Topics /
The most popular blog posts about security & privacy on Hacker News. 8,772 posts.
One consequence of these unsolicited security scans is that — since they feed a variety of inputs to forms, including the account creation form — I see a lot of obviously fake signup attempts (alas, none yet from the world's most obviously fake domain name ). These are harmless, since the signup code sends out a…
I hate to pick on Sony, but they got hacked again (and no, I am not talking about the Lulzsec + sonypictures, this is another…
Posted by Stephan Somogyi, Security & Privacy PM, and Adam Eijdenberg, Certificate Transparency PM On September 14, around 19:20 GMT, Syma...
Part 3 of a series on “Privacy on the Blockchain”.
Threema Goes Open Source, Welcomes New Partner
EFF, ACLU, and Access Now released a statement in support of Apple and its stance on encryption last week. We called on the President to reject any attempt to force backdoors like the one the FBI was seeking to Apple’s operating system. We asked our communities to help by tweeting at the President...
How I built a click farm to “bypass” Cloudflare’s CAPTCHA killer with some cheap USB security keys, an Arduino, and a bit of python.
CURRYFINGER quickly and effectively identifies the real hosts behind CDN networks like CloudFlare - and outperforms existing tools. Find out how to use it.
Learn about Figma's response to the security vulnerabilities that were reported in a 3rd-party library that we use for plugin security
Learn how to scale IAM globally. Ory provides secure multi-region identity solutions.
In this post, we analyze a malicious PyPI package attempting to backdoor FastAPI applications.
Hidden img and script tags with onload and onerror let any site tell if you're logged into GMail, Facebook, Twitter or Digg. Google called it expected.
On April 29th CVE-2026-31431 was publicly disclosed at https://copy.fail/ . This vulnerability allows a local unprivileged user to obtain a root shell by running the Python script shared by the author.
Summary RubyGems.org contained a bug that could allow an attacker to replace some .gem files on our servers with a different file that they supplied. We deployed a partial fix on April 2nd and a co...
Lately, there's been an resurgence of new programs written for retro computers—everything from a Slack client to many Wordle clones, to a Mastodon client. But most of these programs, if they connect to the Internet, require a proxy running on a modern computer to handle the SSL/TLS connection, which almost all APIs…
Process isolation is a key component for containers. One of the key underlying mechanisms are namespaces. We will explore what they are, and how they work, to build our own isolated container and better understand each piece.
No matter how much anyone tries to sugar coat it, a service like Have I been pwned [https://haveibeenpwned.com/] (HIBP) which deals with billions of records hacked out of other peoples' systems is always going to sit in a grey area. There are degrees, of course; at one end
Over the past few months, we’ve been experimenting with DNS-over-HTTPS (DoH), a protocol which uses encryption to protect DNS requests and responses, with the goal of deploying DoH by default ...
From The world is entering an era where identity is no longer a matter of personal relationships, lived experience, or even paperwork. Increasingly, it is reduced to biometric scans, algorithmic ve…
When a browser connects to websites over HTTPS (vs. HTTP), eavesdroppers and attackers on the network can't intercept or alter the data that...
A comprehensive guide about the different types of encryption, the upsides and downsides, and how to make decisions about how much encryption you need for note-taking, passwords, or anything else.
If you’re fed up with Meta right now, you’re not alone. Meta tracks you across millions of websites and apps and its business model relies on your data. If you want to limit Meta’s ability to collect and profit from your personal data, here’s what you need to know.
Linkedin and Reddit both check your clipboard and copy and paste your clipboard contents with every keystroke - even when you’re in another app. Another
I'm going to talk today about signify, a tool I wrote for the OpenBSD project that cryptographically signs and verifies. This allows us to ensure that the releases we ship arrive on your computer in their original, intended form, without tampering.
