2701
Dutch schools must stop using Google's email and cloud due to privacy concerns
Dutch Personal Data Authority raised concerns about Google's GDPR compliance.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,768 posts.
2702
Mozilla Monitor Plus: automatically remove your personal info from data brokers
Today, Mozilla Monitor (previously called Firefox Monitor), a free service that notifies you when your email has been part of a breach, announced its new p
2703
Android Chrome 99 expands Certificate Transparency, breaking all MitM dev tools
Certificate transparency is superb improvement to HTTPS certificate security on the web that's great for users and businesses, but on Android it creates a huge...
2704
Privacy Analysis of FLoC
In a previous post, I wrote about a new set of technologies “Privacy Preserving Advertising”, which are intended to allow for advertising without compr
2705
2706
2707
Playing chicken with cat.jpg
I was reminded of this by 37signals' response on Monday to last week's cat.jpg privacy failure . To be clear, I have a lot of sympathy for 37signals: Once someone looked in their logs and saw "cat.jpg" as the name of the one hundred millionth file they had stored, I'm sure the resulting fit of laughter significantly…
2708
What I'm Telling US Congress about Data Breaches
Last week I wrote about my upcoming congressional testimony [https://www.troyhunt.com/im-testifying-in-front-of-congress-in-washington-dc-about-data-breaches-what-should-i-say/] and wow - you guys are awesome! Seriously, the feedback there was absolutely sensational and it's helped shape what I'll
2709
2710
The VeraCrypt Audit Results
VeraCrypt 1.18 and its bootloaders were evaluated. This release included a number of new features including non-western developed encryption options, a boot loader that supports UEFI (modern BIOSes), and more.
2711
Netherlands Seizes 800 Servers, Arrests 2 for Aiding Cyberattacks
Authorities in the Netherlands have arrested the co-owners of two related Internet hosting companies for operating IT infrastructure used by Russia to carry out cyberattacks, influence operations and disinformation campaigns inside the European Union. The two men were the focus of a 2025 KrebsOnSecurity story about…
2712
A new set of vulnerabilities affecting users of PGP and S/MIME
UPDATE: Enigmail and GPG Tools have been patched for EFAIL. For more up-to-date information, please see EFF's Surveillance Self-Defense guides.UPDATE (5/14/18): More information has been released. See EFF's more detailed explanation and analysis here.A group of European security researchers have...
2713
Why are banks still getting authentication so wrong?
While recently traveling to the U.S., I was completely locked out of my TD Personal Banking account. TD relies heavily on SMS-based two-factor authenticat...
2714
Did Schnorr destroy RSA? Show me the factors
Schnorr has claimed new factoring methods that “destroy RSA”. This should be easy to demonstrate with well known challenges.
2715
Building a more private web: A path towards making third party cookies obsolete
In August, we announced a new initiative (known as Privacy Sandbox) to develop a set of open standards to fundamentally enhance privacy on...
2716
The .ly domain space to be considered unsafe
I would like to warn current and future owners of .ly domains of a concerning incident regarding the deletion of one of our prime domains…
2717
Google Calendar Unexpectedly Leaks Private Information
My wife likes to set reminders for herself in Google Calendar. Recently, she added a note to her personal Google Calendar reading "Email alice@example.com to discuss pay rise" and set the date for a few months from now. She'd had a discussion with her boss, Alice, and they'd agreed to talk about salary later in the…
2718
Website Glitch Let Me Overstock My Coinbase
Coinbase and Overstock.com just fixed a serious glitch that allowed Overstock customers to buy any item at a tiny fraction of the listed price. Potentially more punishing, the flaw let anyone paying with bitcoin reap many times the authorized bitcoin refund amount on any canceled Overstock orders.
2719
Quantifying the Impact of “Cloudbleed”
Last Thursday we released details on a bug in Cloudflare's parser impacting our customers. It was an extremely serious bug that caused data flowing through Cloudflare's network to be leaked onto the Internet.
2720
2721
Running the "Reflections on Trusting Trust" Compiler
Supply chain security is a hot topic today, but it is a very old problem. In October 1983, 40 years ago this week, Ken Thompson chose supply chain security as the topic for his Turing award lecture, although the specific term wasn’t used back then. (The field of computer science was still young and small enough that…
2722
Twitter Direct Message Caching and Firefox
Distinguished engineer Martin Thomson explains how this problem occurred, the implications for people who might be affected, and how problems of this nature might be avoided in future. To get ...
2723
Why we don’t generate elliptic curves every day
Elliptic curves are standardized, instead of being generated like Diffie-Hellman parameters. There's good reasons!
2724
Why (blank) gets you root
tracking down the cause of a serious authentication flaw
2725
Amnesty International: Encryption Is a Human Rights Issue
New Report Analyzes How Crypto Backdoors, Interference with Crypto, and Compelled Disclosure of Encryption Keys All Impact Free Expression and Privacy Defending encryption is a human rights issue, according to a new Amnesty International report. The report calls on nation-states to promote the use...
2726
Life Is About to Get Harder for Websites Without HTTPS
In case you haven't noticed, we're on a rapid march towards a "secure by default" web when it comes to protecting traffic. For example, back in Feb this year, 20% of the Alexa Top 1 Million sites were forcing the secure scheme: These figures are from Scott Helme'
2727
Reflections on Distrusting xz
Was the ssh backdoor the only goal that "Jia Tan" was pursuing with their multi-year operation against xz?
2728
Tor exit node operator prosecuted in Austria
June 30th, 2014 marks a turning point for Austria. Not only was the Vorratsdatenspeicherung (data retention) terminated preliminarily for good (no, really), the operation of TOR exit nodes supposedly was also declared a criminal offense by a regional criminal court. The accused was operating a TOR exit node which was…
2729
2730
Remote Code Execution in Alpine Linux
tl;dr I found several bugs in apk, the default package manager for Alpine Linux. Alpine is a really lightweight distro that is very commonly used with Docker...