Topics /
The most popular blog posts about security & privacy on Hacker News. 8,775 posts.
In this report, we analyze the Windows, Android, and iOS versions of Tencent’s Sogou Input Method, the most popular Chinese-language input method in China. Our analysis found serious vulnerabilities in the app’s custom encryption system and how it encrypts sensitive data. These vulnerabilities could allow a network…
Description of what we have learned
Adobe had a little issue the other day with the small matter of 150 million accounts being breached and released to the public. Whoops. So what are we talking about? A shed load of records containing an internal ID, username, email, encrypted password and a password hint. Naked Security did
Dismantling a Shoddy Malware Operation The Discovery I had been made aware of a malware spreading site called obspremium.com. This site is claiming to offer a so-called “premium” version of the popular open source recording and streaming program Open Broadcaster Software at obsproject.com. “OBS Premium” hosts a direct…
The MIKEY-SAKKE protocol is being promoted by the UK government as a better way to secure phone calls. The reality is that MIKEY-SAKKE is designed to offer minimal security while allowing undetectable mass surveillance, through the introduction a backdoor based around mandatory key-escrow. This weakness has…
The conventional wisdom is that hashing more entropy sources can't hurt: if H is any modern cryptographic hash function then H(x,y,z) is at least as good a random number as H(x,y), no matter how awful z is. So we pile one source on top of another, hashing them all together and hoping that at least one of them is good.
On the irony of cameras built to police Iranians becoming the regime’s Achilles’ heel
At the heart of Edward Snowden's decision to expose the NSA's massive phone and Internet spying programs was a fundamental belief in the people's right-to-know. "My sole motive is to inform the public as to that which is done in their name and that which is done against them," he …
Huawei has seemingly stepped its foot into the kernel self-protection game with the release of HKSP. Absent any threat model and riddled with weaknesses, it also introduces a trivially exploitable local root vulnerability due to a complete lack of defensive programming.
For decades, social psychologists have understood that the link between attitudes and conduct is convoluted, if not weak. Both online and offline, this is
UPDATE 5/28: We are going to resume the rollout with the stable release of Chrome M84. More details . With the stable release of Chrome 8...
Add Two-Factor Authentication To Your Website with Google Authenticator and Twilio SMS
shysecurity blog
Looking for a way to help the Internet stay open and free? This topic needs some dedicated...
Reverse-engineering an obfuscated American Express phishing campaign from email to exfiltration endpoint.
Firefox has had support for Google's Safe Browsing since 2005 when it started as a stand-alone Firefox extension . At first it was only available in the USA, but it was opened up to the rest of the world in 2006 and moved to the Google Toolbar . It then got integrated directly into Firefox 2.0 before the public launch…
Access to this page requires authorization. You can try signing in or changing directories .
polkit is a system service installed by default on many Linux distributions. It’s used by systemd, so any Linux distribution that uses systemd also uses polkit.
San Francisco—The Electronic Frontier Foundation (EFF) filed a Freedom of Information (FOIA) lawsuit today against the Justice Department to shed light on whether the government has ever used secret court orders to force technology companies to decrypt their customers’ private communications, a...
Over the past few weeks, Zoom’s use has exploded since it became the video conferencing platform of choice in today’s COVID-19 world. (My own university, Harvard, uses it for all of its classes. Boris Johnson had a cabinet meeting over Zoom.) Over that same period, the company has been exposed for having both lousy…
This post is about the reason I will probably never try to warn any organisation in Belgium about any vulnerability again. Recently I have been dealing with an attempt at coordinated vulnerability disclosure (CVD) with an organisation in Belgium. This post is not about that, because I’m not allowed to write about it…
Age verification laws are proliferating fast across the United States and around the world, creating a dangerous and confusing tangle of rules about what we’re all allowed to see and do online. That's why today, we're launching EFF.org/Age, a one-stop shop for users seeking to understand what these laws actually do…
