601
Keyhole – Forge own Windows Store licenses
By WitherOrNot
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,762 posts.
602
New documents reveal scale of US Government’s cell phone location data tracking
Thousands of previously unreleased records illustrate how government agencies sidestep our Fourth Amendment rights.
603
It's Time to Break Up the NSA (2014)
The NSA has become too big and too powerful. What was supposed to be a single agency with a dual mission—protecting the security of U.S. communications and eavesdropping on the communications of our enemies—has become unbalanced in the post-Cold War, all-terrorism-all-the-time era. Putting the U.S. Cyber Command, the…
604
Oracle attempt to hide cybersecurity incident from customers?
Being a provider of cloud SaaS (Software-as-a-service) solutions requires certain cybersecurity responsibilities — including being…
605
Sign arbitrary data with your SSH keys
ssh-keygen can sign and verify signatures, and it's way better than PGP
606
SMS phishing is way too easy
Impersonating someone in SMS texts is way too easy, we must change this to prevent social engineering fraud.
607
608
Signal Protocol and Post-Quantum Ratchets
We are excited to announce a significant advancement in the security of the Signal Protocol: the introduction of the Sparse Post Quantum Ratchet (SPQR). This new ratchet enhances the Signal Protocol’s resilience against future quantum computing threats while maintaining our existing security guar...
609
I'm Testifying to Congress about Data Breaches – What Should I Say?
Edit: I'm putting this up front as a lot of people are asking for it - the hearing will be live-streamed on YouTube and there's already an embedded video on the hearing page [https://energycommerce.house.gov/hearings/identity-verification-post-breach-world/] . There's a title I
610
New German government calls for European ban on biometric mass surveillance
The newly-agreed German government coalition has called for a Europe-wide ban on public facial recognition and other biometric surveillance. This echoes the core demands of the Reclaim Your Face campaign which EDRi has co-led since 2020, through which over 65 civil society groups ask the EU and their national…
611
Exposing high-end poker cheating devices
This post exposes how real-world highly advanced poker cheating devices work.
612
There isn't an easy exploit for this PHP vulnerability
Mass hysteria, or something.
613
Mastercard Should Stop Selling Our Data
We trust companies with our information every day. But many companies—even those that hold our most revealing information—are using it not just to provide the services we ask for, but to amp up their profits at the cost of our privacy.That's why EFF has joined a campaign, led by the U.S. Public...
614
Two billion email addresses were exposed
I hate hyperbolic news headlines about data breaches, but for the "2 Billion Email Addresses" headline to be hyperbolic, it'd need to be exaggerated or overstated - and it isn't. It's rounded up from the more precise number of 1,957,476,021 unique email addresses, but other
615
Ken Thompson really did launch his "trusting trust" trojan attack in real life
Ken Thompson's "Trusting Trust" compiler Trojan attack was not just a thought experiment. In fact, Usenet poster Jay Ashworth stated that, from personal communications, Thompson really did launch this attack in real life and successfully compromised the Unix Support Group at Bell Labs. Recently, I've rediscovered this…
616
617
Facebook Messenger begins testing end-to-end encryption using Signal Protocol
Facebook Messenger has started rolling out Secret Conversations, a feature that enables end-to-end encryption for conversations within Messenger. Secret Conversations is built on Signal Protocol, a modern, open source, strong encryption protocol we developed for asynchronous messaging systems.
618
Tl;dv: Over 180k meetings left wide open
How a missing Firestore security rule on tl;dv exposed 181,874 meetings from 84,312 users across 35,003 domains, including live calls I could join uninvited, and how six months of disclosure got me nothing but seen receipts.
619
Blocked by Cloudflare
Well, it finally happened to me. I was blocked out of a website I use for work because of Cloudflare. And I have no idea if or when I'll be...
620
U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise
Communications at the U.S. Treasury and Commerce Departments were reportedly compromised by a supply chain attack on SolarWinds , a security vendor that helps the federal government and a range of Fortune 500 companies monitor the health of their IT networks. Given the breadth of the company’s customer base, experts…
621
Privacy Nightmare on Wheels’: Every Car Brand Reviewed by Mozilla
Mozilla’s latest edition of *Privacy Not Included reveals how 25 major car brands collect and share deeply personal data, including sexual activity, facial expressions, and genetic and health information.
622
Internet of Snitches
Purism makes premium phones, laptops, mini PCs and servers running free software on PureOS. Purism products respect people's privacy and freedom while protecting their security.
623
A GitHub Issue Title Compromised 4k Developer Machines
A prompt injection in a GitHub issue triggered a chain reaction that ended with 4,000 developers getting OpenClaw installed without consent. The attack composes well-understood vulnerabilities into something new: one AI tool bootstrapping another.
624
625
Accessing Max Verstappen's passport and PII through FIA bugs
We found vulnerabilities in the FIA's Driver Categorisation platform, allowing us to access PII and password hashes of any racing driver with a categorisation rating.
626
GotaTun – Mullvad's WireGuard Implementation in Rust
GotaTun is a WireGuard® implementation written in Rust aimed at being fast, efficient and reliable.
627
Defending a website with Zip bombs
Personal Blog of Christian Haschek
628
Hacking Kia: Remotely controlling cars with just a license plate
On June 11th, 2024, we discovered a set of vulnerabilities in Kia vehicles that allowed remote control over key functions using only a license plate. These attacks could be executed remotely on any hardware-equipped vehicle in about 30 seconds, regardless of whether it had an active Kia Connect subscription.
629
Protections Against Fingerprinting and Crypto Mining in Firefox Nightly and Beta
We have added a feature to block fingerprinting and cryptomining in Firefox Nightly as an option for users to turn on.
630
Schneier removed from TSA oversight meeting at TSA request
I was supposed to testify today about the TSA in front of the House Committee on Oversight and Government Reform. I was informally invited a couple of weeks ago, and formally invited last Tuesday: The hearing will examine the successes and challenges associated with Advanced Imaging Technology (AIT), the Screening of…