2041
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,767 posts.
2042
Valve bans 40k Dota 2 accounts using honeypot patch
Today, we permanently banned over 40,000 accounts that were using third-party software to cheat in Dota over the last few weeks. This software was able to access information used internally by the Dota client that wasn't visible during normal gameplay, giving the cheater an unfair advantage. While fixing the…
2043
2044
GPT-6 Astra covertly underperforms on safety research
Research on aligning AI with human values and intent, and reports documenting model failures.
2045
Opening up ‘Zero-Knowledge Proof’ technology
Today, we open sourced our Zero-Knowledge Proof (ZKP) libraries, fulfilling a promise and building on our partnership with Sparkasse to support EU age assurance.
2046
Mitigating the Hetzner/Linode XMPP.ru MitM interception incident
(If you just want some recommendations for what to do, skip down to the Recommendations section below .)
2047
Extracting Qualcomm's KeyMaster Keys – Breaking Android Full Disk Encryption
A security blog focusing on Android, the Linux Kernel and everything nice.
2048
Italian Anti-Corruption Authority Adopts Onion Services
Anonymity technologies are becoming a legal requirement for public agency and corporate anti-corruption compliance.
2049
What's OAuth2, anyway?
Why the OAuth2 protocol was designed the way it is and how it works.
2050
2051
WInd3x, the iPod Bootrom exploit 10 years too late
This is a write-up of the wInd3x bootrom exploit affecting iPod Nanos from 3rd gen to 5th gen. A ready-made tool to use this exploit is available at github.com/freemyipod/wInd3x .
2052
AdGuard publishes the first ad blocker built on Manifest V3
We put a lot of effort into developing an experimental browser extension that could meet all the requirements of Manifest V3 (Chrome's new extension API) and block ads properly within its tight confines. Read the article to find out what we went through and what we achieved.
2053
Deprecating Non-Secure HTTP
Today we are announcing our intent to phase out non-secure HTTP. There's pretty broad agreement that HTTPS is the way forward for the web. In recent months, there have been ...
2054
Microsoft Teams: 1 feature, 4 vulnerabilities
Microsoft Team's link preview feature is susceptible to spoofing and vulnerable to Server-Side Request Forgery. Team's Android users can be DoS'ed and, in the past, their IP address could be leaked.
2055
Humans missed 1 in 3 threats approving AI agent commands across 40k game runs
Results from AI agent permission game: which attacks beat human reviewers, and which safe commands got blocked instead.
2056
2057
Sharing National Security Letters with the Public
*On August 10, 2017, we updated this post with additional National Security Letters (NSLs) we received where, either through litigation or legislation, we have been free…
2058
Equifax Breach Fallout: Your Salary History
In May, KrebsOnSecurity broke a story about lax security at a payroll division of big-three credit bureau Equifax that let identity thieves access personal and financial data on an unknown number of Americans. Incredibly, this same division makes it simple to access detailed salary and employment history on a large…
2059
Finding bugs in SQLite, the easy way
SQLite is probably the most popular embedded database in use today; it is also known for being exceptionally well-tested and robust. In co...
2060
Azure's Weakest Link – Five Full Cross-Tenant Compromises
In my previous blog posts, Azure’s Weakest Link? and Azure’s Weakest Link - Full Cross-Tenant Compromise, I gave an overview of the severely insecure architecture behind API Connections in Azure, a part of Azure Logic Apps, and an instance of a full cross-tenant compromise using these inherent flaws. Now I am back…
2061
2062
Little Snitch and the deprecation of kernel extensions
You probably came here because your Mac showed a message telling you that software from “Objective Development Software GmbH” (Little Snitch) loaded a system extension that will no longer be compatible with a future version of macOS and that you…
2063
The cleverest floppy disc protection ever? Western Security Ltd
Introduction I've been on a bit of a floppy disc protection odyssey recently. This will probably be the last floppy disc related post for so...
2064
Police search homes of Zwiebelfreunde board members and OpenLab in Augsburg
On June 20th, board members of the „Zwiebelfreunde“ association in multiple German cities had their homes searched under the dubious pretence that they were „witnesses“ while their computers and...
2065
Critical Security Issue Identified in iTerm2
A security audit funded by Mozilla has discovered a critical security vulnerability in the widely used macOS terminal emulator iTerm2.
2066
Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges
Posted by Mark Seaborn, sandbox builder and breaker, with contributions by Thomas Dullien, revers...
2067
How I tripped over the Debian weak keys vulnerability
Those of you who haven’t been in IT for far, far too long might not know that next month will be the 16th(!) anniversary of the disclosure of what was, at the time, a fairly earth-shattering revelation: that for about 18 months, the Debian OpenSSL package was generating entirely predictable private keys .
2068
Basic Intro to Elliptic Curve Cryptography (2019)
Learn cryptography in Go by building ciphers, hashes, password security, and encryption tools. Understand security beneath the library call.
2069
Reverse engineering a custom CPU from a single program
or: reverse-engineering a custom, unknown CPU from a single programtl;dr: We reverse-engineered a program written for a completely custom, unknown CPU architecture, without any documentation for th…
2070
