2281
Best practices for user account, authorization and password management
Google Cloud offers our best practices to ensure you have a safe, scalable, usable account authentication system.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,768 posts.
2282
Does GPT-2 Know Your Phone Number?
The BAIR Blog
2283
2284
2285
2286
How to handle secrets on the command line
How to keep secret credentials safe on the command line.
2287
Let’s Encrypt client will transition to a new name and a new home at EFF
Update: Added clarification that only the Let’s Encrypt client software is changing its name and host. The Let’s Encrypt certificate authority and associated services are not changing names or relocating. Over the next few months the Let’s Encrypt client software will transition to a new name, soon to be announced…
2288
Learn Authentication the Hard Way: Part Three
This is the final installment of a three part series in which we dive into modern application authentication solutions - the hard way. Part One: The Hard Way Part Two: The Hard Way, Continued Part Three: The Hard Way: Return Of The Specification The Hard Way: Return Of The Specification We are continuing our quest to…
2289
The modern packager’s security nightmare
One of the most important tasks of the distribution packager is to ensure that the software shipped to our users is free of security vulnerabilities. While finding and fixing the vulnerable code is…
2290
That's not how 2FA works
Another day, another high-profile website cloned to phish credentials. Tess Rinearson@_tessrIs this a phishing attempt? Goes to "githubverification.com" and asks for username and pw (if so, it nearly got me!) /cc @github pic.x.com/jgt4oNvjF2❤️ 2,243💬 111🔁 016:12 - Sat 16 January 2021 In the replies, you’ll see lots of…
2291
2292
Someone has been attempting to DDoS us for weeks and we do nothing
Someone has been attempting to DDoS us for weeks now. They have flooded our server with hundreds of millions of requests and attempted to download our setup…
2293
DEV-0537 targeting organizations for data exfiltration and destruction
The activity we have observed has been attributed to a threat group that Microsoft tracks as DEV-0537, also known as LAPSUS$. DEV-0537 is known for using a pure extortion and destruction model without deploying ransomware payloads.
2294
A Post-Quantum Future for Let's Encrypt
Let’s Encrypt is committed to a post-quantum-safe Web PKI. The path we’re planning to take is Merkle Tree Certificates (“MTCs”), a new approach that adds post-quantum authentication to the web without sacrificing the speed and reliability that have made TLS universal. This post is about these plans and why we believe…
2295
Threat actor abuses Cloudflare tunnels to deliver remote access trojans
Key findings Proofpoint has observed an increase in malware delivery via TryCloudflare Tunnel abuse. The activity is financially motivated and delivers exclusively remote
2296
PayPal phishing scam uses invoices sent via PayPal
Scammers are using invoices sent through PayPal.com to trick recipients into calling a number to dispute a pending charge. The missives — which come from Paypal.com and include a link at Paypal.com that displays an invoice for the supposed transaction — state that the user’s account is about to be charged hundreds of…
2297
SQL patterns I use to catch transaction fraud
The actual queries I run when I'm hunting fraud in transaction data. Velocity, impossible distances, suspicious amounts, merchant clusters, off-hours buys, and window functions.
2298
2299
Metadata Equals Surveillance
Back in June, when the contents of Edward Snowden’s cache of NSA documents were just starting to be revealed and we learned about the NSA collecting phone metadata of every American, many people—including President Obama—discounted the seriousness of the NSA’s actions by saying that it’s just metadata. Lots and lots…
2300
Yet another macOS privacy protections bypass
Today I'm disclosing a macOS privacy protections bypass. I discovered that an application can use the venerable Unix command-line tool "ls" (list directory contents) to bypass both TCC (Transparency, Consent, and Control) and the sandbox, enabling unauthorized access to file metadata in directories that are supposed…
2301
Cross-Site Request Forgery is dead
After toiling with Cross-Site Request Forgery on the web for, well forever really, we finally have a proper solution, it's Same-Site Cookies.
2302
A single byte write opened a root execution exploit
Thursday, September 22nd 2016. An email popped up in my inbox. Subject: ares_create_query OOB write As one of the maintainers of the c-ares project I'm receiving mails for suspected security problems in c-ares and this was such a one. In this case, the email with said subject came from an individual who had reported a…
2303
2304
2305
RaidForums gets raided, alleged admin arrested
The U.S. Department of Justice (DOJ) said today it seized the website and user database for RaidForums , an extremely popular English-language cybercrime forum that sold access to more than 10 billion consumer records stolen in some of the world’s largest data breaches since 2015. The DOJ also charged the alleged…
2306
2307
2308
Tor Browser 4.0 is released
Update (Oct 22 13:15 UTC): Windows users that are affected by Tor Browser crashes might try to...
2309
Why are free proxies free? (2013)
Personal Blog of Christian Haschek
2310
