991
How does Apple privately find offline devices?
At Monday’s WWDC conference, Apple announced a cool new feature called “Find My”. Unlike Apple’s “Find my iPhone”, which uses cellular communication and the lost…
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 1,584 posts.
992
993
Have I Been Pwned Is Now Partnering with 1Password
The penny first dropped for me just over 7 years ago to the day: The only secure password is the one you can't remember [https://www.troyhunt.com/only-secure-password-is-one-you-cant/]. In an era well before the birth of Have I Been Pwned [https://haveibeenpwned.
994
Equifax Breach Fallout: Your Salary History
In May, KrebsOnSecurity broke a story about lax security at a payroll division of big-three credit bureau Equifax that let identity thieves access personal and financial data on an unknown number of Americans. Incredibly, this same division makes it simple to access detailed salary and employment history on a large…
995
Critical Security Issue Identified in iTerm2
A security audit funded by Mozilla has discovered a critical security vulnerability in the widely used macOS terminal emulator iTerm2.
996
One Token to rule them all – Obtaining Global Admin in every Entra ID tenant
While preparing for my Black Hat and DEF CON talks in July of this year, I found the most impactful Entra ID vulnerability that I will probably ever find. One that could have allowed me to compromise every Entra ID tenant in the world (except probably those in national cloud deployments). If you are an Entra ID admin…
997
Improving the security of your SSH private key files
Update (July 2015): This post is now rather outdated, and the procedure for modifying your private key files is no longer recommended. A better solution is to use ssh-keygen -o .
998
Compromised PyTorch-nightly dependency chain between December 25th – December 30
If you installed PyTorch-nightly on Linux via pip between December 25, 2022 and December 30, 2022, please uninstall it and torchtriton immediately, and use the latest nightly binaries (newer than...
999
RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit
The Visual Studio Code server in Windows Subsystem for Linux uses a local WebSocket WebSocket connection to communicate with the Remote WSL extension. JavaScript in websites can connect to this server and execute arbitrary commands on the target system. Assigned CVE-2021-43907 and zero bounty. I paid 5 USD for the EC2…
1000
Living with HTTPS
( These are my notes from the first half of my talk at HOPE9 last weekend. I write notes like these not as a script, but so that I have at least some words ready in my head when I'm speaking. They are more conversational and less organised than a usual blog post, so please forgive me the rough edges. )
1001
Docker Security Cheat Sheet
Website with the collection of all the cheat sheets of the project.
1002
FBI Breaks into iPhone. We Have Some Questions
The FBI has successfully accessed data on an iPhone that has been the subject of a legal battle between the Justice Department and Apple, according to a court filing. EFF is pleased that the Justice Department has retreated from its dangerous and unconstitutional attempt to force Apple to subvert...
1003
Let’s Encrypt client will transition to a new name and a new home at EFF
Update: Added clarification that only the Let’s Encrypt client software is changing its name and host. The Let’s Encrypt certificate authority and associated services are not changing names or relocating. Over the next few months the Let’s Encrypt client software will transition to a new name, soon to be announced…
1004
Industry Concerns about TLS 1.3
Search IETF mail list archives
1005
Modern Alternatives to PGP
Did your last Yubikey just break? Perhaps you forgot an offline backup password. Maybe you’re just tired of living like a spy and never using smartphones. Whatever it is, you’re here, and you’re finally ready to give up on PGP. That’s great! We’re here to help! No one was sending you encrypted emails anyway, so that’s…
1006
1007
1008
GrayKey iPhone unlocker poses serious security concerns
Ever since the case of the San Bernadino shooter pitted Apple against the FBI over the unlocking of an iPhone, opinions...
1009
Psychic Signatures in Java
The long-running BBC sci-fi show Doctor Who has a recurring plot device where the Doctor manages to get out of trouble by showing an identity card which is actually completely blank. Of course, thi…
1010
Missouri governor’s office responsible for teacher data leak
Missouri Governor Mike Parson made headlines last year when he vowed to criminally prosecute a journalist for reporting a security flaw in a state website that exposed personal information of more than 100,000 teachers. But Missouri prosecutors now say they will not pursue charges following revelations that the data…
1011
The GNU Name System
This document provides the GNU Name System (GNS) technical specification. GNS is a decentralized and censorship-resistant domain name resolution protocol that provides a privacy-enhancing alternative to the Domain Name System (DNS) protocols. This document defines the normative wire format of resource records…
1012
Making an SSH client the hard way
Explore Tailscale SSH Console, a web-based SSH client that simplifies connecting to your devices. Learn how Tailscale integrates WebAssembly, WireGuard, and SSH for secure, password-free access right from your browser."
1013
Don’t try to sanitize input – escape output
Why you should escape output correctly, but generally not sanitize user input.
1014
1015
LG Smart TVs log USB filenames and viewing info to LG servers
Earlier this month I discovered that my new LG Smart TV was displaying ads on the Smart landing screen. After some investigation, I f...
1016
Chinese Government Fabricates Social Media Posts for Strategic Distraction
The Chinese government has long been suspected of hiring as many as 2,000,000 people to surreptitiously insert huge numbers of pseudonymous and other deceptive writings into the stream of real social media posts, as if they were the genuine opinions of ordinary people. Many academics, and most journalists and…
1017
An experimental real world adblock
Corporate branding and advertisements are ubiquitous in society today and almost impossible to avoid. What if we lived in a world where consumers were blind to this surplus of corporate branding? Brand Killer is a technology demonstration that envisions a future in which consumers can use augmented reality to opt out…
1018
SMTP Smuggling – Spoofing Emails Worldwide
Introducing a novel technique for e-mail spoofing
1019
Google's Backdoor Access System into Gmail Accounts
Google made headlines when it went public with the fact that Chinese hackers had penetrated some of its services, such as Gmail, in a politically motivated attempt at intelligence gathering. The news here isn’t that Chinese hackers engage in these activities or that their attempts are technically sophisticated—we knew…
1020
First in-the-wild UEFI bootkit bypassing UEFI Secure Boot
ESET researchers are the first to publish an analysis of BlackLotus, the first in-the-wild UEFI bootkit capable of bypassing UEFI Secure Boot.