reverse engineering, bug bounty programs, and secure code development. Passionate about discovering vulnerabilities, building scalable systems, and teaching practical cybersecurity techniques.
51
Highly Evasive Attacker Leverages SolarWinds Supply Chain
Transform cyber defense with Mandiant. Engage frontline experts for incident response, threat intelligence services, and cyber risk management.
52
Who is Facebook's mysterious “Lan Tim 2”?
Facebook has an interesting feature. It will let you see which companies have associated your off-Facebook activity with your Facebook account. If you visit: https://www.facebook.com/off_facebook_activity/ you'll see what companies are snitching on you to Facebook. Alice St⭕️llmeyer@StollmeyerEU#AirBnB shares your…
53
Mozilla’s DNS over HTTPs
The current insecure DNS system leaves billions of people around the world vulnerable because the data about where they go on the internet is unencrypted. We’ve set out to change ...
54
An iOS zero-click radio proximity exploit odyssey
Posted by Ian Beer, Project ZeroNOTE: This specific issue was fixed before the launch of Privacy-...
55
No, Cellebrite Cannot “Break Signal Encryption”
Yesterday, the BBC ran a story with the factually untrue headline, “Cellebrite claimed to have cracked chat app’s encryption.” This is false. Not only can Cellebrite not break Signal encryption, but Cellebrite never even claimed to be able to. Since we weren’t actually given the opportunity to co...
56
The EARN IT Act Violates the US Constitution
Since senators introduced the EARN IT Act (S. 3398) in early March, EFF has called attention to the many ways in which the bill would be a disaster for Internet users’ free speech and security. We’ve explained how the EARN IT Act could be used to drastically undermine encryption. Although the bill...
57
The unexpected Google wide domain check bypass
David Schütz's bug bounty writeups
58
How to contact Google SRE by dropping a shell in Cloud SQL
Note: The vulnerabilities that are discussed in this post were patched quickly and properly by Google. We support responsible disclosure. The research that resulted in this post was done by me and …
59
U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise
Communications at the U.S. Treasury and Commerce Departments were reportedly compromised by a supply chain attack on SolarWinds , a security vendor that helps the federal government and a range of Fortune 500 companies monitor the health of their IT networks. Given the breadth of the company’s customer base, experts…
60
Please stop using CDNs for external JavaScript libraries
I want to discuss a (minor) antipattern that I think is (slightly) harmful. Lots of websites use large Javascript libraries. They often include them by using a 3rd party Content Delivery Network like so: Copied HTML to 📋⧉ HTML<script src="https://cdn.example.com/js/library-v1.2.3.js"></script> There are, supposedly, a…