7621
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,773 posts.
7622
Signal knows who you're talking to (2023)
Recently I got a friend to finally join me on Signal. He asked something about whether or not Signal is truly secure and private, like if it was safe from US government surveillance. I told him: “Well, it’s end-to-end encrypted, so they don’t know what we’re talking about, but they definitely know that we’re talking…
7623
What is the point of a public key fingerprint?
What is the point of a public key fingerprint? What does it do that the public key itself doesn't do. This post explains.
7624
7625
7626
How secure is merely discarding (TRIMing) all of a SSD's blocks?
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
7627
Why Your Wi-Fi Router Doubles as an Apple AirTag
Apple and the satellite-based broadband service Starlink each recently took steps to address new research into the potential security and privacy implications of how their services geo-locate devices. Researchers from the University of Maryland say they relied on publicly available data from Apple to track the…
7628
Zoom’s 90-day plan to bolster key privacy and security initiatives
Learn more about how to use each Zoom product to connect with coworkers, customers, businesses, and more with insights and best practices.
7629
Macs with T2, M1 chips cannot be restored to factory state without Apple
Modern Apple computers can no longer be fully used and maintained in 100% offline environments, or in ways that will reasonably ensure that the computer is…
7630
7631
The Anti-Palantir Manifesto
Nym CEO Harry Halpin responds to Palantir manifesto with one that defends human freedom and privacy against techno-fascism.
7632
7633
Firefox Local Files Theft – Not Patched Yet
Recently, I was performing a research on Same Origin Policy attacks, I managed to realize that the la version of Firefox (currently 67) is vulnerable to local files theft attack (on any supported OS), due to improper implementation of Same Origin Policy for file scheme URIs. Let’s go over the PoC details then I will…
7634
7635
Evolution Mail Users Easily Trackable
A dns-prefetch tag in an HTML email makes Evolution Mail do a DNS lookup on open, even with remote content blocked. The developers blame WebKitGTK.
7636
7637
Microsoft adopts first international cloud privacy standard
Today marks a major milestone, as Microsoft is the first major cloud provider to adopt the world’s first international standard for cloud privacy. It’s another reason customers can move with confidence to the Microsoft Cloud. The standard in question may seem technical, but it has important practical benefits for…
7638
7639
Aserto: Developer API for permissions and RBAC
No one should build permissions and RBAC on their own. Aserto's authorization-as-a-service platform is here to make sure of it!
7640
DNA testing company vanishes along with its customers' genetic data
Atlas Biomed, a DNA testing company that promised clients insights into their genetic disposition has suddenly disappeared.
7641
Valid Signal privacy issues shrugged off while patches quietly rolled out
kelly kaoudis: application security, hacking, software engineering blog
7642
TIL: Some surprising code execution sources in bash
I ran across two surprising sources of code execution in bash (and probably other shells) recently.
7643
New prompt injection papers: Agents rule of two and the attacker moves second
Two interesting new papers regarding LLM security and prompt injection came to my attention this weekend. Agents Rule of Two: A Practical Approach to AI Agent Security The first is …
7644
Preventing Pool-Party Attacks
Brave has identified a new category of tracking vulnerability, forms of which are present in all browsers. We call this category of attack “pool-party” attacks because the attack uses collections (or “pools”) of limited-but-shared resources to create side channels.
7645
7646
Firefox Under Fire: Anatomy of latest 0-day attack
The recent Firefox attacks are an example of active in-the-wild exploitation of a serious software vulnerability.
7647
Ending CAPTCHAs: Introducing Cryptographic Attestation of Personhood
We want to remove CAPTCHAs completely. The idea is rather simple: a real human should be able to touch or look at their device to prove they are human, without revealing their identity. Let's explore!
7648
7649
Invisible Click Tracking Using “Empty” UTF-8 Characters
Have a look at this URL linking to this post: https://kaspars.net/blog/invisible-click-tracking Notice any tracking variables? Me neither! But check out the HTTP request and response in the network inspector of your browser -- it is redirecting to the "same" URL: URL encoded special characters in the browser console…
7650
Hacking Gmail’s UX with 'From' Fields – Another Phishing Vector
An Unexpected Consequence of a Bad Header