Topics /
The most popular blog posts about security & privacy on Hacker News. 8,768 posts.
This is a quick blog post about a security vulnerability (now fixed) that allowed me to make anyone like or message a profile on okcupid.com simply by getting them to click a link on my website. In doing so, I used one of the most boring web application security issues (CSRF) combined with a somewhat interesting JSON…
Posted by Adam Langley, Security Engineer On Wednesday, July 2, we became aware of unauthorized digital certificates for several Google ...
After a leaked FISA court document revealed that the National Security Agency (NSA) is vacuuming up private data on millions of innocent Americans by collecting all the phone records of Verizon customers, President Obama responded by saying "let's have a debate" about the scope of US surveillance...
Open source technology encourages collaboration and innovation to address real world problems, including projects supported by Google Cloud. As part of our broad engagement with the open source community, we’ve been working with HashiCorp since 2013 to enable customers who use HashiCorp tools to make optimal use of…
Here’s how I temporarily took over 50% of all DNS traffic for the TLD of the Democratic Republic of Congo.
Learn how OAuth 2.0 works with this simplified explanation and guide. Learn what it is, why it's essential for secure authorization, and best practices for implementation.
Welcome to acronym city! The Court of Appeal of Brussels has made an interesting ruling. A customer complained that their bank was spelling the customer's name incorrectly. The bank didn't have support for diacritical marks. Things like á, è, ô, ü, ç etc. Those accents are common in many languages. So it was a little…
What I learned mining 125,000 vulnerabilities from Linux git history. The average kernel bug lives 2.1 years before discovery, but some subsystems are far worse.
Not long ago, the ability to digitally track someone’s daily movements just by knowing their home address, employer, or place of worship was considered a dangerous power that should remain only within the purview of nation states. But a new lawsuit in a likely constitutional battle over a New Jersey privacy law shows…
Border Gateway Protocol is the de facto protocol that directs routing decisions between different ISP networks, and is generally known as the “glue” that holds the internet together. It’s safe to say that the internet we currently know would not function without working BGP implementations.
When you can’t remove an app which you installed just a few minutes ago, you know there’s something wrong. Here’s the solution, and why this is bad security.
Hello, Lately I have been looking into race condition bugs affecting websites/web-applications. Here is a good resource to learn about th...
OpenAI Privacy Filter is an open-weight model for detecting and redacting personally identifiable information (PII) in text with state-of-the-art accuracy
What is credit card fraud, how we noticed it and how it impacted our business.
The FBI wants strong encryption without key escrow, which is insecure at scale, to be illegal or impractical. Data breach risks rise as devices get less secure.
The Chinese government has long been suspected of hiring as many as 2,000,000 people to surreptitiously insert huge numbers of pseudonymous and other deceptive writings into the stream of real social media posts, as if they were the genuine opinions of ordinary people. Many academics, and most journalists and…
We identified nine Bahraini activists whose iPhones were successfully hacked with NSO Group’s Pegasus spyware between June 2020 and February 2021. The hacked activists included three members of Waad (a secular Bahraini political society), three members of the Bahrain Center for Human Rights, two exiled Bahraini…
The United States Court of Appeals for the Second Circuit issued an opinion rejecting the government’s attempt to hold an employee criminally liable under the federal hacking statute—the Computer Fraud and Abuse Act (“CFAA”)—for violating his employer-imposed computer use restrictions. The decision...
Personal blog of Julien (jvoisin) Voisin
Hacking on a plane, by Midjourney AI
The systemd-analyze security command gives your systemd service units an automated security rating. This is a good starting point for security hardening.
From Cloudflare’s headline-making takedown of the Daily Stormer last autumn to YouTube’s summer restrictions on LGBTQ content, there's been a surge in “voluntary” platform censorship. Companies—under pressure from lawmakers, shareholders, and the public alike—have ramped up restrictions on speech,...
Today we announce that we no longer support port forwarding. New port forwards will no longer be supported, and existing ports will be removed 2023-07-01.
Over the weekend, there was an attack on Stack Overflow. We have confirmed that some level of production access was gained on May 11. We discovered and investigated the extent of the access and are addressing all known vulnerabilities. We have not identified any breach of customer or user data. Our customers’ and…
Learn why rotating your SSH keys is essential for preventing credential theft. Discover best practices for SSH key rotation and how to protect your systems from potential breaches.
