Topics /
The most popular blog posts about security & privacy on Hacker News. 8,768 posts.
I don’t have a lot to say about the Sony hack, which seems to still be ongoing. I want to highlight a few points, though. At this point, the attacks seem to be a few hackers and not the North Korean government. (My guess is that it’s not an insider, either.) That we live in the world where we aren’t sure if any given…
Two or three times a day, I get an email whose basic structure is as follows: Prof. Aaronson, given your expertise, we’d be incredibly grateful for your feedback on a paper / report / gr…
Today, I loaded the 1,000th data breach into Have I Been Pwned. Reflecting on that milestone number, I pondered how to mark the occasion in writing, and what immediately came to mind was a very simple question: why is it still needed? Especially considering the emergence of privacy regulations
Private Cloud Compute (PCC) fulfills computationally intensive requests for Apple Intelligence while providing groundbreaking privacy and security protections — by bringing our industry-leading device security model into the cloud. To build public trust in our system, we’re making it possible for researchers to…
Why I stopped trying to give LLM agents a better memory and instead built Lemmalog, a Datalog engine that maintains an agent's knowledge as analysis state, with provenance, retractions and incremental evaluation, plus what happened when I benchmarked it on LongMemEval and LoCoMo.
In this post, I’ll look at CVE-2023-6241, a vulnerability in the Arm Mali GPU that allows a malicious app to gain arbitrary kernel code execution and root on an Android phone. I’ll show how this vulnerability can be exploited even when Memory Tagging Extension (MTE), a powerful mitigation, is enabled on the device.
Good Obscurity vs. Bad Obscurity Camouflage OPSEC An SSH Example Reducing Impact or Probability Summary Many of us are familiar with a concept know as Security
Starting in 2007, Pwn2Own has evolved from a small demonstration with prizes averaging around $10,000 per exploit, to one of the most well-known security contests in the industry, with millions of dollars of cash and prizes made available to contestants over the years. The contest serves as more tha
Kaspersky researchers found malware in CamScanner, a text recognition app that was downloaded more than 100 million times from Google Play.
Previously on Github: XSS , CSRF ( My github followers are real , I gained followers using CSRF on bitbucket ), access bypass, mass assignm...
A writeup detailing the vulnerability reporting process that took place after Sakura Samurai had breached the Indian Government
A Finnish online bank leaked out user data by using a third-party tracker script.
I was happy for years in Apple’s walled garden; with AI, however, their protections feel like limitations.
What is SAML? Security Assertion Markup Language (SAML) is an open standard for exchanging authentication and authorization data between parties. Source: Wikipedia SAML is often used for single-sign on (“Sign in with Google”, “Sign in with Twitter” etc.). It means when you want to log in to example.com, example.com…
We’ve learned of suspicious Git activity on GitLab. Affected users have been notified.
Emil Mikhailov is the founder of XIX.ai [http://XIX.ai] (YC W17). Roman Trusov is a researcher at XIX.ai. Recent studies by Google Brain have shown that any machine learning classifier can be tricked to give incorrect predictions, and with a little bit of skill, you can get them to give pretty much any result you…
You've probably heard of stream ciphers, but what about a scream cipher 😱? Today I learned there are more “Latin capital letter A” Unicode characters than there are letters in the English alphabet....
Dieser Artikel ist auch auf deutsch erschienen To celebrate Franco-German friendship, German Transport Minister Wissing and his French counterpart Beaune came up with something special: 30,000 free Interrail tickets per country for travel in Germany and France for young adults between 18 and 27. Codename: “Passe…
Google is making it even easier to get started with passkeys by offering the ability to set them up for all users — by default.
The Norwegian Data Protection Authority confirmed that Grindr did not receive valid consent from users and announces a fine of 100 Mio NOK (€ 9.63 Mio) on Grindr.
We already put legal limits on financial, medical, military, transportation, and agriculture technology. Why not online tracking?
Can I drop a pacemaker 0day at DefCon that is capable of killing people? Computers now run our cars. It's now possible for a hacker to i...
KrebsOnSecurity ran a story this week that puzzled over Apple ‘s response to inquiries about a potential privacy leak in its new iPhone 11 line, in which the devices appear to intermittently seek the user’s location even when all applications and system services are individually set never to request this data. Today…
111 GB of internal customer information from National Credit Federation was left exposed in a publicly downloadable data repository. This is its story.
Early results from my scan: there's about 3000 systems vulnerable just on port 80, just on the root "/" URL, without Host field. That doesn'...
