Topics /
The most popular blog posts about security & privacy on Hacker News. 8,770 posts.
Last week, Target told reporters at The Wall Street Journal and Reuters that the initial intrusion into its systems was traced back to network credentials that were stolen from a third party vendor. Sources now tell KrebsOnSecurity that the vendor in question was a refrigeration, heating and air conditioning…
Microsoft today is taking the unusual step of releasing security updates for unsupported but still widely-used Windows operating systems like XP and Windows 2003 , citing the discovery of a “wormable” flaw that the company says could be used to fuel a fast-moving malware threat like the WannaCry ransomware attacks of…
A few days ago, a new type of gold/item scam made the rounds. Usually scamming in MMORPGs is done using social engineering techniques, e.g. an attacker sells a fake item code for alleged in-game items like mounts to a potential victim for in-game currency. But this most recent kind of attack does not only involve…
Once upon a time, a journalist never gave up a confidential source. When someone comes forward, anonymously, to inform the public, it's better to risk time incarcerated than give them up. This ethical responsibility was also a practical and professional necessity. If you promise anonymity, you're obliged to deliver…
Your salary sorted into Pots. Your spare change turned into savings. Your money, doing what it should with Monzo.
Last time I reviewed various security keys at a fairly superficial level: basic function, physical characteristics etc. This post considers lower-level behaviour.
The next time you’re thinking of throwing away a used boarding pass with a barcode on it, consider tossing the boarding pass into a document shredder instead. Two-dimensional barcodes and QR codes can hold a great deal of information, and the codes printed on airline boarding passes may allow someone to discover more…
A smartphone’s unique Bluetooth fingerprint could be used to track the device’s user–until now. A team of researchers have developed a simple firmware update that can completely hide the Bluetooth fingerprint, eliminating the vulnerability.
Cloudflare is a service that acts as a middleman between a website and its end users, protecting it from various attacks. Unfortunately, those websites are often poorly configured, allowing an attacker to entirely bypass Cloudflare and run DDoS attacks or exploit web-based vulnerabilities that would otherwise be…
Troubleshooting of an Amazon ELB bug found in production using the Sysdig and Wireshark analysis tools and following a strictly top-down approach.
Now you can request an archive of your data from your account settings page.
ICANN is currently considering a proposal that “domains used for online financial transactions for commercial purpose should be ineligible for [WHOIS] privacy and proxy registrations” [ PDF ]. Given the vagueness around what would count as “commercial purpose” (tip jars? advertising? promoting your Kickstarter?) and…
Getting your messages without giving a third party your credentials and data
Anthropic's Claude Desktop silently installs a Native Messaging bridge into seven Chromium browsers, including browsers Anthropic's own documentation says it does not support, and browsers the user has not even installed.
Posted by Elie Bursztein, Security & Anti-abuse Research Lead, and Jean-Michel Picod, Software Engineer, Google Today, FIDO security...
Co-authored by Rainey Reitman and Marcia Hofmann The First Amendment to the Constitution guarantees freedom of expression against government encroachment — but that doesn't help if the censorship doesn't come from the government. The controversial whistle-blower website WikiLeaks, which has begun...
This is a from-scratch explanation of private information retrieval built using homomorphic encryption. I try to assume only a general math / computer science background. To simplify things, my explanations may not always match academic definitions. You can check out this paper or code for more.
We can now conclusively link Stuxnet to the centrifuge structure at the Natanz nuclear enrichment lab in Iran. Watch this new video presentation from Ralph Langner, the researcher who has done the most work on Stuxnet. It’s a long clip, but the good stuff is between 21:00 and 29:00. The pictures he’s referring to are…
Lawmakers are getting serious about renewing the U.S. government’s Internet spying powers, so we need to get serious about stopping their bad proposals. First out of the gate is a bill from Sen. Tom Cotton, an ardent defender of government surveillance. His bill would not just reauthorize, but make...
Identifying and exploiting over 70 cache poisoning vulnerabilities across major bug bounty programs, including GitHub, GitLab, Shopify and HackerOne.
TiDB is the distributed SQL database built for AI agents. Vectors, transactions, and analytics in one engine with ACID guarantees and elastic scale.
Fear the reaper: characterization and fast detection of card skimmers Scaife et al., USENIX Security 2018 Until I can get my hands on a Skim Reaper I’m not sure I’ll ever trust an ATM or other expo…
When law enforcement agencies tout their latest cybercriminal arrest, the defendant is often cast as a bravado outlaw engaged in sophisticated, lucrative, even exciting activity. But new research suggests that as cybercrime has become dominated by pay-for-service offerings, the vast majority of day-to-day activity…
Software piracy is a fact of life for vendors of desktop software. Take a look at Google’s helpful suggestions if you search on the name of one of my products: Trying to make your software cr…
Update (4/27/2023): Amazon S3 now automatically enables S3 Block Public Access and disables S3 access control lists (ACLs) for all new S3 buckets in all AWS Regions. Update (August 2019)– Fresh screen shots and changes to the names of the options. Newly created Amazon S3 buckets and objects are (and always have been)…
While traveling through Dulles Airport last week, I noticed an Internet oddity. The nearby AT&T hotspot was fairly fast—that was a pleasant surprise.
