1111
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,762 posts.
1112
1113
EFF sues the NSA Over Illegal Surveillance
firstunitarianvnsa-final.pdf
1114
CCPA Scam – Human subject research study conducted by Princeton University
Get ready for the CCPA compliance scams from Princeton.
1115
FBI Probes Service Selling 153M+ Drivers Licenses
A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphoning images collected by…
1116
TP-Link firmware sends six DNS requests and one NTP query every 5 seconds
A design flaw in TP-Link Wi-Fi repeater firmware causes it to waste an excessive amount of bandwidth on NTP timekeeping. DDoS’ed public NTP servers in the process.
1117
Don't use text pixelation to redact sensitive information
See why you should never use pixelation for redacting text and why it is a surefire way to get your data leaked. Learn from security researcher Dan Petro.
1118
G-3PO: A protocol droid for Ghidra, or GPT-3 for reverse-engineering
(A Script that Solicits GPT-3 for Comments on Decompiled Code)
1119
You don’t want to be on Cloudflare’s naughty list
My home IP ended up on Cloudflare’s naughty list for six days. Most websites and many apps loaded slowly, partially, or not at all. Just had to wait it out.
1120
I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M
Datatilsynet just fined Elkjop NOK 20 million (€1.8m) for the forced consent in its loyalty club — five years after I told their DPO it was unlawful.
1121
Shutting down our public encrypted DNS
Mullvad has operated public encrypted DNS (DoH) servers since 2022. They are unnecessary when using Mullvad VPN — traffic is already encrypted and Mullvad VPN's internal DNS handles all queries.
1122
Reversing UK mobile rail tickets
The UK has used small credit-card sized tickets to pay for train travel for years and years, since long before I was born — originally theAPTIS ticket1,which...
1123
1124
“Stylish” browser extension steals all your internet history
Before it became a covert surveillance tool disguised as an outstanding browser extension, Stylish really was an outstanding browser extension. It bestowed upon its users nothing less than the power to change the appearance of the internet. Its extensive bank of user-made skins gave bright websites a dark background…
1125
1126
A better zip bomb
This article shows how to construct a non-recursive zip bomb that achieves a high compression ratio by overlapping files inside the zip container. "Non-recursive" means that it does not rely on a decompressor's recursively unpacking zip files nested within zip files: it expands fully after a single round of…
1127
15,000 lines of verified cryptography now in Python
In November 2022, I opened issue 99108 on Python’s GitHub repository, arguing that after a recent CVE in its implementation of SHA3, Python should embrace verified code for all of its hash-related infrastructure.
1128
Motorola cell phones are regularly phoning home
If you have a Motorola Android device, there is a good chance it is silently sending a great deal of your personal information (including email addresses and passwords) to Motorola.
1129
Mitigations landing for new class of timing attack
Several recently-published research articles have demonstrated a new class of timing attacks (Meltdown and Spectre) that work on modern CPUs. Our internal experiments confirm that it is possible to use ...
1130
Mistral's Shieldstral: 3B open-weights model for multimodal moderation
Shieldstral introduces a 3B open-weights multimodal safety classifier that outperforms models up to 7x its size.
1131
Did the FBI Pay a University to Attack Tor Users?
The Tor Project has learned more about last year's attack by Carnegie Mellon researchers on the...
1132
I Inspected My Take-Home Interview Project. It Was a Whole Operation
Appaji, a Computer Science graduate from IIT Patna and former intern at Arista Networks, is a Software Engineer at Infinite Reality. Passionate about building innovative web experiences, with a strong interest in sustainable and customer-focused startups.
1133
Today Google is turning on tracking for many users that previously turned it off
Workspace admins can no longer deactivate Google activity tracking for their users, Google says this is helping people.
1134
De-Googling my phone
I’ve been a professional Free Software developer in the GNU/Linux area for 14 years now, and a hobbyist developer and user for much longer. For some reason that never extended much to the smartphone world, beyond running LineageOS on my older phones (my current Sony Xperia is still under warranty and I’m fine with the…
1135
1136
Bitwarden Acquires Passwordless.dev
Bitwarden has acquired European-based startup Passwordless.dev, a significant milestone in rounding out the Bitwarden commitment to offering open source, scalable, and secure passwordless solutions to every business and end user.
1137
How to Safely Store Your Users' Passwords in 2016
Salted Password Hashing with Argon2, Scrypt, Bcrypt, and PBKDF2
1138
The protester's guide to smartphone security
Your phone is an essential tool, but it also represents a huge risk to your privacy and security. Understanding these best practices when it comes to securing your smartphone will help keep you and your data safe.
1139
Truecrypt report
A few weeks back I wrote an update on the Truecrypt audit promising that we’d have some concrete results to show you soon. Thanks to some hard work by the NCC Crypto Services group, soon is n…
1140