Topics /
The most popular blog posts about security & privacy on Hacker News. 8,767 posts.
Twice in the past month KrebsOnSecurity has heard from readers who had their accounts at big-three credit bureau Experian hacked and updated with a new email address that wasn’t theirs. In both cases the readers used password managers to select strong, unique passwords for their Experian accounts. Research suggests…
Over the last century, the Land of the Free has slowly transformed into a land governed by endless laws, largely by cracking down on vices instead of actual crimes, creating a society that would render us all criminals if our behavior were constantly observed. Meanwhile, the state has steadily expanded its use of mass…
A blog about software craft and quality
I would like to thank Microsoft product teams and Microsoft Security Response Center (MSRC) for collaborating with me on this technical analysis and mitigation of the disclosed vulnerabilities. The editorial opinions reflected below are solely the author’s and do not necessarily reflect those of the organizations I…
Kaspersky GReAT experts discovered previously undocumented infection chains used in the Notepad++ supply chain attacks. The article provides new IoCs related to those incidents which employ DLL sideloading and Cobalt Strike Beacon delivery.
For decades, I have been talking about the importance of individual privacy. For almost as long, I have been using the metaphor of digital feudalism to describe how large companies have become central control points for our data. And for maybe half a decade, I have been talking about the world-sized robot that is the…
Today we’re launching AWS Secrets Manager which makes it easy to store and retrieve your secrets via API or the AWS Command Line Interface (AWS CLI) and rotate your credentials with built-in or custom AWS Lambda functions. Managing application secrets like database credentials, passwords, or API Keys is easy when…
Today I'm disclosing a macOS privacy protections bypass. (You may recall that I disclosed another one last year .) The privacy protections system (also known as TCC: Transparency, Consent, and Control) was introduced in macOS Mojave, and one of its purposes is to protect certain files on your Mac from access by…
UPDATE: Add the IRS to the list of federal agencies obtaining information from NSA surveillance. Reuters reports that the IRS got intelligence tips from DEA's secret unit (SOD) and were also told to cover up the source of that information by coming up with their own independent leads to recreate...
TL;DR: Instagram ($2000), Google ($0) and Microsoft ($500) were vulnerable to direct money theft via premium phone number calls. They all offer services to supply users with a token via a computer-voiced phone call, but neglected to properly verify whether supplied phone numbers were legitimate, non-premium numbers…
In September 2023, KrebsOnSecurity published findings from security researchers who concluded that a series of six-figure cyberheists across dozens of victims resulted from thieves cracking master passwords stolen from the password manager service LastPass in 2022. In a court filing this week, U.S. federal agents…
Reverse engineering the kernel-mode authenticity check, and how Microsoft knows about your hacked/custom hard-drive.
Welcome to The Nor, a series of essays by James Bridle commissioned by the Hayward Gallery in 2014/5. In order, the essays are: All Cameras Are Police Cameras , Living in the Electromagnetic Spectrum , and Low Latency , as well as an Epilogue . These are accompanied by photographs and a map , and additional content…
Self-Managed OAuth is now available to all developers on Cloudflare. Here's how we executed a zero-downtime migration of our core OAuth engine to make it happen.
The Sophos Blog
This article explore Podman's features and benefits, comparing it to Docker and describing a step-by-step migration guide
A recent post received numerous comments asking why I was so concerned about privacy and asking what I have to hide. Here's my reply...
A low code optimization
Learn how IdentityLogger used fingerprinting to combat ban evasion, protecting our CSGO community from relentless cheaters.
Security testing starts with understanding vulnerabilities. The CVE website lists known software flaws. The OWASP Top Ten highlights common weaknesses. With this knowledge, we can improve our Go development. This article shows how to put in place robust practices. They are fuzz inputs, verify dependencies, and use…
A few months ago I wrote about a WhatsApp backdoor that allowed hackers to access all data on any phone running WhatsApp [1]. Facebook, its parent company, claimed at the time that they had no proof the flaw had ever been used by attackers [2]. Last week it became clear that this backdoor had been exploited to extract…
Ring founder Jamie Siminoff is back at the helm of the surveillance doorbell company, and with him is the surveillance-first-privacy-last approach that made Ring one of the most maligned tech devices. Not only is the company reintroducing new versions of old features which would allow police to...
The Online Safety Bill has some genuinely good intentions, but the proposed legislation is remarkably poor.
