A series of registry hijacks of the .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) ccTLDs allowed attackers to modify authoritative DNS records and obtain unauthorized HTTPS certificates covering Google domains and many other organizations. Chrome responded immediately by blocking those unauthorized certificates in the browser using CRLSets and coordinating with issuing Certificate Authorities to revoke the certificates so non-Chrome clients were protected. Analysis of Certificate Transparency logs uncovered additional affected brands and services; Chrome proactively blocked those certificates as well and reached out to impacted organizations. Chrome says end users of the browser do not need to take any action.
Chrome warns that browser-side mitigations are not a substitute for domain owner defenses and outlines concrete steps: continuous monitoring of Certificate Transparency logs for unexpected issuance across all domain holdings, and publishing restrictive CAA records with ACME account bindings to limit which CAs and accounts can issue certificates. CAA helps prevent new issuance after DNS control is restored and mitigates reuse of cached domain-control validations. Chrome also commits to ecosystem changes - reducing certificate validity and DCV reuse through the Chrome Root Program and a new quantum-resistant root initiative - to limit the impact of transient routing and DNS compromises.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A lawsuit claims Starbucks misleadingly labels some drinks as sugar-free despite containing significant sugar, up to 21 grams. Starbucks denies the allegations, stating the sugar comes from milk proteins and not added sugar. (gizmodo.com)
YGGSTORE enables friends to share sharded, encrypted storage using Yggdrasil, allowing them to lend disk space and send files securely. Files are exchanged by sending sealed stubs, ensuring privacy and security in peer-to-peer storage. (github.com)
Sara Gordon's research questions the scientific validity of forensic techniques like blood pattern analysis and ballistics, which are often accepted uncritically in court. Studies show these methods have significant uncertainties and rely more on subjective interpretation than rigorous science. (nautil.us)
Hackers hijacked three top-level domains and issued counterfeit TLS certificates for Google and other major services. Google updated Chrome to block these unauthorized certificates and revoked them with issuing authorities. (arstechnica.com)
Explosive ordnance disposal teams faced a rare challenge when uncovering WWII bombs in Plymouth and Exmouth in 2026. Experts used specialized robots and careful procedures to safely defuse the bombs, which could have caused widespread destruction if detonated. (theguardian.com)
Elon Musk and Palmer Luckey's roles in a Pentagon study on future warfare raise ethical concerns about conflicts of interest, as both have significant defense contracts and financial stakes. Critics warn that their involvement may bias the study toward promoting their own military technology interests. (text.npr.org)
Today's best Hacker News stories, summarized and screenshotted, one email a day.