1
Your Computer Isn't Yours
There have been several updates appended to this page as of 2020-11-16, please see below. Also available in: Türkçe Français Español Português Português…
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 42 posts.
2
Firefox and Chromium
Firefox is sometimes recommended as a supposedly more secure browser because of its parent company's privacy practices. This article explains why this notion is not true and enumerates a number of security weaknesses in Firefox's security model when compared to Chromium. In particular, it covers the less granular…
3
Android | Madaidan's Insecurities
By default, Android has a strong security model and incorporates full system SELinux policies , strong app sandboxing , full verified boot , modern exploit mitigations like fine-grained, forward-edge Control Flow Integrity and ShadowCallStack , widespread use of memory-safe languages (Java / Kotlin) and more. As such…
4
The Brave web browser is hijacking links, and inserting affiliate codes
How does this keep happening? It is a mystery.
5
Flatpak: A security nightmare – two years later
Flatpak - a security nightmare
6
Catalina is checking notarization of unsigned executables
This is a follow-up to Allan Odgaard's excellent article macOS 10.15: Slow by Design . I want to talk specifically about the first section "Spawning a new Process", because there has been widespread misunderstanding of this. Odgaard provides a simple test to show that the first run of an executable is delayed while…
7
Does Apple really log every app you run? A technical look
Apple’s launch of macOS Big Sur was almost immediately followed by server issues which prevented users from running third-party apps on their computers. While a workaround was soon found by people on Twitter, others raised some privacy concerns related to that issue.
8
Linux Hardening Guide
Linux is not a secure operating system . However, there are steps you can take to improve it. This guide aims to explain how to harden Linux as much as possible for security and privacy. This guide attempts to be distribution-agnostic and is not tied to any specific one. DISCLAIMER: Do not attempt to apply anything in…
9
Memory safe ‘curl’ for a more secure internet
tldr: work has started to make Hyper work as a backend in curl for HTTP. curl and its data transfer core, libcurl, is all written in C. The language C is known and infamous for not being memory safe and for being easy to mess up and as a result accidentally cause security problems. At … Continue reading rust in curl…
10
Who’s behind Wednesday’s epic Twitter hack?
Twitter was thrown into chaos on Wednesday after accounts for some of the world’s most recognizable public figures, executives and celebrities starting tweeting out links to bitcoin scams. Twitter says the attack happened because someone tricked or coerced an employee into providing access to internal Twitter…
11
NAT Slipstreaming
exploit NAT/firewalls to access TCP/UDP services bound to any system behind victim's NAT
12
When you browse Instagram and find Tony Abbott's passport number
Do not get arrested challenge 2020
13
Microsoft buys corp.com so bad guys can’t
In February, KrebsOnSecurity told the story of a private citizen auctioning off the dangerous domain corp.com for the starting price of $1.7 million . Domain experts called corp.com dangerous because years of testing showed whoever wields it would have access to an unending stream of passwords, email and other…
14
GPG and Me (2015)
I receive a fair amount of email from strangers. My email address is public, which doesn’t seemto be a popular choice these days, but I’ve received enough inspiring correspondence over the yearsto leave it be.When I receive a GPG encrypted email from a stranger, though, I immediately get the fee...
15
Why Is This Website Port Scanning Me?
Investigation of the practice of port scanning site visitors for fingerprinting and tracking.
16
Zero-day in Sign in with Apple
What if I say, your Email ID is all I need to takeover your account on your favorite website or an app. Sounds scary, right? This is what a…
17
Psychic Paper: iOS Sandbox Escape
Siguza’s Blog
18
19
Who’s behind the “reopen” domain surge?
The past few weeks have seen a large number of new domain registrations beginning with the word “reopen” and ending with U.S. city or state names. The largest number of them were created just hours after President Trump sent a series of all-caps tweets urging citizens to “liberate” themselves from new gun control…
20
72% of smart TVs and 46% of game consoles hardcode DNS settings
Welcome Hacker News readers!• Thank you to M. Hammad Mazhar for his research that inspired this guide.• @healyio made some great additional suggestions in th...
21
Dangerous domain corp.com goes up for sale
As an early domain name investor, Mike O’Connor had by 1994 snatched up several choice online destinations, including bar.com, cafes.com, grill.com, place.com, pub.com and television.com. Some he sold over the years, but for the past 26 years O’Connor refused to auction perhaps the most sensitive domain in his stable…
22
Whose Computer Is It?
Patrick Wardle highlighted a tweet by Maxwell (" Some Apple apps bypass some network extensions and VPN Apps. Maps for example can directly access the internet bypassing any NEFilterDataProvider or NEAppProxyProviders you have running "), sparking an extensive HN discussion on Apple's ham-fisted tactics (not unlike…
23
How to use FIDO2 USB keys with SSH
I recently installed Ubuntu Wacky Whatever, the latest version, and I’m very excited about it shipping with SSH 8.2, which means that I can finally use hardware USB keys for secure, easy to use authentication. If securing your devices has been something you’ve wanted to easily do yourself, read on, because it’s…
24
Ok Google: please publish your DKIM secret keys
The Internet is a dangerous place in the best of times. Sometimes Internet engineers find ways to mitigate the worst of these threats, and sometimes they fail. Every now and then, however, a major …
25
Ethereum Is a Dark Forest
A horror story.
26
Image Scaling Attacks
This post is part of a series about machine learning and artificial intelligence. Click on the blog tag “huskyai” to see related posts. Overview: …
27
Cryptic Rumblings Ahead of First 2020 Patch Tuesday
Sources tell KrebsOnSecurity that Microsoft Corp. is slated to release a software update on Tuesday to fix an extraordinarily serious security vulnerability in a core cryptographic component present in all versions of Windows . Those sources say Microsoft has quietly shipped a patch for the bug to branches of the U.S…
28
It’s 255:19AM. Do you know what your validation criteria are?
Ed25519 signature validation criteria vary widely between implementations, creating risks for consensus systems. Here's why and how to fix it.
29
Me on Covid-19 contact tracing apps
I was quoted in BuzzFeed: “My problem with contact tracing apps is that they have absolutely no value,” Bruce Schneier, a privacy expert and fellow at the Berkman Klein Center for Internet & Society at Harvard University, told BuzzFeed News. “I’m not even talking about the privacy concerns, I mean the efficacy. Does…
30
TikTok: Logs, Logs, Logs
We are in 2020 and the US president is about to ban TikTok, a video-sharing social network mobile app, because “it poses a risk to US…