7801
Kernel anti-cheat is an overreach
Modern PC games make you install a ring-0 anti-cheat driver you can't audit.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,773 posts.
7802
What happens when a ccTLD is retired? Exploring the potential risks of .io
Could the complex political history of Diego Garcia put the .io domain at risk? Tech firms should be aware of potential risk to their websites.
7803
Two types of privacy
"Privacy" can mean different things in different contexts. Tracking-reduction and tracking-evasion represent different goals with some conflict and overlap.
7804
Norway Fining Meta $98,500 per Day for User Privacy Breach
Norway’s DPA Datatilsynet is penalizing Meta over alleged data privacy breaches, with profound implications across Europe. Learn more in the full news story!
7805
Browser Extension Password Managers Exposing Passwords Everywhere
Advancements in password cracking and frequent theft of password databases endanger single-factor password authentication systems. Password managers are one of the only tools available that can help users remember unique high-entropy passwords, and other secrets such as credit card numbers, for a large number of…
7806
Nine-year-old kids are launching DDoS attacks against schools
Britain's computer crime cops are targeting youngsters as young as nine years old in an attempt to dissuade them from embarking on a life of cybercrime.
7807
We must protect our ability to transact privately online (2019)
Without cryptocurrency, a cashless society is a surveillance society
7808
An Update on the Security Issue
We're sharing new details about the recent security issue.
7809
Senate Guts Privacy Rules. Will House Follow Suit?
Majority Leader McCarthy Confirms House to Immediately Act on Behalf of the Cable and Telephone Industry Following the Senate Vote Yesterday, the U.S. Senate by a razor thin margin of 50 to 48 voted to take away the privacy rights of Internet users as a favor to the cable and telephone industry....
7810
Two-Factor Authentication and the Police State
In Britain - and many other countries - the police can legally force you to divulge your passwords. Whether it's to an encrypted file, a social network, or your email account, the state can legally rifle through your most intimate thoughts and (potentially) pose as you online. As we've recently seen, this can be done…
7811
7812
TEMU Is Cleverly Hidden Spyware That Poses an Urgent Security Threat to U.S.
Analysis of PDD’s app software by multiple experts is showing all the signs of red-flag concern. The calls to outside device data and functions that violate users’ privacy are far more aggressive than any well-known consumer shopping app.
7813
Apple is becoming an ad company despite privacy claims
Apple’s ad business is growing fast. It tracks you in its apps and uses that data to sell ads despite its privacy claims.
7814
7815
7816
7817
Using Hinge as a Command and Control Server
A proof of concept demonstrating how to use the Hinge dating app as a C2.
7818
Birds aren't real – how to create your own "bird"
Did you know that birds aren't real? They are actually mobile devices that have cameras and microphones to maintain surveillance by the government. You may be asking yourself why they do not just use the cell phones in everyone's pocket; hey, I don't know; I don't make the rules.Now that I have completely destroyed my…
7819
The Increasing Trend of Online Extortion
I heard about this guy, walked into a federal bank with a portable phone, handed the phone to the teller, the guy on the other end of the phone said: “We got this guy’s little girl, and if you don’t give him all your money, we’re gonna
7820
7821
Weaponizing Dependabot: Pwn Request at its finest
Your trusty Dependabot (and other GitHub bots) might be an unwitting accomplice. Through "Confused Deputy" attacks, they can be tricked into merging malicious code. This doesn't stop here. It can escalate to full command injection via crafted branch names and even bypass branch protection rules. Plus, we disclose two…
7822
Enable ARMv9 Memory Tagging Extension (MTE) on Pixel 8
The Pixel 8 hardware ( Tensor G3 ) supports the ARM Memory Tagging Extension (MTE) , and software support is available both in Android userspace and the Linux kernel. This feature is a powerful defense against linear buffer overflows and many types of use-after-free flaws. I’m extremely happy to see this hardware…
7823
Delaying Further Symantec TLS Certificate Distrust
Due to a long list of documented issues, Mozilla previously announced our intent to distrust TLS certificates issued by the Symantec Certification Authority, which is now a part of DigiCert. ...
7824
7825
I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded
How four layers of authentication in a production anti-cheat driver still hand you a complete BYOVD toolkit
7826
Isolating Xwayland in a VM
In my last post, Qubes-lite with KVM and Wayland, I described setting up a Qubes-inspired Linux system that runs applications in virtual machines. A …
7827
Strengthening the Microsoft Edge Sandbox
In a recent post, we outlined the layered strategy that the Microsoft Edge security team employs to protect you from vulnerabilities that could be used to compromise your device or personal data. In particular, we showed how Microsoft Edge is leveraging technologies like Code Integrity Guard (CIG) and Arbitrary Code…
7828
The NPM registry is deprecating TLS 1.0 and TLS 1.1
Beginning October 4, 2021, all connections to npm websites and the npm registry, including for package installation, must use TLS 1.2 or higher.
7829
7830
Yangtze River Port and Logistics: On-The-Ground Research Shows Assets Fabricated
Actually no matter if someone doesn’t be aware of then its up to other viewers that they will help, so here it occurs.