Topics /
The most popular blog posts about security & privacy on Hacker News. 8,774 posts.
We know from the Snowden documents (and other sources) that the NSA taps the Internet backbone through secret agreements with major US telcos., but the US government still hasn’t admitted it. In late August, the Obama administration declassified a ruling from the Foreign Intelligence Surveillance Court. Footnote 3…
States need to have and use data privacy laws to bring privacy violations to light and hold companies accountable for them. So, we were glad to see that the Texas Attorney General’s Office has filed its first lawsuit under Texas Data Privacy and Security Act (TDPSA) to take the Allstate Corporation...
tl;dr: You can now use our searchable database to download Bitcoin timestamps for items in the Internet Archive.
Tor Browser 7.0a4 is now available from the Tor Browser Project page and also from our...
The Internet Archive has filed a federal challenge to a new Washington State law that intends to make online service providers criminally liable for providing access to third parties' offensive materials. There is a press release and an article about it.
This document contains the R 5 N DHT technical specification. R 5 N is a secure distributed hash table (DHT) routing algorithm and data structure for decentralized applications. It features an open peer-to-peer overlay routing mechanism which supports ad-hoc permissionless participation and support for topologies in…
50 ways to leak your data: an exploration of apps’ circumvention of the Android permissions system Reardon et al., USENIX Security Symposium 2019 The problem is all inside your app, she said to me …
Two weeks before Russia invaded Ukraine in February 2022, a large, mysterious new Internet hosting firm called Stark Industries Solutions materialized and quickly became the epicenter of massive distributed denial-of-service (DDoS) attacks on government and commercial targets in Ukraine and Europe. An investigation…
Online payment processing for internet businesses. Stripe is a suite of payment APIs that powers commerce for businesses of all sizes.
Note: Read about past updates to this technology in other blog posts about Intelligent Tracking Prevention, and the Storage Access API.
IntroductionI’ve recently been researching Pixel kernel exploitation and as part of this research...
Cannoli Cannoli is a high-performance tracing engine for qemu-user. It can record a trace of both PCs executed as well as memory operations. It consists of a small patch to QEMU to expose locations to inject some code directly into the JIT, a shared library which is loaded
On World Password Day, we’re providing a sneak peek at a future in which, one day, you won’t need a password at all.
In 2018, Andrew Schober was digitally mugged for approximately $1 million worth of bitcoin. After several years of working with investigators, Schober says he’s confident he has located two young men in the United Kingdom responsible for using a clever piece of digital clipboard-stealing malware to siphon his crypto…
I've been slowly removing Google apps from my life, and one of the last ones left is Authenticator. In this post I look at migrating codes out of Authenticator to a command-line OTP tool, and the steps involved.
Discover secure hard drive destruction methods using powerful magnets to safeguard sensitive data.
Some thoughts about cyber security, technology and life - https://utkusen.com/. Click to read Utku Sen’s Substack, a Substack publication with hundreds of subscribers.
Unicode contains a range of symbols which don't get much use. For example, there are separate symbols for TradeMark - ™, Service Mark - ℠, and Prescriptions - ℞. Nestling among the "Letterlike Symbols" are two curious entries. Both of these are single characters: Telephone symbol - ℡ Numero Sign - № What's interesting…
We are excited to announce that PGPP (Pretty Good Phone Privacy) is now in Beta.
Sonic Drive-In , a fast-food chain with nearly 3,600 locations across 45 U.S. states, has acknowledged a breach affecting an unknown number of store payment systems. The ongoing breach may have led to a fire sale on millions of stolen credit and debit card accounts that are now being peddled in shadowy underground…
Few weeks ago, the German political magazine Panorama and STRG_F reported that law enforcement agencies infiltrated the Tor network in order to expose criminals. The reporters had access to documents showing four successful deanonymizations. I was given the chance to review some documents. In this post, I am…
Code level discussion of web scraping, gray hat automation, growth hacking and bounty hunting
Microsoft has announced that CAs in its root program may not issue certs signed using the SHA-1 algorithm, starting just over two years from now, and that Windows will start refusing to recognise such certs starting just over 3 years from now.
Linux uses dm-crypt in order to provide transparent disk or partition encryption. What are the options in case you need to recover passphrase from such encryption? There are already ready-made tools, but we have also produced and published our own in order to support newer LUKS format/ciphers/hashing.
Often times, physical access to a machine means game over. While people like to think that OSX is immune to most security threats, even Apple computers can be susceptible to physical attacks. Mac OSX is capable of booting into single user mode by holding a special key combination (Command-S). From this point, an…
this has been bothering me for a while now, so I want to write down my thoughts so I can get it out of my head and move on. we’re gonna talk about how Deno approaches security, specifically with its permissions system, and why I think this approach is fundamentally insecure and misleading.
End-to-end encryption is the foundation of the Proton ecosystem. Here’s what E2EE means, and how it protects you.
My friend Aviv was recently the subject of a popular Buzzfeed article about the possibility of an impending “information apocalypse”. tl;dr: Aviv extrapolates from the fake news crisis that started in 2016 to a world in which anyone can create AI-assisted misinformation campaigns indistinguishable from reality to the…
