811
The Line of Death
When building applications that display untrusted content, security designers have a major problem— if an attacker has full control of a block of pixels, he can make those pixels look like anything…
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,762 posts.
812
Pixel phones are sold with bootloader unlocking disabled
Request to Google : ungrey the “OEM unlocking” toggle in the factory, before shipping store.google.com devices to customers. Do not make your customers connect the device to the Internet before they are allowed to install the operating system they want.
813
The S in IoT is for Security
Purism makes premium phones, laptops, mini PCs and servers running free software on PureOS. Purism products respect people's privacy and freedom while protecting their security.
814
The Facebook phone numbers are now searchable in Have I Been Pwned
The headline is pretty self-explanatory so in the interest of time, let me just jump directly into the details of how this all works. There's been huge interest in this incident, and I've seen near-unprecedented traffic to Have I Been Pwned [https://twitter.com/troyhunt/status/
815
816
Intuit to share payroll data from 1.4M small businesses with Equifax
Financial services giant Intuit this week informed 1.4 million small businesses using its QuickBooks Online Payroll and Intuit Online Payroll products that their payroll information will be shared with big-three consumer credit bureau Equifax starting later this year unless customers opt out by the end of this month.
817
818
I hate password rules
The other day, I was creating a new account on the web. It was financial in nature, which means it gets one of my most secure passwords. I used Password Safe to generate this 16-character alphanumeric password: :s^Twd.J;3hzg=Q~ Which was rejected by the site, because it didn’t meet its password security rules. It took…
819
NSA's Backdoor Key from Lotus Notes (2002)
Before the US crypto export regulations were finally disolved the export version of Lotus Notes used to include a key escrow / backdoor feature called differential cryptography. The idea was that they got permission to export 64 bit crypto if 24 of those bits were encrypted for the NSA's public key. The NSA would then…
820
California law enforcement misused state databases more than 7k times in 2023
The Los Angeles County Sheriff’s Department (LACSD) committed wholesale abuse of sensitive criminal justice databases in 2023, violating a specific rule against searching the data to run background checks for concealed carry firearm permits.The sheriff’s department’s 6,789 abuses made up a majority...
821
Federal appeals court finds geofence warrants “categorically” unconstitutional
In a major decision on Friday, the federal Fifth Circuit Court of Appeals held that geofence warrants are “categorically prohibited by the Fourth Amendment.” Closely following arguments EFF has made in a number of cases, the court found that geofence warrants constitute the sort of “general,...
822
How the Bitcoins Were Stolen from Mt. Gox [video]
The thought “I know PHP! How hard could running an exchange be?” never goes anywhere good.
823
Are Apple gift cards safe to redeem?
Link to: https://tidbits.com/2025/12/17/compromised-apple-gift-card-leads-to-apple-account-lockout/
824
An iframe from googlesyndication.com tries to access the camera and microphone
The last thing we want is for an advertising network to access the Camera or Microphone on our computer. But, while looking for something else, I stumbled upon messages in the Safari JavaScript console saying that an iframe loaded from safeframe.googlesyndication.com tried to do exactly that.
825
Cybersecurity looks like proof of work now
AISI’s tests of Mythos suggest a new security economy: to harden a system you must spend more tokens finding exploits than attackers do.
826
Serious Intel CPU bugs (2016)
2015 was a pretty good year for Intel. Their quarterly earnings reports exceeded expectations every quarter. They continue to be the only game in town for the serious server market, which continues to grow exponentially; from the earnings reports of the two largest cloud vendors, we can see that AWS and Azure grew by…
827
The most popular docker images each contain at least 30 vulnerabilities
we found that 44% of docker image scans had known vulnerabilities, and for which there were newer and more secure base image available. Most vulnerabilities originate in the base image you selected. For that reason, remediation should focus on base image fixes.
828
Proposal: Treat FLoC as a security concern
Google is rolling out Federated Learning of Cohorts (FLoC) for the Chrome browser. TL;DR: FLoC places people in groups based on their browsing habits to target advertising. Why is this bad? As the …
829
830
Windows Defender is enough, if you harden it
This article is not intended to convince you to abandon your current antivirus solutions. In this post I would like to share my observations and ways to improve the effectiveness of Defender. You don’
831
832
Dorking: the use of search engines to find very specific data
tl;dr: Use advanced Google Search to find any webpage, emails, info, or secrets cost: $0 time: 2 minutes Software engineers have long joked about how much of their job is simply Googling things Now you can do the same, but for free Below, I'll cover dorking, the use of …
833
The .feedback scam
Do you have feedback you'd like to give to Google, Facebook, StackOverflow, Inc., or Gandi? Now there's a website that will collect that feedback. Or... not.
834
LastPass Disclosure Shows Why We Can't Have Nice Things
Response to the media's hysteria surrounding LastPass' responsible security warning.
835
What would you do if you lost your Google account?
What happens when you forget your password or loose your phone? What Google wants to know to validate your identity?
836
Sign in with Google in Chrome
Many websites such as Yelp show an annoying “Sign in with Google” banner when you visit.
837
PuTTY vulnerability vuln-p521-bias
Home | FAQ | Feedback | Licence | Updates | Mirrors | Keys | Links | Team Download: Stable · Snapshot | Docs | Privacy | Changes | Wishlist
838
Proton spam and the AI consent problem
The one where I get very annoyed with my email provider.
839
Riot Games Approach to Anti-Cheat
Combating cheats is an ever-evolving arms race. The scope and complexity of cheat development grows every year along with the stakes in online gaming. The pressure is on for game studios to level up when it comes to detecting and preventin…
840