91
Bitwarden design flaw: Server side iterations
Bitwarden is a hot candidate for a LastPass replacement. Looking into how they encrypt data, it doesn’t do things that much better however.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 617 posts.
92
How mobile apps illegally share personal data
Some mobile apps share your personal data immediately after they're opened. This isn't compliant with EU privacy laws
93
Block: Inflated user metrics and “frictionless” fraud facilitation
Initial Disclosure: After extensive research, we have taken a short position in shares of Block, Inc. (NYSE: SQ). This report represents our opinion, and we encourage every reader to do their own due diligence. Please see our full disclaimer at the bottom of the report.
94
Statement on EU-US Cooperation on Turning Public Opinion Against Encryption
The members of the Global Encryption Coalition’s Steering Committee issued a statement on the EU-US collaboration against encryption.
95
When your classmates threaten you with felony charges
A few weeks ago, I was part of a talk at DEF CON 31 called The Hackers, The Lawyers, and the Defense Fund. I was asked to share my experience receiving a legal…
96
Want anonymity? Make a persona not a mystery
Derek Sivers official site. Thoughts on philosophy, culture, self-improvement. Author of Useful Not True, How to Live, Hell Yeah or No, Anything You Want.
97
Encrypting private data and private communications is now an ethical duty
We have come to a point where end-to-end encrypting all your private data and private communications
98
Google Authenticator now supports Google Account synchronization
Christiaan Brand, Group Product Manager We are excited to announce an update to Google Authenticator , across both iOS and Android, which a...
99
Debunking NIST's calculation of the Kyber-512 security level
[Sidney Harris cartoon used with permission. Copyright holder: ScienceCartoonsPlus.com .]
100
Is Gmail killing independent email?
People report that self-hosted emails always end up in Gmail spam. Is there anything Google can do about it?
101
102
Prompt injection: what’s the worst that can happen?
Activity around building sophisticated applications on top of LLMs (Large Language Models) such as GPT-3/4/ChatGPT/etc is growing like wildfire right now. Many of these applications are potentially vulnerable to prompt …
103
Tailscale Has Partnered with Mullvad
Since Tailscale was founded in 2019, customers have been forced to choose between either Tailscale or Mullvad without the ability for them to co-exist.
104
Google’s fully homomorphic encryption compiler – a primer
Back in May of 2022 I transferred teams at Google to work on Fully Homomorphic Encryption (newsletter announcement). Since then I’ve been working on a variety of projects in the space, including being the primary maintainer on github.com/google/fully-homomorphic-encryption, which is an open source FHE compiler for…
105
Belgium legalises ethical hacking
On 15 February 2023, Belgium saw the entering into force of a new ‘whistleblower’ law, which legalised ‘ethical hacking’ even for cases where the hacked entity did not consent to it. In order to benefit from such decriminalisation, the law poses a number of conditions for ethical hacking, that have to be fulfilled in…
106
Norwegian ban on Meta behavioral advertising extended to entire EU
Det europeiske personvernrådet har nå bestemt at det norske forbudet mot adferdsbasert markedsføring på Facebook og Instagram skal bli permanent og utvides til å gjelde hele EU/EØS.
107
How to Yubikey
How to use and configure a Yubikey
108
Twilio’s toll fraud problem
On New Years’ Day, I woke up to 40 emails from Twilio, each with the subject line of, “Your Twilio account has been recharged.” In total…
109
NIST Elliptic Curves Seeds Bounty
Announcing a $12,288 bounty (tripled to charity) for cracking the five seeds selected by the NSA in the '90s for the NIST elliptic curve standard.
110
Bitwarden PINs can be brute-forced
Video showing bitwarden. User then sets the pin 2345. The vault is locked and then bitwarden is quit. In the terminal the exploit program is run, which after a short while outputs the PIN 2345.
111
The WebP 0day
Early last week, Google released a new stable update for Chrome. The update included a single security fix that was reported by Apple's Security Engineering and Architecture (SEAR) team. The issue, CVE-2023-4863, was a heap buffer overflow in the WebP image library, and it had a familiar
112
WFH – Watched from Home: Office 365 and workplace surveillance creep (2022)
Imagine your performance at work was assessed directly from the amount of e-mails sent, the amount of time consumed editing a document, or the time spent in meetings or even moving your mouse. This may sound ludicrous but your boss might be doing exactly that.
113
SSH over HTTPS
Tl;DR: to pass SSH through HTTPS you need to tweak client and server sides as the following:
114
Hacking Google Bard – From Prompt Injection to Data Exfiltration
Recently Google Bard got some powerful updates, including Extensions. Extensions allow Bard to access YouTube, search for flights and hotels, and also to access …
115
ProtonMail Rewrites Your Emails
I switched to ProtonMail a few years back after getting fed up with Google. It’s been mostly acceptable, but a few months ago the Android client started mangling emails – if I hit “send” too soon, it would send out only part of what I’d typed; I had to wait 10 seconds or so after I finished typing before hitting send…
116
117
Brute-forcing a macOS user’s real name from a browser using mDNS
Exploring potential privacy vulnerabilities in Apple devices. This article discusses revealing a user's first name without permissions using the mDNS protocol.
118
Android 14 introduces cellular connectivity security features
Posted by Roger Piqueras Jover, Yomna Nasser, and Sudhi Herle Android is the first mobile operating system to introduce advanced cellular...
119
AI and Mass Spying
Spying and surveillance are different but related things. If I hired a private detective to spy on you, that detective could hide a bug in your home or car, tap your phone, and listen to what you said. At the end, I would get a report of all the conversations you had and the contents of those conversations. If I hired…
120
EU's concealment of secret 'expert list' on CSAM regulation is maladministration
After a year-long inquiry, the EU Ombudsman recommends that the European Commission should monitor stages of progress in every Big Tech case that the Irish Data Protection Commission is responsible for.