Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 684 posts.
SMS text messages were already the weakest link securing just about anything online, mainly because there are tens of thousands of employees at mobile stores who can be tricked or bribed into swapping control over a mobile phone number to someone else. Now we’re learning about an entire ecosystem of companies that…
You may be concerned that the NSA is reading your e-mail. Is there really anything you can do about it though? After all, you don’t really want to move off of GMail / Google Apps. And no plac…
FINAL STATUS (2026-10-21): the CVE-2026-109618 / CVE-2026-109619 memory-corruption class shipped patches 2026-10-21. On the patch, that class is closed: the cached-pointer chain dies at the addref and the serialize-state path is a memory-safety bug, not code execution. Two session-handling flaws survive on…
John Gilmore , an American entrepreneur and civil libertarian, once famously quipped that “the Internet interprets censorship as damage and routes around it.” This notion undoubtedly rings true for those who see national governments as the principal threats to free speech.
This is the introduction of a multipart series. It is to give a high level overview without really deeply diving into any individual component.
The big tech news this week is that the FBI is trying to force Apple to unlock a suspect's iPhone. One of the interesting points around this story is that the iPhone in question is an older one, an iPhone 5c. Newer phones have what Apple calls the Secure Enclave, which some say protects against requests of this…
Applied Cryptography taught two generations of developers what they know about crypto, and it is a dreadful instruction manual. The book to replace it with, and what you still have to learn after.
There's been some discussion about forward secret TLS recently, spurred, I think, by this piece from Declan McCullagh on CNET.
2021 update: Browsers now implicitly set rel=noopener for any target=_blank link, following a spec change . If the demo on this page no longer seems scary, congratulations — you’re using a modern browser!
blog about networking, cameras, old gear, and xmpp
How participation in Facebook's bug bounty not only led to the complete compromise of Instagram, but also legal threats and intimidation
Until a few years ago, any app you installed on an Android device could see all other apps on your phone without your permission.
The past few weeks have seen a large number of new domain registrations beginning with the word “reopen” and ending with U.S. city or state names. The largest number of them were created just hours after President Trump sent a series of all-caps tweets urging citizens to “liberate” themselves from new gun control…
I extracted the certificate from the SuperFish adware and cracked the password (" komodia ") that encrypted it. I discuss how down below. T...
A security architect with the National Labor Relations Board (NLRB) alleges that employees from Elon Musk ‘s Department of Government Efficiency (DOGE) transferred gigabytes of sensitive data from agency case files in early March, using short-lived accounts configured to leave few traces of network activity. The NLRB…
Date: March 7, 2111
Back in 2013, I was beginning to get the sense that data breaches were becoming a big thing. The prevalence of them seemed to be really ramping up as was the impact they were having on those of us that found ourselves in them, myself included. Increasingly, I was writing
In this post I’ll show you how I found a zeroday vulnerability in the Linux kernel using OpenAI’s o3 model. I found the vulnerability with nothing more complicated than the o3 API ̵…
I’ve been doing the local usergroup circuit with this lately and have been asked to write it up.
Andres Freund published the existence of the xz attack on 2024-03-29 to the public oss-security@openwall mailing list. The day before, he alerted Debian security and the (private) distros@openwall list. In his mail, he says that he dug into this after “observing a few odd symptoms around liblzma (part of the xz…
Today, we deployed HTTPS by default on Stack Overflow. All traffic is now redirected to https:// and Google links will change over the next few weeks. The ac...
Welcome Hacker News readers!• Thank you to M. Hammad Mazhar for his research that inspired this guide.• @healyio made some great additional suggestions in th...
Yesterday Andres Freund emailed oss-security@ informing the community of the discovery of a backdoor in xz/liblzma, which affected OpenSSH server (huge respect for noticing and investigating this). Andres' email is an amazing summary of the whole drama, so I'll skip that. While admittedly most juicy and interesting…
If you have just/as of late gotten an email about your keys being revoked, this is because of me, and if you have, you should really go through and make sure that no one has done anything terrible to you, since you have opened yourself to people doing very mean things to you for what is most likely a very long time.
