2131
Tell the EU: Don't Break Encryption with "Chat Control"
The EU’s Chat Control law would scan private messages and weaken encryption. Sign Mozilla Foundation’s petition to defend privacy and protect our digital future.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,767 posts.
2132
2133
Disclosing E2EE vulnerability in multiple Matrix clients
Matrix, the open protocol for secure decentralised communications
2134
2135
A Vulnerability in Libsodium
Libsodium is now 13 years old!
2136
Email addresses are not good 'permanent' identifiers for accounts
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
2137
Meta's ships facial recognition on smart glasses
Stella is the companion app for Meta's smart glasses. Inspecting version 273.0.0.21 of the Android build (com.facebook.stella), I found the entire computational and storage stack for on-device facial recognition: three face models, a local database schema, a cosine-similarity vector index dimensioned to
2138
My bank keeps on undermining anti-phishing education
TLDR: my bank sent out emails with websites which looked a lot like phishing mails, so much so that this similarity could potentially be used against them legally by potential phishing victims Discussion at hackernews: https://news.ycombinator.com/item?id=44592377 Chapter 1: You’ve got mail As I was writing my first…
2139
2140
OpenAI Adopts Google's SynthID Watermark for AI Images with Verification Tool
OpenAI advances AI content provenance with Content Credentials, SynthID, and a verification tool to help people identify and trust AI-generated media.
2141
Chained PHP2Shell exploit roots 25 servers, including US Government servers
Custom PHP2Shell Exploit Chained with Kernel LPE to Root Versions of Palo Alto Networks PAN-OS Firewalls in the Wild
2142
2143
FTC Report Confirms: Commercial Surveillance Is Out of Control
A new Federal Trade Commission (FTC) report confirms what EFF has been warning about for years: tech giants are widely harvesting and sharing your personal information to fuel their online behavioral advertising businesses.
2144
LibreSSL: More Than 30 Days Later
LibreSSL was officially announced to the world just about exactly five months ago. Bob spoke at BSDCan about the first 30 days. For those who weren't there, I'll quickly rehash some of that material. Also, it's always best to start at the beginning, but then I'll try to focus on some new material and updates.
2145
Pwning the Ladybird Browser
Ladybird is a relatively new browser engine originating from the SerenityOS project . Currently, it’s in pre-alpha and improving quickly. Take a look at the website and the GitHub for more information!
2146
Abolish the Department of Homeland Security
I have a love/hate relationship with the Cato Institute. Most of their analysis I strongly disagree with, but some of it I equally strongly agree with. Last September 11—the tenth anniversary of 9/11—Cato’s David Rittgers published “Abolish the Department of Homeland Security“: DHS has too many subdivisions in too…
2147
I use C when I believe in memory safety
I am using C for a professional project. I believe in memory safety. Yes, I'm a hypocrite, but please, let me explain.
2148
BusKill: A kill cord for your laptop
BusKill is a Kill Cord for your laptop implementing a Dead Man Switch using $20 in USB hardware + udev rule to trigger your laptop self-destruct if stolen.
2149
We got admin access to Baseten's production GitHub
We gave Strix a domain. In 25 minutes, it found a live token with admin access to Baseten's product, deployment, and CLI repos in a public Docker image.
2150
Every Signature Is Broken: Insecurity of Microsoft Office’s Ooxml Signatures
Simon Rohlmann, Vladislav Mladenov, Christian Mainka, Daniel Hirschberger, and Jörg Schwenk, Ruhr University Bochum
2151
2152
Cisco Must Be Held Accountable for Aiding China’s Human Rights Abuses
San Francisco—The Electronic Frontier Foundation (EFF) is urging a federal appeals court to reinstate a lawsuit seeking to hold Cisco Systems accountable for aiding in human rights abuses by building the Chinese government a system that Cisco officials knew was intended to identify—and facilitate...
2153
The Reluctant Sysadmin's Guide to Securing a Linux Server
I wrote a follow-up to this guide, which you should probably consider along with this article.
2154
My audio interface has SSH enabled by default
I bought a Rodecaster Duo to solve some audio woes, and found that it has ssh enabled by default. I captured the firmware update process and created custom firmware to enable password authentication for ssh.
2155
State Partitioning
State Partitioning is the new privacy feature called Total Cookie Protection, which will be available in ETP Strict Mode in Firefox 86.
2156
IPinside: Korea’s Mandatory Spyware
Banking websites in South Korea can only be used with IPinside installed. This application collects lots of data about the user, and it makes that data accessible to each and every website. The protection is inadequate.
2157
Equifax Argentinian portal secured with admin/admin
Equifax last week disclosed a historic breach involving Social Security numbers and other sensitive data on as many as 143 million Americans. The company said the breach also impacted an undisclosed number of people in Canada and the United Kingdom. But the official list of victim countries may not yet be complete…
2158
One Token to rule them all – Obtaining Global Admin in every Entra ID tenant
While preparing for my Black Hat and DEF CON talks in July of this year, I found the most impactful Entra ID vulnerability that I will probably ever find. One that could have allowed me to compromise every Entra ID tenant in the world (except probably those in national cloud deployments). If you are an Entra ID admin…
2159
Releasing my book "Hacking the Xbox" as a free PDF in honor of Aaron Swartz
Dear Reader, No Starch Press and I have decided to release this free ebook version of Hacking the Xbox in honor of Aaron Swartz. As you read this book, I hope that you’ll be reminded of how important freedom is to the hacking community and that you’ll be inclined to support the causes that Aaron believed in. Download…
2160
WhatsApp Rolls Out End-To-End Encryption to Its Over 1B Users
End-to-end encryption has just gone massively mainstream. In an update on March 31st, the Facebook-owned messaging platform WhatsApp quietly pushed an update adding end-to-end encryption enabled by default to its chat and call functionality. They announced the change publicly on Tuesday, allowing...