Feed aggregator

Article URL: https://twitter.com/internetfreedom/status/2080586673977438351

Comments URL: https://news.ycombinator.com/item?id=49036049

Points: 3

# Comments: 0

Article URL: https://www.nature.com/articles/d41586-026-02267-0

Comments URL: https://news.ycombinator.com/item?id=49036032

Points: 1

# Comments: 0

Article URL: https://johnjeffers.com/how-to-manage-your-robot/

Comments URL: https://news.ycombinator.com/item?id=49036020

Points: 1

# Comments: 0

Article URL: https://grith.ai/blog/codex-credential-sweep-syscall-trace

Comments URL: https://news.ycombinator.com/item?id=49035983

Points: 5

# Comments: 0

Article URL: https://defnull.de/2026/bakers-club/

Comments URL: https://news.ycombinator.com/item?id=49035977

Points: 1

# Comments: 1

Article URL: https://www.nytimes.com/2026/07/24/arts/music/ai-music-faq.html

Comments URL: https://news.ycombinator.com/item?id=49035973

Points: 1

# Comments: 1

Article URL: https://sqlguard.app

Comments URL: https://news.ycombinator.com/item?id=49035966

Points: 1

# Comments: 0

Article URL: https://mtholyoke.com/dalbino/books/text/harpers01.html

Comments URL: https://news.ycombinator.com/item?id=49035953

Points: 1

# Comments: 0

Google has started rolling out a new way to recover access to your account if you’ve lost your phone or forgotten your password: a “selfie video” verification option.

After recording a short video of your face during setup, you can later submit another video during account recovery to prove you are who you claim to be and regain access.

On paper, this sounds like a user‑friendly solution to account lockouts. In practice, it introduces new security and privacy questions. It also raises concerns about deepfakes and creates another repository of sensitive biometric data that could become a target if compromised.

The idea is: you open your Google Account, go to Security & sign‑in, choose Selfie video, and follow guided prompts to record a short video with your face and basic movements. Google stores this enrolment video and later compares new videos you submit during sign‑in or account recovery to confirm your identity.

Image courtesy of 9to5google.com

While this may sound like a good idea, it’s a textbook example of trading long‑term security and privacy for short‑term convenience.

Google also offers several privacy reassurances. According to Google’s statements cited in coverage, the videos are encrypted at rest, stored “securely,” and can be deleted via your security settings. You can opt out of letting them be used to improve Google’s verification systems, and Google says they are not shared with third parties. The feature is marketed as a fallback method, effectively turning your face into a spare key to your digital life.

Multiple objections Security

Every face is unique, but facial recognition systems don’t compare photographs directly. Top‑tier facial recognition algorithms can exceed 99% accuracy in controlled, high‑quality conditions, according to evaluations by the US National Institute of Standards and Technology (NIST). That sounds impressive, but it still implies non‑zero false positives and false negatives, and performance drops as lighting, camera quality, and angle degrade.

Face recognition doesn’t store a literal photo. It stores a mathematical representation (embedding) of your facial features. At login or verification, the system computes a new embedding and compares it to the stored one, accepting if the similarity score is above a configured threshold. Any system used by Google has to allow for normal changes in appearance, including aging, weight changes, lighting, camera angle, glasses, or facial hair.

That alone makes using a face (or selfie video) as a standalone, high‑privilege credential, especially for account recovery, an inherently risky approach.

Modern deepfakes have become convincing enough that researchers are actively studying whether they can fool facial verification systems. One 2025 paper on AI and identity security found sophisticated deepfake attacks achieved success rates above 78% against some commercial facial verification systems in controlled tests. That doesn’t necessarily reflect Google’s implementation, but it shows how quickly this area is evolving.

Privacy

Personally, I do not want Google to have my face. Even though it probably already has plenty of photos of me.

Besides the potential risks of vulnerabilities and data breaches, Google already collects large amounts of behavioral data. Now it’s encouraging users to upload high‑fidelity video recordings of their faces and head movements as part of basic account management. Even if Google’s current privacy posture is reasonable (encryption at rest, deletion controls, no sharing), the mere existence of this data is a long‑term privacy risk.

Privacy policies and product uses also change over time. Today’s “not shared” could become tomorrow’s “used for fraud detection,” “used to improve verification systems,” or disclosed in response to lawful requests.

Google’s documentation, cited by some sources, says “users can also opt out of allowing the data to be used for additional purposes such as improving verification methods.” This implies that, unless you opt out, your data may be used to improve Google’s biometric verification systems. In other words, this isn’t just a one‑off security check. Your face could help train or refine the biometric systems Google uses in the future.

What users should do instead

If your Google Account offers selfie video sign‑in (mine doesn’t yet), my recommendation is simple: do not enable it, and if you’ve already tried it, delete your selfie video in your account’s security settings.

Safer options that keep control in your hands:

• Use a password manager and a long, unique password for your Google Account.
• Enable 2‑step verification with hardware security keys or passkeys rather than SMS codes.
• Keep backup codes printed or stored offline in a secure place.
• Regularly review your recovery email address and phone number, and remove anything you no longer control.

While these measures aren’t as flashy as “sign in with your face,” they are time‑tested, revocable, and far less attractive to deepfake operators and biometric data hunters.

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

The company has raised a total of $49 million in funding, including from Battery Ventures, Accel and Foundation Capital.

The post AegisAI Raises $36 Million for AI-Powered Email Security appeared first on SecurityWeek.

You probably think of your phone’s security the way you think of your front door: as long as you’re downloading apps from the Play Store, you’re safe. And for the most part, that’s true. Google reviews apps before they’re published.

But some apps reach your phone without ever passing through the Play Store.

Take Albiriox, a banking Trojan-as-a-service discovered late last year. It’s an Android Remote Access Trojan (RAT) built for on-device fraud. Instead of simply stealing usernames and passwords, it performs fraudulent transactions directly on the victim’s phone. Researchers found it spreading through apps with generic names like “utility,” “security,” “retailer,” or “investment” that victims didn’t remember installing from the Play Store. Instead, they had been sideloaded, downloaded through links in text messages, or installed from websites outside Google’s review process.

This is exactly the kind of threat Malwarebytes for Android is designed to detect. Here’s a look at the different layers of protection working behind the scenes.

I’d like to thank Malwarebytes Director of Software Development Egor Tashchilin for sharing the technical expertise that helped inform this article.

Catching what never went through the Play Store

Apps installed outside the Play Store never go through Google’s review process. That means they can reach your device without the security checks applied to Play Store apps.

Instead of relying on where an app came from, Malwarebytes scans your device itself, searching for Potentially Unwanted Programs (PUPs) and other malicious files, whether they were sideloaded, bundled with other software, or downloaded through a browser.

Even Play Store apps can turn nasty later 

Not every threat starts out malicious.  

In one widely reported case, a barcode scanner app with roughly 10 million installs on the Play Store had malicious code added to it that wasn’t present in previous versions. The update used heavy obfuscation to avoid detection and was signed with the same digital certificate as earlier clean versions, so it appeared completely legitimate. Once installed, it caused browsers to open on their own and redirect users to unwanted websites. 

A similar pattern has emerged in other Play Store incidents researchers have tracked. Apps are updated with malicious code long after installation as a way to evade detection and avoid raising suspicion. 

This is exactly why Real-Time Protection (RTP) doesn’t just watch for new installs—it also reacts to previously unscanned versions of apps you already have. RTP monitors newly installed apps, along with any new or changed files on your device. If an existing app receives a version it hasn’t seen before, RTP treats it as new and scans it, rather than assuming “already installed” means “still safe.” 

Looking inside archives, without touching them 

Malware doesn’t always sit out in the open, either. Cybercriminals often hide malicious files inside ZIP files and other archives, hoping a security scanner won’t bother looking inside.  

Ours does.  

It decompresses archive contents to inspect what’s inside without modifying or altering the original file. The archive is only ever read—we never write anything back to it. If something needs closer inspection, such as a nested archive or an APK’s compiled .dex code, it’s extracted to a temporary sandboxed location and deleted as soon as the scan is complete, so it’s never left on your device. 

Archives are not all handled the same way. ZIP files are inspected entry by entry, while APKs receive a deeper analysis  of the compiled code they contain. Nested archives are scanned independently too, so malware can’t simply hide one layer deeper. 

Scanning deeply, without draining your battery 

Analyzing an app in real depth—its code, behavior, and structure—takes processing power. Done carelessly, it can slow your phone and drain the battery. 

Malwarebytes is designed to avoid that.  

Automatic background scans, such as scheduled scans, scans after an app update, or after a reboot, check your battery conditions before they begin. Depending on your settings, they can wait until your phone is charging or has enough power. Manual Scans always run immediately. 

When a scan starts, Malwarebytes automatically adjusts its workload based on your device’s available processing power, allowing more capable devices to process work in parallel without overloading lower-end devices. 

A threat database that never sits still 

Mobile adware surged in the second half of 2025, while newer banking malware families have become increasingly sophisticated. Some even check whether they’re running on a real phone or inside a security test environment before revealing any malicious behavior.  

A scanner is only as good as its knowledge of what to look for. That’s why we continuously update our detection database with newly identified and verified threats rather than relying on a static, aging picture of the threat landscape. 

More than 10 scanners, working together 

Under the hood, Malwarebytes for Android isn’t a single scanning engine. It’s more than 10 specialized scanners, each designed to detect different kinds and levels of threats. 

That’s because modern Android malware rarely relies on just one technique. A banking Trojan, for example, may combine abuse of Accessibility Services with fake login screens placed over legitimate banking or cryptocurrency apps. 

Some scanners look for known indicators of malicious activity, while others examine an app’s structure, origin, and behavior. Additional layers combine multiple signals and use heuristic analysis to detect more complex or previously unseen threats. 

By layering multiple detection methods, a technique that slips past one scanner is more likely to be caught by another. 

And we don’t stop there. Our researchers continuously monitor how Android threats evolve and regularly add new detection and protection layers. As attackers develop new techniques and find new places to hide, we’re constantly adapting to stay one step ahead. 

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

Download for iOS → Download for Android → 

Tech sovereignty needs to be a part of the UK government’s reindustrialisation plans, and this requires an open source focus

Article URL: https://kickoffreport.com/how-our-prediction-model-works/

Comments URL: https://news.ycombinator.com/item?id=49033975

Points: 1

# Comments: 0

I have been using opencode for development and wrote an AI project that retrieves road network data and generates 3D models. However, every time a new dialog box pops up and requires me to modify a certain function, I have to trace the clues to find the implementation methods in other files. The context becomes cluttered and the reading speed is very slow. So, I wrote a VSCode plugin that can install the skill in one click. This enables the AI to write code with detailed comments. The plugin can also be converted into JSON. If the AI wants to know something, it can automatically call the interface to obtain the entire method chain and corresponding comment introduction. Reading a main function only takes a few seconds. To make it look better, I also created an HTML to display it. Of course, this is just for aesthetics. The plugin is open source and can be searched for in the vscode marketplace under "devmap". Although its practicality might be average, there are many similar projects on GitHub that are better than mine. However, seeing the network that my project has built up is still quite fulfilling.

Comments URL: https://news.ycombinator.com/item?id=49033971

Points: 1

# Comments: 0

Industry professionals debate whether it represents a lab containment failure or an unprecedented agentic capability milestone.

The post Industry Reactions to OpenAI Models Hacking Hugging Face: Feedback Friday appeared first on SecurityWeek.

Article URL: https://nimbus-docs.com/

Comments URL: https://news.ycombinator.com/item?id=49033951

Points: 1

# Comments: 0

Article URL: https://technicshistory.com/2026/07/24/the-ibm-pc-part-1-arrival/

Comments URL: https://news.ycombinator.com/item?id=49033916

Points: 2

# Comments: 0

Article URL: https://www.nytimes.com/2026/07/24/realestate/for-profit-affordable-housing-ascent.html

Comments URL: https://news.ycombinator.com/item?id=49033905

Points: 2

# Comments: 1

Article URL: https://blog.codacy.com/detecting-malicious-intent-across-ai-generated-pull-requests-a-governance-framework-for-engineering-leaders

Comments URL: https://news.ycombinator.com/item?id=49033883

Points: 1

# Comments: 0