Breaking WebAuthn, FIDO2, and Forging Passkeys(nullpt.rs)

46 points by vmfunc 1 year ago | 31 comments

Anonymous Tor Phone(0ut3r.space)

128 points by h0ek 3 years ago | 77 comments

Linux Kernel Exploitation: Attack of the Vsock(hoefler.dev)

223 points by todsacerdoti 1 year ago | 65 comments

Omarchy: Any User Process Can Escalate to Root(0xcc.io)

471 points by trap0xcc 1 month ago | 451 comments

Blog post describing a flaw in Omarchy's default Docker configuration that let any desktop user process escalate to root without a password; fixed in 4.0.1.

Brute.Fail: Watch brute force attacks fail in real time(brute.fail)

626 points by mike_d 3 years ago | 231 comments

Brute.Fail is a live feed showing real-time SSH and other login attempts by attackers guessing usernames and passwords against honeypot servers.

New Gmail Security Alert for 2.5B Users as AI Hack Confirmed(forbes.com)

3 points by libpcap 2 years ago | 0 comments

Leaking the email of any YouTube user for $10k(brutecat.com)

1548 points by brutecat 1 year ago | 439 comments

A security researcher's write-up of a vulnerability chain that exposed the email address of any YouTube channel owner, earning a $10,000 Google bug bounty.

Google is making private AI practical with homomorphic encryption(blog.google)

473 points by u1hcw9nx 2 months ago | 276 comments

Google Security blog post by Jeremy Kun on how Google is using homomorphic encryption to make privacy-preserving AI practical.

Gmail registration now requires scanning a QR code and sending a text message(discuss.privacyguides.net)

575 points by negura 5 months ago | 427 comments

Privacy Guides forum thread discussing Google account registration now requiring users to send an SMS from their phone (via QR code) rather than receive one.

The Lost Atomic Update on Loongson CPU(jia.je)

120 points by jiegec 1 month ago | 6 comments

A blog post investigating a hardware erratum on the Loongson LA664 CPU where an atomic instruction loses updates, causing an infinite loop while packaging normaliz for Debian.

Multiple Russia-aligned threat actors actively targeting Signal Messenger(cloud.google.com)

773 points by karel-3d 1 year ago | 271 comments

Google Threat Intelligence Group blog post describing Russia-aligned threat actors targeting Signal Messenger accounts.

Encrypting private data and private communications is now an ethical duty(blog.tripu.info)

416 points by gasull 3 years ago | 200 comments

A personal blog essay arguing that end-to-end encrypting private data and communications has become an ethical duty, using a glass-walls analogy.