Topics /
The most popular blog posts about security & privacy on Hacker News. 8,772 posts.
Previously on Deep Space Nine, we discussed (read: I complained about) the short life and quick death of DLNA. On the way, I mentioned DLNA's dependence on UPnP as an underlying autoconfiguration protocol. Let's talk a bit more about UPnP, because it's 1) an interesting protocol, 2) widely misunderstood, and 3)…
After 28 years, SSLv2 is still not gone from the internet... but we're getting there, Author: Jan Kopriva
Back in the early 1990s, PGP introduced the concept of web of trust (WoT)- a means by which users of personal encryption can know whether or...
Developers already use HTTPS to communicate with Firebase Cloud Messaging (FCM). The channel between FCM server endpoint and the device is encrypted with SSL over TCP. However, messages are not encrypted end-to-end (E2E) between the developer server and the user device unless developers take special measures. To this…
Guest Post: A Swiss data centre leaked over 70,000 routes to China Telecom, some for over two hours.
In this post we will set up a virtual lab for malware analysis. We’ll create an isolated virtual network separated from the host OS and from the Internet, in which we’ll setup two victim virtual machines (Ubuntu and Windows 7) as well as an analysis server to mimic common Internet services like HTTP or DNS. Then…
Update December 14, 2021: After this post was published, on June 4, 2021, a federal magistrate judge in Kansas issued another opinion denying the government's application for a geofence warrant.Update May 17, 2021: Since this post was published, the court unsealed its July 24, 2020 opinion denying...
Introduction An obscure quirk of the /proc/*/mem pseudofile is its “punch through” semantics. Writes performed through this file will succeed even if the destination virtual memory is marked unwritable. In fact, this behavior is intentional and actively used by projects such as the Julia JIT compiler and rr debugger…
Andrew “bunnie” Huang and Edward Snowden have designed a hardware device that attaches to an iPhone and monitors it for malicious surveillance activities, even in instances where the phone’s operating system has been compromised. They call it an Introspection Engine, and their use model is a journalist who is…
Vulnerability in Chrome, Firefox, and Opera makes users susceptible to phishing with Unicode domains
Since the initial launch of Qubes OS back in April 2010, work on Qubes has been funded in several different ways. Originally a pet project, it was first supported by Invisible Things Lab (ITL) out of the money we earned on various R&D and consulting contracts. Later, we decided that...
1) Intro & Motivations At the start of of this year, I set myself a personal goal of finding 365 bugs in 365 days. This was entirely motivated by wanting to challenge myself to find more security issues as I felt I'd been slacking off. I thought back to things
As discussed in my previous blogpost, it took about 3 hours to reverse engineer the Lenovo/Superfish certificate and crack the password. In...
Along with several other advocacy groups, EFF signed on to an amicus brief this week in the case of the Commonwealth of Massachusetts v. James Keown, in support of requiring courts to set pre-search limits on the method of digital searches by law enforcement pursuant to judicially authorized...
Table of Contents
A 18-year-old Tennessee man who helped set in motion a fraudulent distress call to police that led to the death of a 60-year-old grandfather in 2020 was sentenced to 60 months in prison today.
HTTP Public Key Pinning (HPKP, RFC 7469)—a standard that was intended to bring public key pinning to the masses—might be dead.
The $1.5B Bybit Hack demonstrates how the Era of Operational Security Failures has arrived, and most cryptocurrency companies are not prepared for its implications.
This means that I am oblivious to all of my friends’ fun broadcasted on Instagram. I don’t feel pressured either to update the abstract audience of everyone I ever connected with online, on where I am, what I am doing or who I am hanging out with.
Security has always been critical to the web, but challenges involved in site migration have inhibited HTTPS adoption for several years. In the interest of a safer web for all, at Google we've worked alongside many others across the online ecosystem to better understand and address these challenges, resulting in real…
Posted by Mark Brand, Truncator of IntegersThis is going to be a quick post, just describing a pa...
Flattr improves customer privacy protections by automatically deleting collected data when its no longer needed for its core service.
Cloudflare Zaraz now can also help you with gathering and managing consent. With this new tool, you can easily collect user’s consent preferences on your website, using a consent modal, and apply your consent policy on third-party tools you load via Cloudflare Zaraz
Better Auth is joining Vercel. We're joining to accelerate our work on open-source auth and securing agent workflows.
Recent months have seen an uptick in reports of JavaScript malware that hides in image files.
The TSA is testing new requirements that passengers remove books and other paper goods from their carry-on baggage when going through airline security. Given the sensitivity of our reading choices, this raises privacy concerns .
Xiaofeng Zheng, Tsinghua University and Tsinghua National Laboratory for Information Science and Technology; Jian Jiang, University of California, Berkeley; Jinjin Liang, Tsinghua University and Tsinghua National Laboratory for Information Science and Technology; Haixin Duan, Tsinghua University, Tsinghua National…
