121
I Went to SQL Injection Court
Chicago argued that answering a FOIA request with a database query means creating a new record. Matt Chapman sued, I wound up on the stand explaining SQL, and now there's a bill to fix it.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,762 posts.
122
Confirmed: The NSA is Spying on Millions of Americans
Today, the Guardian newspaper confirmed what EFF (and many others) have long claimed: the NSA is conducting widespread, untargeted, domestic surveillance on millions of Americans. This revelation should end, once and for all, the government's long-discredited secrecy claims about its dragnet...
123
Amazon threatens to suspend Signal's AWS account over censorship circumvention
Last week, we received the following email from Amazon: From: [redacted], [redacted] <[redacted]@amazon.com> Subject: Notification of potential account suspension regarding AWS Service Terms Moxie, Yesterday AWS became aware of your GitHub and Hacker News/ycombinator posts des...
124
125
Are Xiaomi browsers spyware? Yes, they are (2020)
Xiaomi browsers collect not merely your browsing history but also searches, downloads, YouTube videos watched and much more.
126
Tech-savvy audiences block Google Analytics
Is Google Analytics still useful and how accurate are its stats? How much data is missing from Google Analytics due to adblockers and privacy-friendly browsers?
127
Warp – Mobile VPN
Today we're excited to announce what we began to plan more than two years ago: the 1.1.1.1 App with WARP performance and security technology. We built Warp from the ground up to thrive in the harsh conditions of the modern mobile Internet.
128
LocationSmart Leaked Location Data for All Major U.S. Carriers in Real Time
On May 16th, I found a vulnerability in the LocationSmart website which allowed anyone, with no prior authentication or consent, to obtain the realtime location of any cellphone in the US to within…
129
A small number of samples can poison LLMs of any size
Anthropic research on data poisoning attacks shows a few hundred malicious documents can "backdoor" large language models of any size.
130
Apple's git still trusts the compromised eMudhra certificates
Eleven days after Apple was notified of the eMudhra CA compromise, the git, curl and python3 that Apple ships with macOS still trust the compromised certificates.
131
Block YouTube ads on AppleTV by decrypting and stripping ads from Profobuf
Apple TV and iOS YouTube ads are not blocked by Pi-hole, so I researched this and discovered a flaw in Protobuf that allows me to restrict YouTube ads.
132
Everyone knows all the apps on your phone
Until a few years ago, any app you installed on an Android device could see all other apps on your phone without your permission.
133
Someone bought 30 WordPress plugins and planted a backdoor in all of them
Last week, I wrote about catching a supply chain attack on a WordPress plugin called Widget Logic. A trusted name, acquired by a new owner, turned into
134
GrapheneOS – Break Free from Google and Apple
🇬🇧->🇵🇱 Przejdź do polskiej wersji tego wpisu / Go to polish version of this post
135
Use of Google Analytics declared illegal by French data protection authority
In reaction to the invalidation of the Privacy Shield in July 2020 by the Court of Justice of the European Union (CJEU), US President Joe Biden adopted on 7 October 2022 a new legal framework (Executive Order) to strengthen safeguards on the collection and use of personal data by US intelligence agencies.
136
Let's Encrypt Has Issued a Billion Certificates
We issued our billionth certificate on February 27, 2020. We’re going to use this big round number as an opportunity to reflect on what has changed for us, and for the Internet, leading up to this event. In particular, we want to talk about what has happened since the last time we talked about a big round number of…
137
eMudhra to exit global SSL/TLS certificate business
eMudhra Limited (BSE: 543533 | NSE: EMUDHRA), a global digital trust company, today announced that its Board has decided to voluntarily withdraw from the global SSL/TLS certificate business.
138
How to gain code execution on hundreds of millions of people and popular apps
how to gain code execution on millions of people and hundreds of popular apps
139
How we got read access on Google’s production servers
This is the original writeup on how Detectify security researchers gained read access on Google's production servers.
140
PyPI Was Subpoenaed
The PSF received three subpoenas from the US Department of Justice for PyPI user data in March and April of 2023.
141
The 'papers, please' era of the internet will decimate your privacy
Americans, be warned: Age verification is identity verification.
142
Passkeys are a trap
Intended audience: non-technical citizens of the web
143
Stripe records user movements on its customers' websites
An investigation into how Stripe tracks your users and what you can do to prevent it
144
Our First Certificate Is Now Live
Let’s Encrypt passed another major milestone by issuing our first certificate. You can see it in action here. Our cross signature is not yet in place, however this certificate is fully functional for clients with the ISRG root in their trust store. When we are cross signed, approximately a month from now, our…
145
Today, we hacked what we'd set out to hack: the iPhone
Today, we hacked what we'd set out to hack: the iPhone.
146
Apple sues NSO Group to curb the abuse of state-sponsored spyware
Apple today filed a lawsuit against NSO Group to hold it accountable for abusive surveillance and the targeting of a small number of Apple users.
147
GLM 5.2 beats Claude in our benchmarks
Among models given nothing but a prompt, the best open-weight option beat Claude Opus 4.8.
148
149
ChatControl: EU wants to scan all private messages, even in encrypted apps
The EU is pushing legislation that would scan all our private messages, even in encrypted apps.
150
