Romance fraud has been growing as an issue for years. It's not uncommon to see news stories with bewildered victims explaining just how deeply they'd been sucked in. After receiving a number of opener
This article is archived on mirror.xyz , and attracted discussion on Hacker News Generated by this notebooklm Gene Spafford "Using encryption on the…
I wrote last month about my diabetes diagnosis this year and my difficult choice to wear a proprietary device (called a CGM) on my arm 24/7 to continuously monitor my glucose levels. Like my friend and colleague, Karen M. Sandler — who previously made a much higher-stakes choice to receive a proprietary implanted…
OpenSSH post quantum cryptography
The Great Firewall of China (GFW) experienced the largest leak of internal documents in its history on Thursday September 11, 2025. Over 500 GB of source code, work logs, and internal communication records were leaked, revealing details of the GFW's research, development, and operations.
After the excitement of our .MOBI research, we were left twiddling our thumbs. As you may recall, in 2024, we demonstrated the impact of an unregistered domain when we subverted the TLS/SSL CA process for verifying domain ownership to give ourselves the ability to issue valid and trusted TLS/
Finding and disabling the cellular modem for BlueLink in the Kona EV
I gave a talk on Wednesday at the Bay Area AI Security Meetup about prompt injection, the lethal trifecta and the challenges of securing systems that use MCP. It wasn’t …
On June 19th, my life changed with a phone call.
Purism makes premium phones, laptops, mini PCs and servers running free software on PureOS. Purism products respect people's privacy and freedom while protecting their security.
Hosted by the Brooklyn Public Library, this Burner Phone 101 workshop introduced participants to phone-related risk modeling, privacy-protective smartphone practices, the full spectrum of burner phone options, and when to leave phones behind entirely.
Branch Privilege Injection ( CVE-2024-45332 ) brings back the full might of branch target injection attacks (Spectre-BTI) on Intel. Intel’s hardware mitigations against these types of attacks have held their ground for almost 6 years. In our work, we demonstrate how these mitigations can be broken due to a race…
Malware driving attack includes "dead man's switch" that can harm user data.
Last year, we wrote about why a memory safety strategy that focuses on vulnerability prevention in new code quickly yields durable and compounding gains. This year we lo…
Click fraud protection in one tool: DataCops flags bot clicks, blocks repeat bots at your Cloudflare edge, keeps them out of the conversions 8 ad platforms learn from, and exports Google refund evidence.
I have for you a bizarre tale of scrapers, feds, data poisoning, Torswats, and everyone's favorite fedi instance. It veers technical, because I suspect it will be of interest to other people running servers with UGC (i.e., every fedi instance), and also because the mechanics of how I figured out what I figured out…
In the span of just weeks, the US government has experienced what may be the most consequential security breach in its history—not through a sophisticated cyberattack or an act of foreign espionage, but through official orders by a billionaire with a poorly defined government role. And the implications for national…
I guess you have all heard about the growing problem of AI companies trying to aggressively collect whatever data they can get their hands on to train their models. This has caused an explosive surge in web crawlers relentlessly hitting servers big and small. But who runs these crawlers? Turns out — it could be you!
A simple typo of ghcr.io to ghrc.io would normally be a small goof. You’d typically get a 404 or similar error, finally work out the issue, fix it, and move along. But in this case, that typo appears to be doing something very malicious, stealing GitHub credentials. What’s ghcr.io? First, a quick bit of background…
A rare and revealing breach attributed to a North Korean-affiliated actor, known only as “Kim” as named by the hackers who dumped the data, has delivered a new insight into Kimsuky (APT43) tactics, techniques, and infrastructure. This actor's operational profile showcases credential-focused intrusions targeting South…
Google announced a program that is proving to be unpopular among Android app development experts. I have questions.
OpenAI is fighting the New York Times’ demand for 20 million private ChatGPT conversations and accelerating new security and privacy protections to protect your data.
If you were an Internet user for a few years on either side of the turn of the millennium, you will remember pop-up advertisements.
This is deranged, each nation’s boomers and reactionaries attempting to outdo the others: “Action to prohibit the provision of VPN services to children in the United Kingdom” … th…
The Financial Times reports that the U.K. is once again demanding that Apple create a backdoor into its encrypted backup services. The only change since the last time they demanded this is that the order is allegedly limited to only apply to British users. That doesn’t make it any better.The demand...
