Topics /
The most popular blog posts about security & privacy on Hacker News. 8,773 posts.
What I detect in Google’s behavior (and John Battelle’s more-or-less defense of it) is a sense of entitlement. That because in the past ad networks could track almost all users via cookies, they are entitled to continue tracking almost all users across the web via cookies, even when a large (and growing) number of…
Last Friday, the TSA snuck out a document updating the “privacy policy” for the nude body scanners. On Tuesday, reports started coming in on the change, including right here. Professi…
Posted by Jay Brown, Sr. Technical Program Manager, Security For many years, we’ve worked to increase the use of encryption between our us...
PyPI requires new users to enable 2FA before performing management actions.
Ars Technica gave three experts a 16,000-entry encrypted password file, and asked them to break them. The winner got 90% of them, the loser 62%—in a few hours. The list of “plains,” as many crackers refer to deciphered hashes, contains the usual list of commonly used passcodes that are found in virtually every breach…
Big Brother meets Big Data
I use a password manager. I have 2FA set up on everything. When an organisation asks me to set a recovery question, I generate a 32 character passphrase. I don't use my mother's maiden name or my first pet's birthday on anything sensitive. I monitor my email addresses for breaches, and I regularly check my credit…
I was chatting with a close friend of mine and he sent me a link to his new SaaS that he's developing.
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw.
Beginning August 13th, 2021, we will no longer accept account passwords when authenticating Git operations on GitHub.com.
Web developer and cybersecurity researcher
An Open Letter To JD Vance From A Former CIA Officer On The Counterintelligence Risks Of Smartwatches Mr. Vice President, Congratulations on your ascendancy to the Vice President of the United States of America. While we are an apolitical platform, we wish you nothing but success, the country depends on you. In a rec
A free new service from the U.S. Postal Service that provides scanned images of incoming mail before it is slated to arrive at its destination address is raising eyebrows among security experts who worry about the service’s potential for misuse by private investigators, identity thieves, stalkers or abusive…
As the UK's politicians continue to fail to understand what "strong cryptography" or "banning" even mean, I thought I would have a look at how simple strong cryptography can be.
Onafhankelijk cybersecuritybedrijf in Nederland en Spanje. Pentest, MDR, NIS2-advies, incident response en CISO as a Service. Meer dan 20 jaar ervaring, 100+ security experts.
An introduction to QUIC and its potential for censorship resistance, as well as a survey of current QUIC blocking in China, India, Russia and Uganda.
One of the great thing about C are the many fairly mature tools in the ecosystem. The bad news however is that most educational materials don't teach them and thus many beginners (and sometimes even experienced) developers have absolutely no awareness that these tools even exists.
A long, long time ago, in a land free of binary exploit mitigations, when Unix still roamed the Earth, there lived a pre-authentication Telnetd vulnerability. In fact, this vulnerability was born so long ago (way back in 1994) that it may even be older than you. To put the
Understand Chrome's deprecation of U2F API and its effects, while exploring how to migrate to the WebAuthn API for continued YubiKey support.
KeePassXC Password Manager
Extracting BitLocker keys sealed with a TPM by sniffing the LPC bus
Some conversations are difficult to have with members of older generations who grew up with different social norms. In particular, when you’re talking to people who grew up with PDP-11s with their completely flat memory, or Lisp machines or Burroughs Large Systems with their deeply opinionated and language-integrated…
Despite the fact that it is not a 'real' vulnerability, escaping privileged Docker containers is nevertheless pretty funny. And because there will always be people who will come up with reasons or excuses to run a privileged container (even though you really shouldn't), this could really be handy at some point in the…
Breaking news, live coverage, investigations, analysis, video, photos and opinions from The Washington Post. Subscribe for the latest on U.S. and international news, politics, business, technology, climate change, health and wellness, sports, science, weather, lifestyle and more.
“[T]he ultimate good desired is better reached by free trade in ideas....That at any rate is the theory of our Constitution.” — Justice Oliver Wendell Holmes, dissent in Abrams v. United States, 1919EFF has witnessed a growing number of calls in recent weeks for Twitter to ban certain...
We successfully exploited two discontinued network devices at DistrictCon’s inaugural Junkyard competition in February, winning runner-up for Most Innovative Exploitation Technique. Our exploit chains demonstrate why end-of-life hardware poses persistent security risks.
