6181
YubiKey Bio Series
The YubiKey Bio Series delivers secure second factor and passwordless logins for desktop-based FIDO-supported services and applications.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,772 posts.
6182
The shady world of IP leasing
The IPv4 "exhaustion" is not real. The addresses got hoarded and the market devolved into a wild sub-leasing economy where anyone can choose where their IPs appear from, who owns them on paper, and scrub them clean of any history.
6183
I want XAES-256-GCM/11
I want the extended-nonce 256-bit reduced-rounds XAES-256-GCM/11 AEAD. It has infinitely randomizable nonces, a comfortable margin of multi-user security, and nearly the same performance as AES-128-GCM. Only issue is that it doesn’t exist.
6184
A modern approach to preventing CSRF in Go
My new book guides you through the start-to-finish build of a real world web application in Go — covering topics like how to structure your code, manage dependencies, create dynamic database-driven pages, and how to authenticate and authorize users securely .
6185
Gradually sunsetting SHA-1
Cross-posted on the Chromium Blog The SHA-1 cryptographic hash algorithm has been known to be considerably weaker than it was designed t...
6186
Acme, a brief history of one of the protocols which has changed the Internet
ACME, a brief history of one of the protocols which has changed the Internet Security Changelog 03 December 2025: article announced on Mastodon, LinkedIn and X. 03 December 2025: J.C. Jones published his reflections about 10 years of Let’s Encrypt. A must read! 03 December 2025: J.C. has also been kind enough to…
6187
Mozilla to Certificate Authorities: no subordinate CAs for traffic interception
Earlier today we sent an email to all certificate authorities in the Mozilla root program to clarify our expectations around certificate issuance. In particular, we made it clear that the ...
6188
6189
Cryptography is not magic
Crypto is often treated like a black art only anointed experts can hope to wield safely. It's not. There are laws, and we can learn them.
6190
TextSecure, Now With 10 Million More Users
At Open Whisper Systems, we’re working to both advance the state of the art for secure communication and also reduce the friction required for ordinary people to make use of it. We want everyone to have access to advanced secure communication methods that are as easy and reliable to use as makin...
6191
How Verizon's Advertising Header Works
Over the past couple of days, there’s been an outpouring of concern about Verizon’s advertising practices. Verizon Wireless is injecting a unique identifier into web requests, as data transits the network. On my phone, for example, here’s the extra HTTP header. 1
6192
MSI Center – How to gain SYSTEM privileges in seconds
Abusing named pipes in proprietary software to get LocalSystem privileges in seconds.
6193
Most parked domains now serving malicious content
Direct navigation — the act of visiting a website by manually typing a domain name in a web browser — has never been riskier: A new study finds the vast majority of “parked” domains — mostly expired or dormant domain names, or common misspellings of popular websites — are now configured to redirect visitors to sites…
6194
Multi-Account Containers to “Exchange messages with programs other than Firefox”
A new version of Firefox Multi-Account Containers requires permission to “Exchange messages with programs other than Firefox.”
6195
Microsoft Office 365 Message Encryption Insecure Mode of Operation
This blogpost, written by WithSecure’s STINGR Group, presents the analysis of a security incident that happened in February 2026 and was investigated by the WithSecure Incident Response team.
6196
New Intermediate Certificates
On Wednesday, March 13, 2024, Let’s Encrypt generated 10 new Intermediate CA Key Pairs, and issued 15 new Intermediate CA Certificates containing the new public keys. These new intermediate certificates provide smaller and more efficient certificate chains to Let’s Encrypt Subscribers, enhancing the overall online…
6197
6198
Hidden in plain sight: Brute-forcing Slack private files
Van Pathé tot KLM en de Rijksoverheid: ontdek hoe Dawn Technology met maatwerk software alledaagse ervaringen slimmer, sneller en beter maakt.
6199
WPA3 Wifi Security Protocol Announced
New Wi-Fi® security features available in 2018Las Vegas, NV – January 8, 2018 – Wi-Fi Alliance® introduces enhancements and new features for Wi-Fi Protected Access®, the essential family of Wi-Fi CERTIFIED™ security technologies for more than a decade. Wi-Fi Alliance is launching configuration, authentication, and…
6200
A more privacy-friendly blog
Over the years, I have implemented some changes to this blog to make it more privacy-friendly.
6201
6202
Detect and crash Chromium bots
Disclaimer: If you're here for the holy grail of bot detection, this may not be it, unless your UX strategy involves surprise popups and your marketing strategy involves blocking Google crawlers. We recently stumbled across a bug on the Chromium bug tracker where a short JavaScript snippet can crash
6203
A Court Order is an Insider Attack
Commentators on the Lavabit case, including the judge himself, have criticized Lavabit for designing its system in a way that resisted court-ordered access to user data. They ask: If court orders are legitimate, why should we allow engineers to design services that protect users against court-ordered access? The…
6204
Surveillance and the Internet of Things
The Internet has turned into a massive surveillance tool. We’re constantly monitored on the Internet by hundreds of companies—both familiar and unfamiliar. Everything we do there is recorded, collected, and collated—sometimes by corporations wanting to sell us stuff and sometimes by governments wanting to keep an eye…
6205
Sony uses DMCA to silence speech that reveals its security flaws
Co-authored by Corynne McSherry and Marcia Hofmann For years, EFF has been warning that the anti-circumvention provisions of the Digital Millennium Copyright Act can be used to chill speech, particularly security research, because legitimate researchers will be afraid to publish their results lest...
6206
Disabling SSLv3 and RC4
Posted by Adam Langley, Security Engineer As the previously announced transition to SHA-256 certificates is nearing completion, we are p...
6207
Incident Report – DDoS Attack
On Monday, December 1st, 2014, we experienced a major volumetric DDoS attack aimed at a customer's domain. Here is our full report.
6208
A buffer overflow in the XNU kernel
XNU kernel buffer overflow, introduced in macOS 14.0 and fixed in macOS 14.5.
6209
RansomEXX Trojan attacks Linux systems
We recently discovered a new file-encrypting Trojan built as an ELF executable and intended to encrypt data on machines controlled by Linux-based operating systems.
6210
