391
Understanding ECDSA
Exploring blockchain, math, and smart contracts through a security lens.
New
The latest blog posts to take off on Hacker News. 4,333 posts.
392
Kohler Can Access Pictures from "End-to-End Encrypted" Toilet Camera
Claimed end-to-end privacy doesn’t fully conceal your rear-end data
393
Constructing the Word's First JPEG XL MD5 Hash Quine
A walk through of building an image that displays its own MD5 Hash
394
Stopping bad guys from using my open source project (feedback wanted)
I maintain a sorta-popular open source package, and I want to prevent big corporations and "bad guys" from using it. I want feedback on how to do this.
395
Landlock-Ing Linux
Landlock is a Linux API that lets applications explicitly declare which resources they are allowed to access. Its philosophy is similar to OpenBSD’s unveil() and (less so) pledge() : programs can make a contract with the kernel stating, “I only need these files or resources — deny me everything else if I’m…
396
Running Unsupported iOS on Deprecated Devices
Earlier this year I demoed iOS 6 running on an iPod touch 3 - a device that Apple never gave iOS 6 to, making iOS 5.1.1 the latest build it can run
397
398
X Just Accidentally Exposed a Covert Influence Network Targeting Americans
How a new X feature led to the most sweeping public exposure of covert foreign activity on a major platform since 2016.
399
NSA and IETF, part 3: Dodging the issues at hand
Normal practice in deploying post-quantum cryptography is to deploy ECC+PQ. IETF's TLS working group is standardizing ECC+PQ. But IETF management is also non-consensually ramming a particular NSA-driven document through the IETF process, a "non-hybrid" document that adds just PQ as another TLS option.
400
Signal knows who you're talking to (2023)
Recently I got a friend to finally join me on Signal. He asked something about whether or not Signal is truly secure and private, like if it was safe from US government surveillance. I told him: “Well, it’s end-to-end encrypted, so they don’t know what we’re talking about, but they definitely know that we’re talking…
401
A Reverse Engineer's Anatomy of the macOS Boot Chain and Security Architecture
1.0 The Silicon Root of Trust: Pre-Boot & Hardware Primitives The security of the macOS platform on Apple Silicon is not defined by the kernel; it is d...
402
The privacy nightmare of browser fingerprinting
If you were worried about tracking cookies, you really don’t want to know about browser fingerprinting.
403
Mozilla says it's finally done with Onerep
In March 2024, Mozilla said it was winding down its collaboration with Onerep — an identity protection service offered with the Firefox web browser that promises to remove users from hundreds of people-search sites — after KrebsOnSecurity revealed Onerep’s founder had created dozens of people-search services and was…
404
Go Cryptography State of the Union
I delivered my traditional Go Cryptography State of the Union talk at GopherCon US 2025 in New York. It goes into everything that happened at the intersection of Go and cryptography over the last year.
405
Okta's NextJS-0auth troubles
When AI engineering fails: Dealing with hallucinations, misattribution, and broken code in an Okta/Auth0 pull request maintained by AI.
406
I caught Google Gemini using my data and then covering it up
I asked Google Gemini a pretty basic developer question. The answer was unremarkable, apart from it mentioning in conclusion that it knows I previously used ...
407
Cities panic over having to release mass surveillance recordings
Flock's 'licence plate readers' read much more than license plates. A judge says what they record must be released.
408
I have recordings proving Coinbase knew about breach months before disclosure
I have recordings and emails showing attacks months before Coinbase's 'discovery'. Timeline, headers, and audio evidence.
409
Reverse Engineering Yaesu FT-70D Firmware Encryption
This article dives into my full methodology for reverse engineering the tool mentioned in this article. It's a bit longer but is intended to be accessible to folks who aren't necessarily advanced reverse-engineers.
410
411
Chat Control 2.0 through the back door
Just before a decisive meeting in Brussels, digital rights expert and former Member of the European Parliament Dr. Patrick Breyer is sounding the alarm. Using a "deceptive sleight of hand," a mandatory and expanded Chat Control is being pushed through the back door, in a form even more intrusive tha
412
I didn't reverse-engineer the protocol for my blood pressure monitor in 24 hours
The personal website of James Belchamber.
413
Drilling down on Uncle Sam's proposed TP-Link ban
The U.S. government is reportedly preparing to ban the sale of wireless routers and other networking gear from TP-Link Systems , a tech company that currently enjoys an estimated 50% market share among home users and small businesses. Experts say while the proposed ban may have more to do with TP-Link’s ties to China…
414
IP blocking the UK is not enough to comply with the Online Safety Act
A follow up to The Ofcom Files. Some notes on Ofcom’s strategy to date. As many of you know, I represent the U.S. website 4chan, pro bono, in its U.S. federal lawsuit against the UK…
415
Firefox Forcing LLM Features
Mozilla forcing llm features and providing no gui for users to disable them
416
Cloudflare scrubs Aisuru botnet from top domains list
For the past week, domains associated with the massive Aisuru botnet have repeatedly usurped Amazon , Apple , Google and Microsoft in Cloudflare’s public ranking of the most frequently requested websites. Cloudflare responded by redacting Aisuru domain names from their top websites list. The chief executive at…
417
Two billion email addresses were exposed
I hate hyperbolic news headlines about data breaches, but for the "2 Billion Email Addresses" headline to be hyperbolic, it'd need to be exaggerated or overstated - and it isn't. It's rounded up from the more precise number of 1,957,476,021 unique email addresses, but other
418
New prompt injection papers: Agents rule of two and the attacker moves second
Two interesting new papers regarding LLM security and prompt injection came to my attention this weekend. Agents Rule of Two: A Practical Approach to AI Agent Security The first is …
419
Alleged Jabber Zeus Coder 'MrICQ' in U.S. Custody
A Ukrainian man indicted in 2012 for conspiring with a prolific hacking group to steal tens of millions of dollars from U.S. businesses was arrested in Italy and is now in custody in the United States, KrebsOnSecurity has learned.
420
Notes by djb on using Fil-C
I'm impressed with the level of compatibility of the new memory-safe C/C++ compiler Fil-C (filcc, fil++). Many libraries and applications that I've tried work under Fil-C without changes, and the exceptions haven't been hard to get working.