Topics /
The most popular blog posts about security & privacy on Hacker News. 8,773 posts.
With the latest release of corecrypto, we’re publishing our implementations of quantum-secure ML-KEM and ML-DSA algorithms, along with the mathematical proofs we built to assure they are faithful to the FIPS 203 and FIPS 204 specifications. To advance the state of the art for assuring critical software, we're also…
Mark Zuckerberg’s announcement of A Privacy-Focused Vision for Social Networking is not some dramatic pivot: it is a growth opportunity for Facebook and a challenge for regulators.
EFF and over a dozen other organizations are urging U.S. lawmakers to oppose a dangerous bill proposed by Sens. Sheldon Whitehouse and Lindsey Graham that would make the already-flawed Computer Fraud and Abuse Act (CFAA) worse. The joint letter sent Wednesday explains that the legislation fails to...
I have been awarded a fellowship at the Berkman Center for Internet and Society at Harvard University, for the 2013–2014 academic year. I’m excited about this; Berkman and Harvard is where a lot of the cool kids hang out, and I’m looking forward to working with them this coming year. In particular, I have three goals…
From 15 March 2026, CAs must validate DNSSEC on CAA lookups and ACME checks. I've run DNSSEC for 14 years; see if your registrar supports it.
The recent move among U.S. states to add digital “age verification” to websites which serve adult content is a troubling one. Digital age verification systems are rife with privacy concerns, many requiring you to upload your government ID to third-party vendors or even directly to the website in question. Privacy…
Recently, Wired reported on documents leaked in May from the Council of the European Union’s ongoing deliberations over the draft Child Sex Abuse Regulation. The proposal is controversial because, as presently written, it would require online service providers to proactively scan their services – including users’…
My long-time collaborator Richard Barnes [1] used to say that "in security, trust is a four letter word" , and yet the dominant experience of using any software-based system—which is, you know, pretty much anything electronic—is trusting the manufacturer. Not only is there no meaningful way to determine what software…
Brief background
Distributed Denial of Service (DDoS) attempts to make a machine or network unavailable by flooding it with overwhelming amounts of traffic.
Earlier this year we published a puzzle that handed you a complete neural network and asked you to figure out what it did. The response was great, so we’ve made another one! This time, we’re going much deeper down the tech stack.
Today the High Court of the United Kingdom handed down an excellent decision—excellent because the result is so unreasonable, so out of touch with reality, and so divorced from the needs and expectations of ordinary users, that it provides a textbook illustration of the need for urgent reform of...
Like many developers, I find myself more and more using AI agents to help with software development. I currently use Claude Code, the co...
Let’s start by defining the word Wardriving: it is the search for WIFI wireless networks from a vehicle equipped with a computer. This would be the classic definition. I define modern wardriving as the search for WIFI networks, Bluetooth devices … Continue reading →
a guided introduction for first-timers
This morning I received an interesting scam email. It might not be a new scam, but it was the first time I’d seen it.
For programmers new to cryptography, there are plenty of “known unknowns” – unfamiliar terms like “elliptic curves” and “random oracles”, and unnecessarily long acronyms (“RSASSA-PKCS-v1_5”, like really?). But what really gives cryptography its reputation is the unknown unknowns. The things that catch even experienced…
Project Description Rowhammer haunted us for the better part of the past decade. Most DDR3 modules were found to be susceptible to this vulnerability which can compromise data directly inside the memory cells. What made it so scary was the fact that it could be exploited from software on PCs, clouds, smartphones, over…
Hello, I’m Shiga( @Ga_ryo_ ), a security engineer at Flatt Security Inc.
Joanna Rutkowska recently gave a presentation titled “Reasonably Secure Computing in the Decentralized World (An Operating System Architect’s Perspective)” at a public event hosted by The Golem Project in Berlin, Germany called “Golem and Friends: Data, Security, Scaling and More….” The...
Hartley writes about full stack software engineering and AI-driven software development.
A court filing unsealed late Wednesday shows that the U.S. Department of Justice (DOJ) made a highly misleading argument to an appeals court in October during a hearing on the constitutionality of National Security Letters (NSLs). On October 8, the Electronic Frontier Foundation argued before the...
Comparing SSH keys: RSA, DSA, ECDSA, and Ed25519 explained, with a straight algorithm recommendation and the move from keys to certificates. Read on.
Congress has begun debating the TAKE IT DOWN Act (S. 146), a bill that seeks to speed up the removal of a troubling type of online content: non-consensual intimate imagery, or NCII. In recent years, concerns have also grown about the use of digital tools to alter or create such images, sometimes...
