8581
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,776 posts.
8582
8583
Advanced cryptographic ratcheting
At Open Whisper Systems, we’ve been working on improving our encrypted asynchronous chat protocol for TextSecure. The TextSecure protocol was originally a derivative of OTR, with minor changes to accommodate it for transports with constraints like SMS or Push. Some of the recent changes we’ve ...
8584
CRLite: Certificate Revocation Checking in Firefox
Firefox is now the first and the only browser to deploy fast and comprehensive certificate revocation checking that does not reveal your browsing activity to anyone (not even to Mozilla). ...
8585
8586
Critical Security Vulnerability in React Server Components
The library for web and native user interfaces
8587
Tracking Down a Stolen iPhone
( Note: some screenshots are quite obviously simulated. ) ( Note 2: this is my first blog post in over three years, feel free to read my ancient history if you like. ) ( Note 3: All said and done, the comments and Internet-fame have been awesome. I'm moving on though. If you're interested, check…
8588
8589
8590
Public key pinning coming in Chrome 13
Starting with Chrome 13, we'll have HTTPS pins for most Google properties. This means that certificate chains for, say, https://www.google.com , must include a whitelisted public key. It's a fatal error otherwise. Credit goes to my colleague, Chris Evans, for much of this.
8591
8592
8593
8594
Apple Rejects EFF Updates App, because it links "objectionable" youtube video
Last month, EFF got an email from software developer Duane Fields of Exact Magic, asking if he could use our logo on an iPhone application that exclusively displays content from EFF's RSS feed. Sounded like a great idea to us, as long as it was clear that the app wasn't an EFF-sponsored product.But...
8595
8596
Block AI Scrapers with Anubis proof-of-work
I got tired with all the AI scrapers that were bullying my git server, so I made a tool to stop them for good.
8597
Stop Password Masking
Usability suffers when users type in passwords and the only feedback they get is a row of bullets. Typically, masking passwords doesn't even increase security, but it does cost you business due to login failures.
8598
Faking votes on Hacker News
Hacker News is a site where users vote on links. When someone clicks on an up or down vote, their browser sends a GET request that looks like this: GET /vote?by= joesmith dir=upfor=8765309 A user can only vote if the by parameter matches their Hacker News login cookie. So for a third…
8599
I've Seen the Future, and It Has a Kill Switch
It used to be that just the entertainment industries wanted to control your computers—and televisions and iPods and everything else—to ensure that you didn’t violate any copyright rules. But now everyone else wants to get their hooks into your gear. OnStar will soon include the ability for the police to shut off your…
8600
8601
8602
Encrypt-then-MAC
First things first: Why use a composition of encryption and MAC instead of a single primitive which achieves both? Because people are very good at writing bad code. In my experience on the FreeBSD security team, writing dozens of security advisories, there are three types of code which are especially prone to have…
8603
Chrome phasing out Manifest v2 support from Jan 2022
Details of the Manifest V2 phase-out and end of life.
8604
Creative anti-debugger technique in Spotify for Windows
Spotify for Windows contains code so awesome that OllyDbg can't look at it without crashing.
8605
Countering Trusting Trust Through Diverse Double-Compiling (DDC)
David A. Wheeler's Page on Countering 'Trusting Trust' through Diverse Double-Compiling (DDC) - Countering Trojan Horse attacks on Compilers
8606
You Don't Want XTS
XTS is the de-facto standard disk encryption mode, which makes it look like a good general-purpose one. It isn't. What disk encryption actually promises, and why XTS's guarantees don't travel.
8607
Web Cryptography API posted as W3C working draft
This specification describes a JavaScript API for performing basic cryptographic operations in web applications, such as hashing, signature generation and verification, and encryption and decryption. Additionally, it describes an API for applications to generate and/or manage the keying material necessary to perform…
8608
8609
8610
Why What3Words is not suitable for safety critical applications
What3Words is a widely promoted system that is used for sharing a location using just three words. For example, ///wedge.drill.mess is located in Hyde Park.The globe is divided into 3m squares, eac…