1381
Privacy is the most important concept of our time
Privacy is more than the right of an individual to be left alone. It concerns the very fabric of society.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,767 posts.
1382
Stop donating your customers' data to Google Analytics
In 2020, with better alternatives available, using Google Analytics (GA) to track your web usage is n...
1383
Today, Europe Lost The Internet. Now, We Fight Back
Today, in a vote that split almost every major EU party, Members of the European Parliament adopted every terrible proposal in the new Copyright Directive and rejected every good one, setting the stage for mass, automated surveillance and arbitrary censorship of the internet: text messages like...
1384
PingCap TiDB Leaks
PingCAP Inc. / TiDB Cloud • Distributed databases • 10.6 TB total exfiltration • 200 GB stage one release
1385
Backdooring Your Backdoors – Another $20 Domain, More Governments
After the excitement of our .MOBI research, we were left twiddling our thumbs. As you may recall, in 2024, we demonstrated the impact of an unregistered domain when we subverted the TLS/SSL CA process for verifying domain ownership to give ourselves the ability to issue valid and trusted TLS/
1386
Node.js packages don't deserve trust
Another week, another npm supply chain attack . Yikes! People on hacker news are wringing their hands about what should be done. The problem seems dire.
1387
Third High Severity CVE in Log4j Is Published
The Logging Services Security Team takes security seriously. This allows our users to place their trust in Log4j for protecting their mission-critical data. On this page, we will help you find guidance on security-related issues and access to known vulnerabilities.
1388
A Message about iOS Security
iOS security is unmatched because we take end-to-end responsibility for the security of our hardware and software.
1389
Vanishing from Hyundai’s data network
Finding and disabling the cellular modem for BlueLink in the Kona EV
1390
China is blocking all language editions of Wikipedia
translation: 中国封锁了所有语言版本的维基百科 China recently started blocking all language editions of Wikipedia. Previously, the blocking was limited to the Chinese language edition of Wikipedia (zh.wikipedia.org), but has now expanded to include all *.wikipedia.org language editions. In this post, we share OONI network measurement…
1391
Unauthenticated remote code execution in OpenCode
OpenCode is an open-source AI coding assistant. Prior to v1.1.10, it automatically spawned an HTTP server (default port 4096+) on startup. Since v1.1.10, the server is disabled by default but can be enabled via command-line flags or configuration file. When running, the server exposes endpoints for:
1392
Telling the Truth About Defects in Technology Should Never Be Illegal
Congress has never made a law saying, "Corporations should get to decide who gets to publish truthful information about defects in their products,"— and the First Amendment wouldn't allow such a law — but that hasn't stopped corporations from conjuring one out of thin air, and then defending it as...
1393
Moving your SSH port isn’t security by obscurity
I just came across another post on Hacker News talking about why you shouldn’t move your SSH port off of 22 because it’s Security by Obscurity. Ther
1394
Microsoft Kills off ISVs by Foisting Its Own Products That Are No Better
Hi Folks! Meet David, the magnificent masterpiece sculpted by Michelangelo at the start of the 16th century. A photo of his face with that curious furrowed brow featured on our very first anti-cyber…
1395
Hoax email blast abused poor coding in FBI website
The Federal Bureau of Investigation (FBI) confirmed today that its fbi.gov domain name and Internet address were used to blast out thousands of fake emails about a cybercrime investigation. According to an interview with the person who claimed responsibility for the hoax, the spam messages were sent by abusing…
1396
1397
Image Scaling Attacks
This post is part of a series about machine learning and artificial intelligence. Click on the blog tag “huskyai” to see related posts. Overview: …
1398
Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS
Math.tanh, every CSS trig function, and the Web Audio compressor all route through the host libm, so the rounding of a cosine betrays the OS a browser actually …
1399
AI is breaking two vulnerability cultures
A week ago the Copy Fail vulnerability came out, and Hyunwoo Kim immediately realized that the fixes were insufficient, sharing a patch the same day. In doing this he followed standard procedure for Linux, especially within networking: share the security impact with a closed list of Linux security engineers, while…
1400
Rook to XSS: How I hacked chess.com with a rookie exploit
Playing Chess is one of the many hobbies I like to do in my spare time, apart from tinkering around with technology. However, I'm not very good at it, and after losing many games, I decided to see if I could do something I'm much better at; hacking the system!
1401
My Lethal Trifecta talk at the Bay Area AI Security Meetup
I gave a talk on Wednesday at the Bay Area AI Security Meetup about prompt injection, the lethal trifecta and the challenges of securing systems that use MCP. It wasn’t …
1402
Running a fake power plant on the internet for a month
There is a lot more on the internet than just social media and banking websites…
1403
Things to know about the GDPR, Mozilla and Firefox
Has your email inbox been filling up with privacy policy updates? It seems like every service, app or subscription I’ve signed up for (including more tha
1404
Down the Rabbit-Hole
Posted by Tavis Ormandy, Security Research Over-Engineer.“Sometimes, hacking is just someon...
1405
Update: YouTube-dl reinstated thanks to EFF (2020)
In October, the popular and famous archivist tool youtube-dl was taken down by GitHub due to a DMCA request by the Recording Industry Association of America. I posted a detailed analysis explaining the relation between international, US, EU and German law, and showing why this request was very different from what most…
1406
Standalone Signal Desktop
Signal Desktop is now available in a new, standalone form, and the Chrome App has been deprecated.
1407
1408
UK Authorities Destroy Guardian's Hard Drives
Fresh off the news that UK authorities detained the partner of Guardian journalist Glenn Greenwald for nine hours yesterday, Guardian editor-in-chief Alan Rusbridger has published an extraordinary report of government pressure and intimidation that should send chills down the spine of anyone who cares about a free…
1409
Espionage Against the European Parliament
We found that former Member of the European Parliament Stelios Kouloglou was hacked with Pegasus spyware while serving on the PEGA committee, which investigated Pegasus and other spyware abuses in Europe. Through forensic analysis of his device, we found that the attackers could have had access to confidential…
1410
Let’s Encrypt 2016 in Review
Our first full year as a live CA was an exciting one. I’m incredibly proud of what our team and community accomplished during 2016. I’d like to share some thoughts about how we’ve changed, what we’ve accomplished, and what we’ve learned. At the start of 2016, Let’s Encrypt certificates had been available to the public…