2791
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,768 posts.
2792
Bloomberg’s ‘The Big Hack’
One way or the other, there is more to come on this story, and either Bloomberg’s or Apple’s and Amazon’s credibility is going to take a significant hit.
2793
PIA open-sources and announces audit plans
The VPN industry looks just like the world of religion - everyone has their different beliefs on who to trust. However, even the diamond in the rough lied
2794
Firecracker VM Escape: PwnEscape Part 2
Firecracker is supposed to keep untrusted code inside a microVM. We escaped it and achieved code execution as root on the host.
2795
A Bug in Early Creative Commons Licenses Has Enabled Copyleft Trolls (2022)
Copyleft trolls, robosigning, and Pixsy.
2796
GitHub has not removed malicious imitation software after 3 weeks
On the 31st August I got an email from a customer, telling me that they had found an imitation of my data wrangling software on Github. I’m not linking to it, but here is a screenshot: It is …
2797
On Cybersecurity and Being Targeted
Last month, I was the subject of a targeted cyber attack. Someone went through substantial lengths to attempt to gain access to my GitHub account, but were...
2798
White House Deletes TSA Petition
At approximately 11:30 am EDT, the White House removed a petition about the TSA airport screening procedures from the White House
2799
Big no on Big Sur: Mullvad disallows Apple apps to bypass firewall
Despite Apple’s changes to macOS with the release of Big Sur, we can confirm that the Mullvad app still performs as intended by not allowing Apple’s own apps to bypass our VPN firewall.
2800
2801
2802
Kids Pass Just Reminded Us How Hard Responsible Disclosure Is
Only a couple of months ago, I did a talk titled "The Responsibility of Disclosure: Playing Nice and Staying Out of Prison". The basic premise was to illustrate where folks finding security vulnerabilities often go wrong in their handling of the reporting, but I also wanted to show how organisations
2803
Creative usernames and Spotify account hijacking
Spotify supports unicode usernames which we are a bit proud of (not many services allow you to have ☃, the unicode snowman, as a username). However, it has also been a reliable source of pain over the years. This is the story of one time when it bit us pretty badly and how we spent Easter dealing with it.
2804
2805
CISA passes Senate
CISA passed the Senate today in a 74-21 vote. The bill is fundamentally flawed due to its broad immunity clauses, vague definitions, and aggressive spying authorities. The bill now moves to a conference committee despite its inability to address problems that caused recent highly publicized...
2806
Attack campaign involving stolen OAuth tokens issued to third-party integrators
On April 12, GitHub Security began an investigation that uncovered evidence that an attacker abused stolen OAuth user tokens issued to two third-party OAuth integrators, Heroku and Travis-CI, to download data from dozens of organizations, including npm. Read on to learn more about the impact to GitHub, npm, and our…
2807
I Hacked Google App Engine: Anatomy of a Java Bytecode Exploit
Back in college, I was very interested in Java bytecode. When I got an internship at Google in 2013, I was skeptical of the security of the Java version of Google App Engine and got permission to spend the last week of my internship doing a mini red team exercise, trying to break into App Engine. This is the story of…
2808
EFF: Show Support for the Fourth Amendment
This Fourth of July, EFF will be demonstrating our commitment to your Constitutional right of privacy from government surveillance by displaying the text of the Fourth Amendment on our website. This demonstration is a visual symbol of our opposition to the illegal and unconstitutional surveillance...
2809
Beg Bounties
When someone passed me hundreds of thousands of records on kids taken from CloudPets a few years ago [https://www.troyhunt.com/data-from-connected-cloudpets-teddy-bears-leaked-and-ransomed-exposing-kids-voice-messages/] , I had a nightmare of a time getting in touch with the company. They'd
2810
Don't use passkeys for encrypting user data
Passkeys are the future of authentication, but using them for data encryption is a disaster waiting to happen. Overloading these credentials creates a dangerous blast radius that can lead to the irreversible loss of a user's most sacred memories and documents.
2811
Yubico and Microsoft Introduce Passwordless Login
The Security Key by Yubico with FIDO2 enables passwordless login for Windows 10 devices and Microsoft Azure Active Directory.
2812
Microsoft actions following attack by nation state actor Midnight Blizzard
Microsoft Security Response Center Blog
2813
How we protect our most sensitive secrets from the most determined attackers
As a bank, we have a lot of secrets we need to protect to keep our customers and ourselves safe. These include private keys that only we know, which we use to digitally sign requests as coming from us (sort of like a private password). These private keys are super important and are used all over Monzo and when…
2814
Someone is impersonating us in a recruiting scam
Our startup was recently the center of an elaborate recruiting scam. What do other companies do if they realize that someone is impersonating them to attack vulnerable job seekers? This article gives advice to job seekers and shares our story.
2815
Rubygems.org AWS Root Access Event – September 2025
As part of standard incident-response practice, Ruby Central is publishing the following post-incident review to the public. This document summarizes the September 2025 AWS root-access event, what occurred, what we verified, and the actions we’ve taken to strengthen our security processes.
2816
2817
Deleting System32\curl.exe
Let me tell you a story about how Windows users are deleting files from their installation and as a consequence end up in tears. Background The real and actual curl tool has been shipped as part of Windows 10 and Windows 11 for many years already. It is called curl.exe and is located in the … Continue reading deleting…
2818
NixOS and reproducible builds could have detected the xz backdoor
In March 2024, a backdoor was discovered in xz, a (de)-compression software that is regularly used at the core of Linux distributions to unpack source tarballs...
2819
IPMI
I am making steady progress towards moving the Computers Are Bad enterprise cloud to its new home, here in New Mexico. One of the steps in this process is, of course, purchasing a new server... the current Big Iron is getting rather old (probably about a decade!) and here in town I'll have the rack space for more…
2820
Young people in 13 EU countries refuse surveillance of online communication
Poll: the 80% would not feel comfortable being politically active or exploring their sexuality if authorities can monitor their communication.