Topics /
The most popular blog posts about security & privacy on Hacker News. 8,768 posts.
Have you ever violated a website’s terms of use, such as by using something other than your real name on a website that requires one, or by sharing your account password with a family member when doing so is prohibited? Probably. Have you ever clicked “I agree” without actually reading the terms in...
Alice and Bob are crossword enthusiasts. Every morning they rush to complete the Daily Telegraph cryptic crossword . One morning Alice fini...
An exposed GitHub token could have been used to launch a supply chain attack on GitHub CodeQL, resulting in source code exposure and repository tampering of CodeQL users.
As Congress and the President rush to re-authorize the dangerous FISA Amendments Act (FAA)—the law shamefully passed after pressure to legalize certain portions of the NSA’s warrantless wiretapping program—EFF has been sounding the alarm that Americans’ communications are still being...
Today the Transportation Security Administration (TSA) announced that it has launched a “pilot” at Washington National Airport (DCA) of yet another scheme for biometric identification and tracking of domestic air travelers.
To see just how prevalent items of personal data are being listed on the dark web, and at what price, we sent our researchers on a data-gathering mission.
On Apr 14 2015, the Virginia State Board of Elections immediately decertified use of the AVS WinVote touchscreen Direct Recording Electronic (DRE) voting machine. This seems pretty minor, but it received a tremendous amount of pushback from some local election officials. In this post, I’ll explain how we got to that…
Oura users' data is not end-to-end encrypted and can be handed to the government. Will the wearable tech maker say how often it turns over data?
Heartbleed is a catastrophic bug in OpenSSL: “The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of…
Or how to play YouTube videos on you SONOS, easy and for free.
Wiz Research recently discovered a series of alarming vulnerabilities that highlight the supply chain risk of open source code, particularly for customers of cloud computing services.
Nyxgeek here. It's 2026 and I've got two more Azure Entra ID sign-in log bypasses to share with you. Don't get too excited…these bypasses were recently fixed, but I think it's important that people know.
This morning I woke up to an official-looking email from YouTube in my inbox, addressed to an address that isn't mine.
Google Safe Browsing missed 84% of confirmed phishing sites in our dataset. Here's what we found and what it means.
The long way around to screen sharing.
This is by far, the most interesting release from Shadow Brokers as it does not only contain tools — but also materials describing the most…
We are excited to announce that Automated Certificate Management is generally available, at no additional charge, for all applications running on Hobby...
The National Security Agency (NSA) has recently declassified an amazing letter that John Nash sent to it in 1955. It seems that around the year 1950 Nash tried to interest some US security organs …
Miguel de Icaza's Blog
Summary Your phone probably contains banking, payment and personal information that can be remotely stolen via numerous known and unknown bugs in the Android software. This is attractive to criminals. Vendors (LG, Samsung, Xiaomi, etc.), after selling you their phone, have no incentive to keep your phone’s software up…
A team of researchers have examined the source code published as part of the SwissPost e-voting system, provided by Scytl, and discovered a cryptographic trapdoor.
The U.S. Department of Justice (DOJ) today seized four-dozen domains that sold “booter” or “stresser” services — businesses that make it easy and cheap for even non-technical users to launch powerful Distributed Denial of Service (DDoS) attacks designed knock targets offline. The DOJ also charged six U.S. men with…
