211
EFF's New Wordlists for Random Passphrases
Joe Bonneau dives deep into systems using dice to generate random passphrases and introduces EFF's three new wordlists.
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 1,584 posts.
212
Announcing the first SHA-1 collision
Posted by Marc Stevens (CWI Amsterdam), Elie Bursztein (Google), Pierre Karpman (CWI Amsterdam), Ange Albertini (Google), Yarik Markov (Goog...
213
Teen on Musk's DOGE team graduated from 'The Com'
Wired reported this week that a 19-year-old working for Elon Musk ‘s so-called Department of Government Efficiency (DOGE) was given access to sensitive US government systems even though his past association with cybercrime communities should have precluded him from gaining the necessary security clearances to do so…
214
Security advisory: Critical remote code execution vulnerabilities, update now
PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.
215
NSO group iPhone zero-click, zero-day exploit captured in the wild
Citizen Lab found an actively exploited zero-click vulnerability being used to deliver NSO Group’s Pegasus mercenary spyware while checking the device of an individual employed by a Washington DC-based civil society organization with international offices. We refer to the exploit chain as BLASTPASS. The exploit chain…
216
LastPass autofill exploit
Mathias Karlsson decided to check out the security of the LastPass browser extensions. Here's what he found.
217
Chrome users beware: Manifest v3 is deceitful and threatening
Like FLoC and Privacy Sandbox before it, Google Chrome’s Manifest V3 is another example of the inherent conflict of interest that comes from Google controlling both the dominant web browser and one of the largest internet advertising networks.
218
Mythos Finds a Curl Vulnerability
yes, as in singular one. Back in April 2026 Anthropic caused a lot of media noise when they concluded that their new AI model Mythos is dangerously good at finding security flaws in source code. Apparently Mythos was so good at this that Anthropic would not release this model to the public yet but instead … Continue…
219
Hardening Firefox with Anthropic's Red Team
Claude Opus 4.6 found 22 Firefox vulnerabilities in two weeks, 14 rated high-severity, with proofs-of-concept and candidate patches for Mozilla.
220
The Brave web browser is hijacking links, and inserting affiliate codes
How does this keep happening? It is a mystery.
221
222
Archive.today is directing a DDoS attack against my blog
Around January 11, 2026, archive.today (aka archive.is, archive.md, etc) started using its users as proxies to conduct a distributed denial of service (DDOS) attack against Gyrovague, my personal b…
223
Apple can comply with the FBI court order
Earlier today, a federal judge ordered Apple to comply with the FBI’s request for technical assistance in the recovery of the San Bernadino gunmen’s iPhone 5C. Since then, many have argued whether these requests from the FBI are technically feasible given the support for strong encryption on iOS devices. Based on my…
224
Sharing details on a recent incident impacting one of our customers
Google Cloud shares details of an incident impacting one Australian customer's use of Google Cloud VMware Engine. Learn what happened and how we're preventing it from happening again.
225
NSA and IETF: Can an attacker purchase standardization of weakened cryptography?
It's normal for post-quantum cryptography to be rolled out as an extra layer of security on top of traditional pre-quantum cryptography, rather than as a replacement .
226
No, don't enable revocation checking
Revocation checking is in the news again because of a large number of revocations resulting from precautionary rotations for servers affected by the OpenSSL heartbeat bug. However, revocation checking is a complex topic and there's a fair amount of misinformation around. In short, it doesn't work and you are no more…
227
Let’s talk about PAKE
The first rule of PAKE is: nobody ever wants to talk about PAKE. The second rule of PAKE is that this is a shame, because PAKE — which stands for Password Authenticated Key Exchange — is actually o…
228
Distrusting New WoSign and StartCom Certificates
Mozilla has discovered that a Certificate Authority (CA) called WoSign has had a number of technical and management failures. Most seriously, we discovered they were backdating SSL certificates in order ...
229
Negative Result: Reading Kernel Memory from User Mode
I were going to write an introduction about how important negative results can be. I didn’t. I assume you can figure out for yourself why that is and if not you got all the more reason to read this blog post. If you think it’s trivial why my result is negative, you definitely need to read the blog post.
230
Why Constant-Time Crypto?
In 1996, Paul Kocher published a novel attack on RSA, specifically on RSA implementations , that extracted information on the private key by simply measuring the time taken by the private key operation on various inputs. It took a few years for people to accept the idea that such attacks were practical and could be…
231
Chrome phasing out Manifest v2 support from Jan 2022
Details of the Manifest V2 phase-out and end of life.
232
Final post on Javascript crypto
The talk I gave last year on common crypto flaws still seems to generate comments. The majority of the discussion is by defenders of Javascript crypto. I made JS crypto a very minor part of the tal…
233
Cloudflare supports Privacy Pass
Cloudflare supports Privacy Pass, a recently-announced privacy-preserving protocol developed in collaboration with researchers from Royal Holloway and the University of Waterloo.
234
How To Create an SSH CA to Validate Hosts and Clients with Ubuntu
When dealing with an extensive infrastructure and many team members, managing SSH keys for authentication can become unwieldy. However, SSH can utilize cert…
235
My Experience With the Great Firewall of China
When I recently visited China for the first time,as an InfoSec professional I was very curious to finally be able to poke at theGreatFirewall of China with m...
236
Multi-Perspective Validation Improves Domain Validation Security
At Let’s Encrypt we’re always looking for ways to improve the security and integrity of the Web PKI. We’re proud to launch multi-perspective domain validation today because we believe it’s an important step forward for the domain validation process. To our knowledge we are the first CA to deploy multi-perspective…
237
Blocking-resistant communication through domain fronting
David Fifield, University of California, Berkeley Chang Lan, University of California, Berkeley Rod Hynes, Psiphon Inc Percy Wegmann, Brave New Software Vern Paxson, University of California, Berkeley and the International Computer Science Institute
238
How Do Lava Lamps Help with Internet Encryption?
The Cloudflare lava lamps are used for Internet encryption. Learn about entropy in cryptography and why randomness is essential for SSL encryption.
239
240
Firefox 85 cracks down on supercookies
Trackers and adtech companies have long abused browser features to follow people around the web. Since 2018, we have been dedicated to reducing the number of ways our users can ...