7471
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,773 posts.
7472
Analyzing and breaking an externally encrypted HDD
Analyzing and breaking external encrypted HDD has been a “hobby” of mine for quite some time. With my colleagues Joffrey Czarny and Julien Lenoir we looked at several models in the past :
7473
Releasing jsfunfuzz and DOMFuzz
Today I'm releasing two fuzzers: jsfunfuzz , which tests JavaScript engines, and DOMFuzz , which tests layout and DOM APIs.
7474
0x01 – Killing Windows Kernel Mitigations
This post was made possible through hard work and determination. Do not feel frustrated if this stuff does not click immediately and remember, the source of truth will always be the source code. For us, our source code is raw assembly. That said it’s important you understand these techniques in detail because when…
7475
How to write a rootkit without really trying
We open-sourced a fault injection tool, KRF, that uses kernel-space syscall interception. You can use it today to find faulty assumptions (and resultant bugs) in your programs. Check it out! This post covers intercepting system calls from within the Linux kernel, via a plain old kernel module. We’ll go through a quick…
7476
Peter Eckersley, co-creator of Let’s Encrypt, dies at just 43
The Sophos Blog
7477
The Resolv hack: How one compromised key printed $23M
Web3 security lessons from the Resolv hack: how a compromised key enabled a $23M exploit, what went wrong, and how DeFi protocols can prevent similar attacks.
7478
Never talk to the police
Always talk to a criminal defense attorney before you tell the police anything or consent to a search without a warrant. When I was a prosecutor, the first think I would ask when given a case was, "did he say anything?"
7479
7480
Facebook paid $4.5K for disclosure of my user account exploit
Back in 2009 I found a major security exploit on both Facebook and the than popular MySpace which exposed access to a user's personal data. I reported both data leaks to the social networks, and…
7481
I fear for the unauthenticated web
LLM and AI companies seem to all be in a race to breathe the last breath of air in every room they stumble into. This practice started with larger websites, ones that already had protection from ma...
7482
Another Conflict Between Privacy Laws and Age Authentication–Murphy v Confirm ID
This opinion is a routine ruling over TOS formation and whether disputes must go to arbitration. However, before I dig into that question, I need to note the case’s chilling implications. * * * This case involves the Adult Friend...
7483
Every Model Cheats
This post presents a controlled prompt-ablation study: 23 tasks, three prompt conditions, 1,518 individually audited traces, and a simple question: can you prompt away cheating?
7484
7485
Time-lock encryption
How do you encrypt a file such that it can be decrypted after a date, but not before? Use serial computations for proof-of-work using successive squaring, chained hashes, or witness encryption on blockchains.
7486
7487
Chrome client “variations” can be used to identify you (2020)
Until now I used Chrome with a few settings tweak like disabling sending usage statistics, uBlock origin, no crash reports and so on.
7488
Google Docs Users Targeted by Phishing Scam
Broadcom Community - VMTN, Mainframe, Symantec, Carbon Black
7489
What's the risk from fake Yubikeys?
I found this on a security-related Slack (shared with permission). It launched an entertaining discussion about the risks of taking a potentially fake FIDO token. We all know the risks of taking a free USB drive and shoving it in our computer, right? USB sticks can install software, act as a keylogger, transmit data…
7490
Body found in Canada identified as neo-nazi spam king
The body of a man found shot inside a burned out vehicle in Canada three years ago has been identified as that of Davis Wolfgang Hawke , a prolific spammer and neo-Nazi who led a failed anti-government march on Washington, D.C. in 1999, according to news reports.
7491
7492
Google Calendar Event Injection with MailSniper (2017)
Beau Bullock & Michael Felch // Source: https://chrome.google.com/webstore/detail/google-calendar-by-google/gmbgaklkmjakoegficnlkhebmhkjfich Overview Google Calendar is one of the many features provided to those who sign up for a Google account along with other popular […]
7493
Oracle deprecating Java applets in Java 9
The Java programming language is one of the most popular languages today. Stay up to date with news, certifications, free learning resources, Java Magazine, events and much more
7494
Who Does Skype Let Spy?
Lately I’ve been thinking a lot about power and the Internet, and what I call the feudal model of IT security that is becoming more and more pervasive. Basically, between cloud services and locked-down end-user devices, we have less control and visibility over our security—and have no point but to trust those in power…
7495
The Federal HTTPS-Only Standard: Necessary and Overdue
The White House Office of Management and Budget has published a new standard recommending full HTTPS on all federal web sites and web services. They are accepting public comments until April 14; if you care about privacy and security, you should weigh in.This post is our public comment: we whole-...
7496
Containers and Docker: how secure are they?
Docker is a founding member of the Blueprint Alliance, a 12-company reference architecture for securing AI agents, built around four governance questions.
7497
Tarsnap exploit bounty
Most bugs are straightforward, but occasionally one comes up which is not so clear in its impact. Such is the case with a bug which is fixed in tarsnap 1.0.36 . This bug causes the NUL string termination byte to overflow the heap-allocated buffer used for paths of objects examined as tarsnap traverses a directory…
7498
Anti-Interdiction on the Librem 5 USA
Purism makes premium phones, laptops, mini PCs and servers running free software on PureOS. Purism products respect people's privacy and freedom while protecting their security.
7499
7500
Poor man's VPN via ssh socks proxy
Redpill Linpro Tech Blog