2491
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,768 posts.
2492
De-Googling: My Progress
I wrote a bit about my reasoning to De-Google here . Now I want to write a bit about my progress, the struggles and what I ended up with.
2493
German credit agency earns millions through unlawful customer manipulation
The comapny uses manipulative designs to prevent people from obtaining a free copy of their data in accordance with law
2494
From Supabase to Clerk to Better Auth
The perils of logging in
2495
Austria's data protection authority has found that Google Analytics is illegal
Using Google Analytics in a legally compliant way is still possible in Europe. Here we explain how.
2496
ProtonMail Voluntarily Offers Assistance for Real-Time Surveillance?
Proton Mail disputed some of the content of the post originally published at this location. We will continue the discussion directly with Proton Mail, in particular at a meeting in …
2497
Aaron Swartz v. United States
(echoes of a broken system) UPDATE: Aaron committed suicide on January 11, 2013.(!) More on his life here. Aaron Swartz is a friend and Cambridge-area polymath whose projects focus on access to kno…
2498
Why Searching Through 500M Pwned Passwords Is So Quick
In the immortal words of Ricky Bobby, I wanna go fast [https://www.youtube.com/watch?v=_qJGsSuFRIg]. When I launched Pwned Passwords V2 last week [https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/], I made it fast - real fast - and I want to talk briefly here
2499
TLS 1.3 and Proxies
I'll generally ignore the internet froth in a given week as much as possible, but when Her Majesty's Government starts repeating misunderstandings about TLS 1.3 it is necessary to write something, if only to have a pointer ready for when people start citing it as evidence.
2500
2501
Google launches new vulnerability reward platform
Posted by Jan Keller, Technical Program Manager, Google VRP A little over 10 years ago , we launched our Vulnerability Rewards Program (VR...
2502
CircleCI security alert: Rotate any secrets stored in CircleCI
Read CircleCI’s security alerts from January 2023. Last updated 1/13/2023.
2503
2504
2505
2506
Hacking Voting Machines at Defcon
Let's rig some elections.
2507
Scammers Game Amazon A-Z Policy By Replacing iPhones With Clay
This morning I discovered some rather anomalous 1-star reviews on Amazon for the Apple iPhone 6s 128 GB. About 17% of the reviews for that product are 1-star...
2508
Firefox Now Offers a More Private Browsing Experience
We’re releasing a powerful new feature in Firefox Private Browsing called Tracking Protection. We created this feature because we believe in giving you m
2509
Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide
Summary of CVE-2021-4228 (Log4Shell), trivial RCE in log4j, a common Java logging framework. Includes list of affected platforms.
2510
Glassworm is back: A new wave of invisible Unicode attacks hits repositories
The Glassworm supply chain attack is back. Researchers uncovered malware hidden in invisible Unicode characters across 150+ GitHub repositories, plus npm packages and VS Code extensions.
2511
2512
CSRF protection without tokens or hidden form fields
A couple of months ago, I received a request from a random Internet user to add CSRF protection to my little web framework Microdot, and I thought it was a fantastic idea.When I set off to do this…
2513
BoringSSL
We recently switched Google's two billion line repository over to BoringSSL , our fork of OpenSSL . This means that BoringSSL is now powering Chromium (on nearly all platforms), Android M and Google's production services. For the first time, the majority of Google's products are sharing a single TLS stack and making…
2514
MySQL.com compromised via (guess what?) SQL injection
MySQL.com (the official site for the MySQL database) was compromised via (shocking!) blind SQL injection. A post was sent today to the full disclosure list…
2515
Apple 'Hide My Email' vulnerability reveals peoples' real email addresses
The vulnerability has been fixed as of July 7, 2026, but the exploit was simple, and hidden email addresses may still be in third-party logs.
2516
2517
Why Authorization Is Hard
There's a fundamental tension in authorization. Is it business logic or authorization logic? Should it be in the app, or separate? Let’s talk about what makes a
2518
Alignment faking in large language models
A paper from Anthropic's Alignment Science team on Alignment Faking in AI large language models
2519
HTTPS by default
One year from now, with the release of Chrome 154 in October 2026, we will change the default settings of Chrome to enable “Always Use Secure Connections”. This means Ch…
2520
Credit card fraud warning signs
Avoid accepting fraudulent credit card orders by paying attention to these warning signs.