7711
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,773 posts.
7712
Jitsi Meet Security and Privacy
How secure is Jitsi? Learn more about the Jitsi Meet Security & Privacy information, including how we make sure to protect your privacy here.
7713
Worst-Case Thinking
At a security conference recently, the moderator asked the panel of distinguished cybersecurity leaders what their nightmare scenario was. The answers were the predictable array of large-scale attacks: against our communications infrastructure, against the power grid, against the financial system, in combination with…
7714
7715
7716
Six Harmless Bugs Lead to Remote Code Execution
It was May 2024, and our internal security team was evaluating the LogPoint SIEM/SOAR platform to replace our existing platform, potentially. As part of a habit I’ve built over the years —and honestly, part of our 3rd party due diligence— I gave myself 24 hours to do what I always do with any technology we’re […]
7717
TCP backdoor 32764 – how we could patch the Internet (or part of it)
Eloi Vanderbéken recently found a backdoor on some common routers, which is described on his GitHub here. Basically, a process that listens on the 32764 TCP port runs, sometimes accessible from the WAN interface. We scanned the v4 Internet to look for the routers that have this backdoor wild open, and gathered some…
7718
Exploiting McDonald's APIs to hijack deliveries and order food for a penny
A series of API flaws in McDelivery India made it possible to order food for a penny, hijack other people’s delivery orders, view user information, and more.
7719
EFF's Updated SSL Configuration
EFF recently updated our SSL certificate and configuration. This gave us an A+ rating on SSL Labs, a great jumping off point for reviewing a site's secure connection. What follows is a quick, technical guide to how we achieved this. Generating a Certificate First we generate an 4096-bit RSA private...
7720
7721
The Mitto AG surveillanve case – or why we must never backdoor encryption
A single employee leaked sensitive data to secret services, potentially also to Russia.
7722
Security Best Practices for Fintech Application Development
Learn how to build and manage your card program using Marqeta's guides and API reference documentation.
7723
We found cryptography bugs in the elliptic library using Wycheproof
Trail of Bits discovered and disclosed two vulnerabilities in the widely used elliptic JavaScript library that could allow signature forgery or prevent valid signature verification, with one vulnerability still unfixed after the 90-day disclosure window.
7724
PlayStation Vita Exploit Reverse Engineering Challenge
We released HENkaku a week ago and were blown away by the reception. There has been over 25k unique installs and every day new homebrew are being announced. This is all thanks to those who contributed to the SDK project back when Rejuvenate was announced. Without a working toolchain for developers and a couple of…
7725
Making art with SSH key randomart
SSH is everywhere in the development or operations world now. For development it’s what allows you to push to GitHub. For operations it’s what allows you to reasonably securely log into Linux servers.
7726
Cybersecurity Bill Broad Enough to Use Against WikiLeaks and The Pirate Bay
Congress is doing it again: they’re proposing overbroad regulations that could have dire consequences for our Internet ecology. The Cyber Intelligence Sharing and Protection Act of 2011 (H.R. 3523), introduced by Rep. Mike Rogers and Rep. Dutch Ruppersberger, allows companies or the government[fn]...
7727
Thoughts and Concerns about Operation Onymous
What happened Recently it was announced that a coalition of government agencies took control of...
7728
7729
Chat Control 2.0 through the back door
Just before a decisive meeting in Brussels, digital rights expert and former Member of the European Parliament Dr. Patrick Breyer is sounding the alarm. Using a "deceptive sleight of hand," a mandatory and expanded Chat Control is being pushed through the back door, in a form even more intrusive tha
7730
7731
Google tips off cops after spotting child abuse images in email
The Sophos Blog
7732
Unprivileged Docker Builds – A Proof of Concept
I work at a very ‘locked-down’ enterprise, where direct access to Docker is effectively verboten.
7733
Sandboxes won't save you from OpenClaw
AI agent misbehavior isn't a sandbox problem—it's a permissions problem.
7734
TRESOR Runs Encryption Securely Outside RAM
TRESOR is a secure implementation of AES which is resistant against cold boot attacks. The basic idea behind this implementation is to store the secret key inside CPU registers rather than in RAM.
7735
A grim outlook on the future of browser add-ons
Mozilla limiting users’ choice to 9 add-ons on mobile is only the latest development. Add-on support is degrading across all browsers and will continue to do so.
7736
Thai activist jailed under lese majeste laws for sharing an article on Facebook
Thai activist Jatuphat “Pai” Boonpattaraksa was sentenced this week to two and a half years in prison—for the crime of sharing a BBC article on Facebook. The Thai-language article profiled Thailand’s new king and, while thousands of users shared it, only Jutaphat was found to violate Thailand’s...
7737
Identity Is Dead
First published April 2018.
7738
I’m sorry, but were you actually trying to remember your comical passwords?
I love a good XKCD comic; Randall Munroe has a unique way of cutting right to the crux of technology issues and always doing it in a humorous fashion. Little Bobby Tables [http://xkcd.com/327/] remains an all-time classic and it’s amazing how many times you’ll
7739
Audi Cruise Control Bug
I noticed a "bug" in the way Audi handles its Cruise Control options. Cruise control is only meant to be used once you drive "30 kilometers per hour or more". …
7740
Thoughts on the Systemd Root Exploit
Sebastian Krahmer of the SUSE Security Team has discovered a local root exploit in systemd v228 . A local user on a system running systemd v228 can escalate to root privileges. That's bad.