211
GrapheneOS migrates server infrastructure from France
The GrapheneOS project has announced on X that they are ceasing all operations in France, asserting that the country is no longer safe for "open source projects"
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 679 posts.
212
213
NSA and IETF, part 3: Dodging the issues at hand
Normal practice in deploying post-quantum cryptography is to deploy ECC+PQ. IETF's TLS working group is standardizing ECC+PQ. But IETF management is also non-consensually ramming a particular NSA-driven document through the IETF process, a "non-hybrid" document that adds just PQ as another TLS option.
214
215
New USPTO Memo Makes Fighting Patent Trolls Even Harder
The U.S. Patent and Trademark Office (USPTO) just made a move that will protect bad patents at the expense of everyone else. In a memo released February 28, the USPTO further restricted access to inter partes review, or IPR—the process Congress created to let the public challenge invalid patents...
216
I caught Google Gemini using my data and then covering it up
I asked Google Gemini a pretty basic developer question. The answer was unremarkable, apart from it mentioning in conclusion that it knows I previously used ...
217
IP blocking the UK is not enough to comply with the Online Safety Act
A follow up to The Ofcom Files. Some notes on Ofcom’s strategy to date. As many of you know, I represent the U.S. website 4chan, pro bono, in its U.S. federal lawsuit against the UK…
218
The Policy Puppetry Attack: Novel bypass for major LLMs
HiddenLayer’s latest research uncovers a universal prompt injection bypass impacting GPT-4, Claude, Gemini, and more, exposing major LLM security gaps.
219
The insecurity of telecom stacks in the wake of Salt Typhoon
Towards the end of last year, we learned that a group (allegedly affiliated with the Chinese government, referred to as “Salt Typhoon”) breached T-Mobile and other telecommunications co…
220
Sign in as anyone: Bypassing SAML SSO authentication with parser differentials
Critical authentication bypass vulnerabilities were discovered in ruby-saml up to version 1.17.0. See how they were uncovered.
221
222
A Postmark backdoor that’s downloading emails
Secure the modern software stack with Koi. Gain visibility, context, and real-time protection over extensions, MCPs, and autonomous AI agent endpoints.
223
Nvidia Security Team: “What if we just stopped using C?” (2022)
Today I want to share a great story about why many NVIDIA products are now running formally verified SPARK code. This blog post is in part a teaser for…
224
Memory safety for web fonts
Learn how and why the Chrome team has replaced FreeType with Skrifa.
225
FBI Agents Visit Anti-ICE Protester: "Your name was brought up."
“Your name was brought up.”
226
Google spoofed via DKIM replay attack: A technical breakdown
Learn how a Google spoof used a DKIM replay attack to bypass email security and trick users with a fake subpoena in this real-world phishing case.
227
228
CSRF protection without tokens or hidden form fields
A couple of months ago, I received a request from a random Internet user to add CSRF protection to my little web framework Microdot, and I thought it was a fantastic idea.When I set off to do this…
229
HTTPS by default
One year from now, with the release of Chrome 154 in October 2026, we will change the default settings of Chrome to enable “Always Use Secure Connections”. This means Ch…
230
Scream cipher
You've probably heard of stream ciphers, but what about a scream cipher 😱? Today I learned there are more “Latin capital letter A” Unicode characters than there are letters in the English alphabet....
231
A day in the life of a prolific voice phishing crew
Besieged by scammers seeking to phish user accounts over the telephone, Apple and Google frequently caution that they will never reach out unbidden to users this way. However, new details about the internal operations of a prolific voice phishing gang show the group routinely abuses legitimate services at Apple and…
232
How cops can get your private online data
Can the cops get your online data? In short, yes. There are a variety of US federal and state laws which give law enforcement powers to obtain information that you provided to online services. But, there are steps you as a user and/or as a service provider can take to improve online privacy.Law...
233
SystemD Service Hardening
Discover additional security options for systemd units, to include quadlets. These options are everything from system permissions, time manage, BPF, syscall & seccomp filters, etc., all to make your system more secure.
234
Public secrets exposure leads to supply chain attack on GitHub CodeQL
An exposed GitHub token could have been used to launch a supply chain attack on GitHub CodeQL, resulting in source code exposure and repository tampering of CodeQL users.
235
Pwning the Nix ecosystem
ptrpaws's blog on reverse engineering, programming, vr finds and miscellaneous stuff.
236
Landlock-Ing Linux
Landlock is a Linux API that lets applications explicitly declare which resources they are allowed to access. Its philosophy is similar to OpenBSD’s unveil() and (less so) pledge() : programs can make a contract with the kernel stating, “I only need these files or resources — deny me everything else if I’m…
237
Brave blocks Microsoft Recall by default
Starting in version 1.81 for Windows users, Brave browser will block Microsoft Recall from automatically taking screenshots of your browsing activity.
238
Reading NFC Passport Chips in Linux
For boring and totally not nefarious reasons, I want to read all the data contained in my passport's NFC chip using Linux. After a long and annoying search, I settled on roeften's pypassport. I can now read all the passport information, including biometrics. Table of ContentsBackgroundRecreating the MRZPython code to…
239
Zero-day flaws in authentication, identity, authorization in HashiCorp Vault
Check Point's AI Security Solutions deliver AI-driven threat prevention and unified security management for advanced protection across enterprise networks.
240
Why are banks still getting authentication so wrong?
While recently traveling to the U.S., I was completely locked out of my TD Personal Banking account. TD relies heavily on SMS-based two-factor authenticat...