631
Hardening Firefox with Anthropic's Red Team
Claude Opus 4.6 found 22 Firefox vulnerabilities in two weeks, 14 rated high-severity, with proofs-of-concept and candidate patches for Mozilla.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,762 posts.
632
Please stop using CDNs for external JavaScript libraries
I want to discuss a (minor) antipattern that I think is (slightly) harmful. Lots of websites use large Javascript libraries. They often include them by using a 3rd party Content Delivery Network like so: Copied HTML to 📋⧉ HTML<script src="https://cdn.example.com/js/library-v1.2.3.js"></script> There are, supposedly, a…
633
Tailscale didn't stop the Hugging Face intrusion
An AI agent used a stolen Tailscale auth key at Hugging Face. Workload identity federation, flow logs, and safer defaults could have reduced the risk.
634
Perplexity AI is lying about their user agent
Perplexity AI claims it sends a user agent and respects robots.txt but it absolutely does not
635
Lavabit Reloaded
There is nothing here so move right along.
636
Ubuntu still has not released patch for Linux 0day RCE in almost 3 weeks
No patched kernels are available yet for 22.04, 24.04, or 26.04 despite a CVSS 9.8 rating.
637
Lockdown
Officially, Google killed Reader because “over the years usage has declined”. 1 I believe that statement, especially if API clients weren’t considered “usage”, but I don’t believe that’s the entire reason.
638
What Apple should tell you when you lose your iPhone
Two weeks ago, I was on holiday in Turin, Italy and made a boo boo. I forgot my phone in our rental car for a two hour visit to a local…
639
CEO of data privacy company Onerep.com founded dozens of people-search firms
The data privacy company Onerep.com bills itself as a Virginia-based service for helping people remove their personal information from almost 200 people-search websites. However, an investigation into the history of onerep.com finds this company is operating out of Belarus and Cyprus, and that its founder has launched…
640
Strong_password Rubygem hijacked
I recently updated minor and patch versions of the gems our Rails app uses. We want to keep dependencies fresh, bugs fixed, security vulnerabilities addressed while maintaining a high chance ...
641
642
“Super secure” messaging app leaks everyone's phone number
You can be, do, and have whatever you want, except for not spilling user information
643
Privacy analysis of Tiktok’s app and website
I did a detailed privacy check of the app TikTok and its corresponding website. Multiple law infringements, trust, transparency and data protection breaches were found.I provide all technical an
644
Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit
Government operatives used NSO Group’s Pegasus spyware to hack 36 personal phones belonging to journalists, producers, anchors, and executives at Al Jazeera. The journalists were hacked by four Pegasus operators, including one operator MONARCHY that we attribute to Saudi Arabia, and one operator SNEAKY KESTREL that we…
645
Checkout.com hacked, refuses ransom payment, donates to security labs
Our statement detailing an incident concerning a legacy system. We outline our commitment to transparency, accountability, and planned investment in cyber security research.
646
647
iMessage, explained
This blog post is going to be a cursory overview of the internals iMessage, as I’ve discovered during my work on pypush, an open source project that reimplements iMessage.
648
Gentoo Freenode channels have been hijacked
News and information from Gentoo Linux
649
650
Your compliance obligations under the UK’s Online Safety Bill
L ast month I wrote a post about the UK’s “world-leading” vision for age-gating the open web. It got a bit of attention . That post, sadly, encompassed only one aspect of your compliance obligations under the Online Safety Bill . In this post, I’m going to tell you about the rest.
651
Does Apple really log every app you run? A technical look
Apple’s launch of macOS Big Sur was almost immediately followed by server issues which prevented users from running third-party apps on their computers. While a workaround was soon found by people on Twitter, others raised some privacy concerns related to that issue.
652
Chrome again exempts Google from user site data settings
Six years ago I published a blog post Chrome exempts Google sites from user site data settings that received quite a bit of attention: Michael Tsai , Hacker News The Register , The Verge , and Gizmodo , among others. The blog post was about a Google Chrome bug that mysteriously exempted Google-owned sites from the…
653
Web fingerprinting is worse than I thought
Explore top no verification casino sites in Australia offering instant crypto withdrawals, huge pokies libraries, and safe anonymous gambling.
654
The Trouble with CloudFlare
Wednesday, CloudFlare blogged that 94% of the requests it sees from Tor are "malicious." We find...
655
My smart sleep mask broadcasts users' brainwaves to an open MQTT broker
I recently got a smart sleep mask from Kickstarter. I was not expecting to end up with the ability to read strangers' brainwaves and send them electric impul...
656
OnionShare makes it easy to publish anonymous, uncensorable websites
I’m excited to announce that OnionShare 2.2 is released! You can download it from onionshare.org. When I first wrote OnionShare in 2014, it let you anonymously and securely send files to people. It worked like this: OnionShare zips up the files, starts a local web server on
657
Carnegie Mellon CS Professor challenges Sony by mirroring Geohot's PS3 hacks
Request for materials: I would like to receive tutorial information on: Sony PS3 access protection mechanisms, the Elliptical Curve Digital Signature Algorithm ( ECDSA ), the structure of the PS3 hypervisor, METLDR, signing tools, and any other topics necessary for a person reasonably skilled in computer science to be…
658
Upspin – Another option for file sharing
Posted by Andrew Gerrand, Eric Grosse, Rob Pike, Eduardo Pinheiro and Dave Presotto, Google Software Engineers Existing mechanisms for fil...
659
The patent office is about to make bad patents untouchable
The U.S. Patent and Trademark Office (USPTO) has proposed new rules that would effectively end the public’s ability to challenge improperly granted patents at the Patent Office itself. We need EFF supporters to file public comments opposing these rules this week. The USPTO is moving quickly, and staying silent will…
660
Memory Safe Languages in Android 13
Posted by Jeff Vander Stoep For more than a decade, memory safety vulnerabilities have consistently represented more than 65% of vulnerab...