7171
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,772 posts.
7172
About Gatekeeper
Today’s Mountain Lion announcement introduces an important new security feature, called Gatekeeper, in addition to the “sandboxing” feature that premiered in Lion. I’d like to talk a little bit about it, and why it’s important to all Mac users.
7173
iPhone and iPad approved to handle classified NATO information
Today, Apple announced iPhone and iPad are the first and only consumer devices in compliance with information assurance requirements of NATO nations.
7174
Judge to DOJ: Not All Writs
A federal magistrate judge in Brooklyn took an admirable stand last week when he questioned the government’s authority to compel Apple to unlock a seized mobile device using the All Writs Act. That’s a general-purpose law passed in 1789 that allows a court to require third parties’ assistance to...
7175
Security vulnerabilities fixed in Firefox 72.0.1 and ESR 68.4.1
Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw.
7176
Hey Paypal, why do you need access to my microphone, camera and photos?
Who actually checks the permissions of applications they’re installing? A little while ago a Paypal update stalled because it required extra permissions. This is what happens if an app you have already installed wants more power. I was more than a little surprised with what I found.
7177
A possible flaw in open-source bcrypt implementations
[NOTE: See updates below and here .] I'm working on an application that requires a secure password hash. The state of the art is Colin Perc...
7178
Public hacker test on Swiss Post’s e-voting system
Die Post unterstützt mit ihren Dienstleistungen den Alltag der Menschen in der Schweiz, in der physischen und in der virtuellen Welt. Beim E-Voting digitalisiert sie, was sie bereits am besten kann: den sicheren Transport vertraulicher Informationen.
7179
Oblivious DNS: Plugging the Internet’s Biggest Privacy Hole
by Annie Edmundson, Paul Schmitt, Nick Feamster The recent news that Cloudflare is deploying their own DNS recursive resolver has once again raised hopes that users will enjoy improved privacy, since they can send DNS traffic encrypted to Cloudflare, rather than to their ISP. In this post, we explain why this approach…
7180
What every IT person needs to know about OpenBSD Part 3: That packet filter
Useful and fun features related to the OpenBSD packet filter.
7181
7182
Exploiting Android Messengers with WebRTC
Posted by Natalie Silvanovich, Project ZeroThis is a three-part series on exploiting messenger ap...
7183
Bash bug: apply the unofficial patch now (CVE-2014-6277)
OK, rebuild bash and deploy Florian's unofficial patch or its now-upstream version now. If you're a distro maintainer, please consider doi...
7184
Reliability via Automated Renewal Information
The Let’s Encrypt team is excited to announce that ACME Renewal Information (ARI) is live in production! ARI makes it possible for our subscribers to handle certificate revocation and renewal as easily and automatically as the process of getting a certificate in the first place. With ARI, Let’s Encrypt can signal to…
7185
7186
Scientific notation bug in MySQL left AWS WAF vulnerable to SQL injection
We provide around-the-clock threat detection and incident response, backed by expert consulting to keep your organization secure.
7187
7188
Dear Mozilla community: I screwed up. Big time.
I screwed up. Big time. Not just with Adblock Plus users but with the Mozilla community at large.
7189
Improving on Tor .onion Address Usability
Hello again, this blog post is the second issue of the Cooking with Onions series which aims to...
7190
Steps You Can Take Right Now Against Internet Surveillance
One of the trends we've seen is how, as the word of the NSA's spying has spread, more and more ordinary people want to know how (or if) they can defend themselves from surveillance online. But where to start? The bad news is: if you're being personally targeted by a powerful intelligence agency...
7191
French Constitutional Council Widely Approves Surveillance Law
Update (24 July 2015): The French Constitutional Council shows again its disregard for fundamental rights. This morning, after approving almost all dispositions in the Surveillance law, the Constitutional Council builds momentum by rejecting the Question Prioritaire de ConstitutionalitéThe QPC is a
7192
Modernizing Transport Security
Posted by David Benjamin, Chrome networking *Updated on October 17, 2018 with details about changes in other browsers TLS (Transport Lay...
7193
Reversing for dummies – x86 assembly and C code (Beginner/ADHD friendly)
Before I got into reverse engineering, executables always seemed like black magic to me. I always wondered how stuff worked under the hood, and how binary code is represented inside .exe files, and how hard it is to modify this ‘compiled code’ without access to the original source code.
7194
Reverse Engineer Amazon's Whispersync
I am a big fan of my Kindle. This is the device I’d bring over to a desert island. I am also a fairly frequent user of the highlight feature where you can select a bit of text you like and save it. One thing is bothering me though: the lack of open API on the Kindle to retrieve the data about me. Amazon provides the…
7195
The FBI can almost certainly crack the San Bernardino iPhone without Apple
The title kind of says it all. How do I know? Because of this photo : That's a picture of the logic board of an iPhone 5C, the same mod...
7196
Apple Reneged on OCSP Privacy
In the current version of macOS, Monterey, on every system update on a system containing an M1 chip, such as all the new shiny/fast ARM (“Apple Silicon”) macs, the update process phones home to Apple to obtain a special boot signature, known in Apple jargon as a “ticket”.
7197
EFF Pries More Information on Zero Days from the Government
Until just last week, the U.S. government kept up the charade that its use of a stockpile of security vulnerabilities for hacking was a closely held secret.[fn]For what it's worth, the government denies having a “Raiders of the Lost Ark style” stockpile of zero days.[/fn] In fact, in response to...
7198
Lessons from the History of Attacks on Secure Hash Functions
This document is a work-in-progress. Please contact the author if you see errors or omissions. Most of the secure hash functions ever designed have turned out to be vulnerable to collision attacks.
7199
How Rainbow Tables Work
I found the creator of Rainbow Table's paper, aimed at cryptanalysts, was pretty inaccessible considering the simplicity and elegance of Rainbow Tables, so this is an overview of it for a layman.
7200
Audio Adversarial Examples
Figure from our paper: given any waveform, we can modify it slightly to produce another (similar) waveform that transcribes as any different target phrase.