751
Bypassing YouTube video download throttling
Have you ever tried to download videos from YouTube? I mean manually without relying on software like youtube-dl, yt-dlp or one of “these” websites. It’s much more complicated than you might think.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,762 posts.
752
I put all my personal data on eBay
And almost made lots of money
753
How is NSA breaking so much crypto? (2015)
There have been rumors for years that the NSA can decrypt a significant fraction of encrypted Internet traffic. In 2012, James Bamford published an article quoting anonymous former NSA officials stating that the agency had achieved a “computing breakthrough” that gave them “the ability to crack current public…
754
Banned book library in a wi-fi smart light bulb
OverviewA long while back I had an idea to hack a WiFi smart light bulb to do something more useful to me. Actually, I had a few different ideas of things to do with them. One of these ideas was to mo…
755
Opting Your Website Out of Google's FLoC Network
Google recently announced the rollout of their Federated Learning of Cohorts (FLoC), a new advertising-surveillance initiative that seeks to replace third-party cookies with a new user profiling technique that garners data generated by the browser itself.
756
OpenSSL 3.0.7 fixes X.509 email address buffer overflows
Today we published an advisory about CVE-2022-3786 (“X.509 Email Address Variable Length Buffer Overflow”) and CVE-2022-3602 (“X.509 Email Address 4-byte Buffer Overflow”).
757
Google fixed more Chrome bugs in June than over the past two years, thanks to AI
Chrome uses Gemini AI to automate vulnerability discovery, triage, and patching, accelerating updates to match modern security risks.
758
Infrastructure audit completed by Radically Open Security
We tasked the Netherlands based security firm Radically Open Security (RoS) with performing the third audit towards our VPN infrastructure.
759
‘War Dialing’ tool exposes Zoom’s password problems
As the Coronavirus pandemic continues to force people to work from home, countless companies are now holding daily meetings using videoconferencing services from Zoom . But without the protection of a password, there’s a decent chance your next Zoom meeting could be “Zoom bombed” — attended or disrupted by someone who…
760
We found and fixed a rare race condition in our session handling
On March 8, out of an abundance of caution, we logged all users out of GitHub.com. In this post we share technical details of the vulnerability and steps we're taking to ensure it doesn't happen again.
761
Wikimedia v. NSA: Wikimedia Foundation files suit against NSA
Today, the Wikimedia Foundation is filing suit against the National Security Agency (NSA) and the Department of Justice (DOJ) of the United States. The lawsuit challenges the NSA’s mass surveillanc…
762
By default, Signal doesn't recall
Signal Desktop now includes support for a new “Screen security” setting that is designed to help prevent your own computer from capturing screenshots of your Signal chats on Windows. This setting is automatically enabled by default in Signal Desktop on Windows 11. If you’re wondering why we’re on...
763
What Happened to Facebook, Instagram, and WhatsApp?
Facebook and its sister properties Instagram and WhatsApp are suffering from ongoing, global outages. We don’t yet know why this happened, but the how is clear: Earlier this morning, something inside Facebook caused the company to revoke key digital records that tell computers and other Internet-enabled devices how to…
764
Standing on our own two feet
Update, July 10, 2023 See our new blog post for details on the September 2024 expiration of the newer ISRG Root X1 cross-sign from IdenTrust. Update, December 21, 2020 Thanks to community feedback and our wonderful partners at IdenTrust, we will be able to continue to offer service without interruption to people using…
765
How to SSH Properly
This post explains security best practices to use SSH properly and securely
766
Compromising OpenWrt Supply Chain
Introduction Hello, I’m RyotaK (@ryotkak ), a security engineer at Flatt Security Inc. A few days ago, I was upgrading my home lab network, and I decided to upgrade the OpenWrt on my router.1 After accessing the LuCI, which is the web interface of OpenWrt, I noticed that there is a section called Attended Sysupgrade…
767
Git 3.0's upcoming SHA-256 default will be a costly mistake
Git 3.0 will make SHA-256 the new default content hashing algorithm and it will be an incomprehensibly expensive and ultimately valueless and avoidable global nightmare.
768
Ok Google: please publish your DKIM secret keys
The Internet is a dangerous place in the best of times. Sometimes Internet engineers find ways to mitigate the worst of these threats, and sometimes they fail. Every now and then, however, a major …
769
Pair Locking Your iPhone
Learn how to pair lock your iPhone to break law enforcement forensics tools and protect your data.
770
771
Multiple new macOS sandbox escape vulnerabilities
This is a blog post for my presentation at the conference POC2024. The slides are uploaded here.
772
HashiCorp Boundary
Simple and secure remote access — to any system anywhere based on trusted identity.
773
Web scraping for me, but not for thee
by guest blogger Kieran McCarthy There are few, if any, legal domains where hypocrisy is as baked into the ecosystem as it is with web scraping. Some of the biggest companies on earth—including Meta and Microsoft—take aggressive, litigious approaches to...
774
EFF Wins Battle Over Secret Legal Opinions on Government Spying
San Francisco - The Electronic Frontier Foundation (EFF) has won its four-year Freedom of Information Act lawsuit over secret legal interpretations of a controversial section of the Patriot Act, including legal analysis of law enforcement and intelligence agency access to census records. The U.S....
775
776
Milestone: 100M Certificates Issued
Let’s Encrypt has reached a milestone: we’ve now issued more than 100,000,000 certificates. This number reflects at least a few things: First, it illustrates the strong demand for our services. We’d like to thank all of the sysadmins, web developers, and everyone else managing servers for prioritizing protecting your…
777
My Email Canary
Despite the fact that I use really long passwords and two-factor authentication wherever it's available I still worry that someone might b...
778
Moving away from US cloud services
Relying on US cloud services poses legal and political risks for EU users, so I'm moving away from US cloud services. Here's how and why I did it.
779
Breaking the 4Chan CAPTCHA
In this blog post, I will talk about my successful experiment in machine learning using TensorFlow to automate solving the 4Chan CAPTCHA.
780
The Effectiveness of Publicly Shaming Bad Security
Here's how it normally plays out: It all begins when a company pops up online and makes some sort of ludicrous statement related to their security posture, often as part of a discussion on a public social media platform such as Twitter. Shortly thereafter, the masses descend on said