241
AWS IAM Roles, a tale of unnecessary complexity
This is going to be a highly opinionated blog post. I think AWS is great and use it daily, but their implementation of IAM is unnecessarily complicated.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 642 posts.
242
Austrian DSB: EU-US Data Transfers to Google Analytics Illegal
In a groundbreaking decision, the Austrian Data Protection Authority has decided on a model case by noyb that the continuous use of Google Analytics violates the GDPR.
243
How can you be fooled by the U+202E trick? (2013)
Ethical Hacking, Malware Analysis, Disinfection Techniques, Information Security, Pentesting Techniques and all related with Computer Security.
244
Authorization in a Microservices World
Authorization? How hard can it be? I am pretty sure that others have already solved it. We are not the first ones doing microservices. It should be easy to integrate what's already out there.
245
Bitcoin's fungibility graveyard
Where the pipe-dream of Bitcoin’s real-world fungibility goes to die.
246
There is no “software supply chain”
In actual supply chains, money is changing hands. A server manufacturer is paying for PCB fabrication, who is paying their suppliers for raw materials and equipment, and so on until the whole thing eventually loops back on itself when a mining company needs to buy a server.
247
What we can deduce from a leaked PDF
Matthew Butterick
248
Banks are not repaying victims of Zelle scams
When U.S. consumers have their online bank accounts hijacked and plundered by hackers, U.S. financial institutions are legally obligated to reverse any unauthorized transactions as long as the victim reports the fraud in a timely manner. But new data released this week suggests that for some of the nation’s largest…
249
macOS now scans for malware whenever it gets a chance
How macOS now has anti-malware scanners checking your Mac automatically many times each day for the most frequent malware.
250
CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit
In this report, we present a UEFI firmware rootkit that we called CosmicStrand and attribute to an unknown Chinese-speaking threat actor.
251
Why are McDonald’s Self Service Kiosks so hackable?
McDonalds in Australia do a decent cup of coffee. It’s not great but it’s consistently decent so I often start my day with a cup. Due to my travels around Australia in a decked out van I have seen how many McDonalds operate and just how many of
252
Meta Accounts: A New Login for VR
Today we’re introducing Meta accounts: a new way for people to log into their VR headsets that doesn’t require a Facebook account. When we announced that we would start requiring people to log into Meta Quest using a Facebook account, we received a lot of feedback from the Quest community. We took that feedback into…
253
Why offer an Onion Address rather than just encourage browsing-over-Tor?
There are a bunch of reasons to launch an onion site, and a bunch of benefits, all of which have provided value to platforms such as Facebook, the BBC or NYT Onions. The first benefits are authenti…
254
Fine-grained personal access tokens for GitHub
Fine-grained personal access tokens offer enhanced security to developers and organization owners, to reduce the risk to your data of compromised tokens.
255
Exploiting IndexedDB API information leaks in Safari 15
Discover how a software bug in Safari 15's IndexedDB API can track your online activity and reveal your identity.
256
Tor – Arti 1.0.0 is released: Rust Tor implementation ready for production use
Arti 1.0.0 is released and ready for download.
257
258
259
Discovering a security vulnerability in a major grocery delivery platform
We felt more like “Oh fuck, Databreach” Dieser Artikel ist auch auf deutsch erschienen. During the pandemic, grocery delivery services gained popularity. New players on the market offer delivery in under an hour. One of them is Gorillas, which not only delivers apples and granola bars in 10 minutes, but just as…
260
VRchat bans mods, embraces EAC
In VRChat 2022.2.2, we’re introducing two major improvements to the security of VRChat — Easy Anti-Cheat and Secure Instances.
261
The Iran Firewall: A preliminary report
The Internet is easily censored. The neo-liberal's got their arses kicked. The big players like Google/Apple/AWS are partly to blame. China runs the GFI.
262
Element (Matrix) launches Chatterbox, end-to-end encrypted embedded chat
We’re outrageously pleased to launch Chatterbox, an end-to-end encrypted embedded chat built on Matrix!
263
264
Apple’s Private Relay can cause the system to ignore firewall rules
Apple’s Private Relay (Beta) feature calls home to Apple servers without respecting the firewall rules of the system, creating a leak that neither we, nor you, can stop without disabling the entire Private Relay feature.
265
Extracting WhatsApp Messages from an iOS Backup
Find where WhatsApp chats live in an iPhone backup, decrypt an encrypted iOS backup with Python, and read your messages from ChatStorage.sqlite.
266
267
Random number generator enhancements for Linux 5.17 and 5.18
The random number generator has undergone a few important changes for Linux 5.17 and 5.18, in an attempt to modernize both the code and the cryptography used. The smaller part of these will be released with 5.17 on Sunday, while the larger part will be merged into 5.18 on Monday, which should receive its first release…
268
269
Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password
Logging into your Bitwarden vault just got easier! A new passwordless experience enables you to access your Bitwarden vault with another device.
270
I'm a security engineer and I still almost got scammed
I was in the park with my son and his best friend. I saw 2 missed calls from a number I didn’t recognise. I Googled it - it was my bank. I told the other adults that I should call back in case it was important.