Topics /
The most popular blog posts about security & privacy on Hacker News. 717 posts.
Update 5/29: Mullvad has begun rolling out a mitigation feature on their servers that scrambles exit IP positions, thereby fixing this issue. IPs are still deterministically selected based on the pubkey. Mullvad is one of the few VPN providers that offers multiple exit IPs for its servers. If two people connect to the…
Viva.com, one of Europe's largest payment processors, sends verification emails without a Message-ID header — a requirement of RFC 5322 since 2008. Google Workspace rejects them outright. Their support team's response to my detailed bug report: your account has a verified email, so there's no problem.
Railway detected anomalous activity involving systems that store customer environment variables and recommends your immediate attention
Lapsus$ posted Mercor on its leak site. Voice biometrics plus ID documents in one bundle is a deepfake-ready kit. Here is what to do.
A series of unfortunate agents.
LiteLLM 1.107.0 on PyPI ships a .pth credential stealer and a sitecustomize.py backdoor that run on every Python start. How the implant got in, what it steals, and indicators of compromise.
I've always had a soft spot for this particular car brand. Our family has owned a few of them over the years, and they've served us incredibly well. In 2023, I bought a new four wheel drive/SUV from them, and it was the first time I had
So-called age verification for social media is spreading across the world, framed as an effort to create a safer internet for children. In reality, age verification lays the foundation for a fully government controlled internet.
There’s only so much room on your screen. Pop-ups, overlays, and ads can take over fast, getting between you and what you came to do. That’s where
This story is wild. The short version: OpenAI were running a cybersecurity test against an unreleased model, with the model’s guardrail features turned off. Rather than solve the test, the …
Meet motorola signature 27, Motorola's most advanced flagship smartphone ever with next-gen AI, industry-leading tech, & a distnctive design.
OverviewA long while back I had an idea to hack a WiFi smart light bulb to do something more useful to me. Actually, I had a few different ideas of things to do with them. One of these ideas was to mo…
Chrome uses Gemini AI to automate vulnerability discovery, triage, and patching, accelerating updates to match modern security risks.
Git 3.0 will make SHA-256 the new default content hashing algorithm and it will be an incomprehensibly expensive and ultimately valueless and avoidable global nightmare.
AISI’s tests of Mythos suggest a new security economy: to harden a system you must spend more tokens finding exploits than attackers do.
The one where I get very annoyed with my email provider.
A compromised release of the popular Rust crate arrayref pulled in a typosquatted proc-macro1 whose build script downloads and runs a remote binary at compile…
The leaked draft text suggests that the Commission significantly caved in to US’s excessive demands for unfettered information access.
Legal intern Raj Gambhir was the principal author of this post.Update: On April 15, 2026 the FAA rescinded the TFR (FDC 6/4375) and instead issued an advisory (FDC 6/2824), which states: [Drone] operators are advised to avoid flying in proximity to: Department of War (DOW), Department of Energy (...
As one of the managers of the Digital Dissident Devroom , I invite you to be part of a conversation we cannot afford to ignore.
The risk that cryptographically-relevant quantum computers materialize within the next few years is now high enough to be dispositive, unfortunately.
This, if it is still visible: Via: Next up, age verification for ADSB?
Heads-up: An update to this article has been posted. There have been a lot of complaints about both the competency and the logic behind the latest Epstein archive release by the DoJ: from censoring…
This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. We call the technique AdFection, and show how it was used to infect devices at Al Jazeera with Candiru’s spyware. We also uncover Discover-Tech, and show how the company helps mercenary surveillance vendors track and…
Noma Labs found a prompt injection flaw in GitHub Agentic Workflows that let an unauthenticated attacker leak private repo data via a crafted GitHub Issue.
Building Bluehood, a Bluetooth scanner that reveals what information we leak just by having Bluetooth enabled on our devices.
Introducing Apple Reference Image, a new solution for verifiable photography on iPhone. This new, opt-in camera mode lets a photographer create a securely timestamped reference image that accurately depicts what was captured by the iPhone's camera sensor. Apple Reference Image offers a trustworthy, scalable guarantee…
A security issue in Omarchy’s default Docker configuration meant that essentially every program running in the user’s desktop session could escalate to root without a password, sudo, or a privilege prompt. If you use Omarchy, the most important takeaway is simple: update to 4.0.1. I reported this issue privately…
Court records belong to the public. Yet anyone seeking access to federal court filings through PACER, a government software system that stands for Public Access to Court Electronic Records, is usually required to pay hefty fees to search for and view documents. PACER’s fees have long acted as a...
Instant Linux microVMs with defense-in-depth security for running untrusted code.
