1231
Lastpass Security Incident
Please refer to the latest article for updated information.nbs[..]
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,766 posts.
1232
Google Chrome Keystone is modifying /var symlink on non SIP Macs causing k-panic
Reports that some AVID Users Macs would no longer boot. It now may be that a Google Chrome Keystone update modifies /var on NON SIP Protected Macs.
1233
VPN – Very Precarious Narrative
A very long article about commercial VPNs, their marketing strategies, and the truth behind their privacy and security claims.
1234
With questionable copyright claim, Jay-Z orders deepfake parodies off YouTube
With a questionable claim to copyright, Jay-Z ordered two deepfake audio parodies of his voice off YouTube. I talked to the video's creator about the future of AI for creative expression.
1235
Prompt injection: what’s the worst that can happen?
Activity around building sophisticated applications on top of LLMs (Large Language Models) such as GPT-3/4/ChatGPT/etc is growing like wildfire right now. Many of these applications are potentially vulnerable to prompt …
1236
Falling through the KRACKs
The big news in crypto today is the KRACK attack on WPA2 protected WiFi networks. Discovered by Mathy Vanhoef and Frank Piessens at KU Leuven, KRACK (Key Reinstallation Attack) leverages a vulnerab…
1237
Examining a vintage RAM chip, I find a counterfeit with a different die inside
A die photo of a vintage 64-bit TTL RAM chip came up on Twitter recently, but the more I examined the photo the more puzzled I became. The c...
1238
Tailscale Has Partnered with Mullvad
Since Tailscale was founded in 2019, customers have been forced to choose between either Tailscale or Mullvad without the ability for them to co-exist.
1239
What Data Does Facebook Collect When I’m Not Using Facebook, and Why?
Explaining more about the information we get from other websites and apps; how we use the data they send to us; and the controls you have.
1240
I Followed the Official AWS Amplify Guide and Was Charged $1,100
An interesting thing happens when you follow the official Amplify guide.
1241
Going Dark, and the era of law enforcement hacking
I’m coming down from spending a few days at Usenix Security, right here in my hometown of Baltimore. This means that my days have been taken up with two kinds of conversation: first, explaini…
1242
Zero-Click Calendar invite vulnerability chain in macOS
Critical zero-click vulnerability chain in macOS (patched)
1243
Google AdWords Exploit Seen in the Wild
See the ad for ebay at the top of the results? Not particularly interesting, right?…
1244
Firefox Containers Preview
Today, we’re excited to announce the Preview of Containers in Firefox version 153, which lets you keep separate parts of your online life (work, shopping
1245
Logs in High Sierra Show Plaintext Password for APFS Encrypted External Volumes
UPDATE: PLEASE HELP ME TEST UPATE TO THE UPDATE: Similar log entries are now found in another system log that is more persistent, see the article here . UPDATE: This is still vulnerable on current versions of macOS 10.13.3 when encrypted an ALREADY EXISTING unencrypted APFS volume
1246
Password Managers
I’ve spent a lot of time trying to understand the attack surface of popular password managers. I think I’ve spent more time analyzing them than practically anybody else, and I think that qualifies me to have an opinion!
1247
USPS text scammers duped his wife, so he hacked their operation
How someone I don't know hacked the scammers back
1248
Linux Hardening Guide
Linux is not a secure operating system . However, there are steps you can take to improve it. This guide aims to explain how to harden Linux as much as possible for security and privacy. This guide attempts to be distribution-agnostic and is not tied to any specific one. DISCLAIMER: Do not attempt to apply anything in…
1249
Chrome's Plan to Distrust Symantec Certificates
Posted by Devon O’Brien, Ryan Sleevi, Andrew Whalley, Chrome Security This post is a broader announcement of plans already finalized on t...
1250
If you’re not using SSH certificates you’re doing SSH wrong (2019)
SSH has some pretty gnarly issues when it comes to usability, operability, and security. The good news is this is all easy to fix. SSH is ubiquitous. It’s the de-facto solution for remote administration of *nix systems. SSH certificate authentication makes SSH easier to use, easier to operate, and more secure.
1251
Re-entry to US without backscatter or pat-down
On November 21, 2010, I was allowed to enter the U.S. through an airport security checkpoint without being x-rayed or touched by a TSA officer. This post explains how.
1252
1253
Hacking into an insurance company by exploiting their premium calculator
A vulnerable API on Toyota Tsusho Insurance Broker India’s premium calculator website exposed Microsoft corporate cloud credentials.
1254
A picture got my PostgreSQL database to start mining Monero
A Deep Dive into Database Attacks [Part III]: Why Scarlett Johansson’s Picture Got My Postgres Database to Start Mining Monero
1255
Privacy doesn't mean anything anymore, anonymity does
Privacy is when they promise to protect your data. Anonymity is when they never had your data to begin with.
1256
Hacking Grindr Accounts with Copy and Paste
Sexuality, relationships and online dating are all rather personal things. They're aspects of our lives that many people choose to keep private or at the very least, share only with people of our choosing. Grindr [https://www.grindr.com/] is "The World's Largest Social Networking App for Gay,
1257
1258
Google’s fully homomorphic encryption compiler – a primer
Back in May of 2022 I transferred teams at Google to work on Fully Homomorphic Encryption (newsletter announcement). Since then I’ve been working on a variety of projects in the space, including being the primary maintainer on github.com/google/fully-homomorphic-encryption, which is an open source FHE compiler for…
1259
Using Ghidra and Python to reverse engineer Ecco the Dolphin
Re-routing the encryption
1260
Missouri Governor Vows to Prosecute St. Louis Post-Dispatch for Reporting
On Wednesday, the St. Louis Post-Dispatch ran a story about how its staff discovered and reported a security vulnerability in a Missouri state education website that exposed the Social Security numbers of 100,000 elementary and secondary teachers. In a press conference this morning, Missouri Gov. Mike Parson (R) said…