8311
Google Chrome HTTPS Address Bar Spoofing
The Fixed Bounty Bug Revealed Last month Google awarded our security analyst Luka Treiber a Chromium Security Reward for a high-severity ...
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,775 posts.
8312
Google now deleting health clinic searches from location history automatically
Editor's note – May 12, 2023Last year, we launched an important update to Location History. We remain committed to improving the experience and making it as helpful…
8313
Distribution packages considered insecure
If you ever have run a Linux-based operating system you are probably aware of the way that software is usually distributed on them: Using a software repository. Repositories are great for numerous …
8314
8315
Changes to Trusted Certificate Authorities in Android Nougat
News and insights on the Android platform, developer tools, and events.
8316
Azure API vulnerability and roles misconfiguration compromise corporate networks
Over-privileged Azure Key Vault roles & API vulnerabilities let attackers steal credentials silently. Learn how Token Security detects & remediates these critical exposure paths.
8317
8318
DNS4EU for Public Is Available
The free DNS4EU resolver, for everyone in Europe. Get the addresses, set it up in minutes, and block malware and phishing with no tracking.
8319
EFF on Apple's iPhone Developer Program Agreement
The entire family of devices built on the iPhone OS (iPhone, iPod Touch, iPad) have been designed to run only software that is approved by Apple—a major shift from the norms of the personal computer market. Software developers who want Apple's approval must first agree to the iPhone Developer...
8320
The Sad State of Mobile XMPP in 2014
blog about networking, cameras, old gear, and xmpp
8321
Colorado Supreme Court Upholds Keyword Search Warrant
Today, the Colorado Supreme Court became the first state supreme court in the country to address the constitutionality of a keyword warrant—a digital dragnet tool that allows law enforcement to identify everyone who searched the internet for a specific term or phrase. In a weak and ultimately...
8322
8323
COM Like a Bomb: Rust Outlook Add-in
One of legal tech's clichés is that "lawyers live in Word". This is demonstrably incorrect. I, for example, am a lawyer and in fact live in London, England…
8324
iPhone Apps Surreptitiously Communicated with Unknown Servers
Long news article (alternate source) on iPhone privacy, specifically the enormous amount of data your apps are collecting without your knowledge. A lot of this happens in the middle of the night, when you’re probably not otherwise using your phone: IPhone apps I discovered tracking me by passing information to third…
8325
Phishing Darknet Users for Bitcoins
Writeup of a tool for creating bitcoin stealing phishing clones of onion services on large scale
8326
OpenAI's response to the Axios developer tool compromise
OpenAI responds to the Axios supply chain attack by rotating macOS code signing certificates, updating apps, and confirming no user data was compromised.
8327
Kiosk mode bypass for an Ariane Allegro Scenario Player based hotel check-in te
A hotel check-in kiosk application crashed when entering a single quote into the guest search, which enabled access to the Windows Desktop. The terminal uses the Ariane Allegro Scenario Player.
8328
Kaspersky discloses iPhone hardware feature vital in Operation Triangulation
Kaspersky’s Global Research and Analysis Team (GReAT) has unveiled a previously unknown hardware feature in Apple iPhones, pivotal to the Operation Triangulation campaign. The team presented this discovery at the 37th Chaos Communication Congress in Hamburg.
8329
How botnets are created with hijacked Worpess, fake Flash downloads and Node.js
I just noticed the website of an old employer has been hacked and some JavaScript is injected into their corporate website that runs on WordPress. Ouch. Of course I notified them about it and they’re just trying to figure out what happened and how to fix it.
8330
Stanford researcher: Google Circumvents iOS Privacy protection in AdSense ads
Earlier today, the Wall Street Journal published evidence that Google has been circumventing the privacy settings of Safari and iPhone users, tracking them on non-Google sites despite Apple's default settings, which were intended to prevent such tracking. This tracking, discovered by Stanford...
8331
8332
Licenses Over Data: A Case Study with Github v BitBucket
Our Commercial Lawyers deliver legal solutions to businesses in Brisbane and across Australia to meet their commercial targets.
8333
OpenSSL: Stack buffer overflow in CMS AuthEnvelopedData parsing
Show issues fixed only in OpenSSL 4.0 , 3.6 , 3.5 , 3.4 , 3.3 , 3.2 , 3.1 , 3.0 , 1.1.1 , 1.1.0 , 1.0.2 , 1.0.1 , 1.0.0 , 0.9.8 , 0.9.7 , 0.9.6 .
8334
8335
Another cluster of potentially malicious Chrome extensions
I discovered a cluster of at least 109 extensions in Chrome Web Store. A few are committing affiliate fraud or spying, most are simply hoarding overly wide privileges before abusing them.
8336
Data-only attacks are easier than you think (2024)
Data-only attacks, those that do not affect a program’s control flow, have long been considered too sophisticated and niche to pose a practical threat. With our research, however, we have built a tool that automatically generates them with surprising ease. We explain how such attacks work, and why our tool, Einstein…
8337
SourMint Malicious SDK
The Snyk security research team has made two significant disclosures surrounding the Mintegral SDK. Learn about these SourMint vulnerabilities.
8338
A Hidden Cost of Ransomware: Wholesale Password Theft
Organizations in the throes of cleaning up after a ransomware outbreak typically will change passwords for all user accounts that have access to any email systems, servers and desktop workstations within their network. But all too often, ransomware victims fail to grasp that the crooks behind these attacks can and…
8339
SSH key and passwordless login basics for developers
SSH keys are useful to login over ssh (secure shell) without typing a password. They are also used by Github and other version control systems for passwordless authentication. Here is some basic information from the software developer point of view how to use SSH keys for maximum comfort and security. These…
8340
“Please do not make it public” (Tencent’s Sogou Input Method)
In this report, we analyze the Windows, Android, and iOS versions of Tencent’s Sogou Input Method, the most popular Chinese-language input method in China. Our analysis found serious vulnerabilities in the app’s custom encryption system and how it encrypts sensitive data. These vulnerabilities could allow a network…