511
Cross-Site Request Forgery
Cross-Site Request Forgery countermeasures can be greatly simplified using request metadata provided by modern browsers.
New
The latest blog posts to take off on Hacker News. 4,333 posts.
512
When DEF CON partners with the U.S. Army
DEF CON has alienated many hackers by officially aligning its geopolitics with those of the U.S. military and announcing partnerships with the authoritarian countries of Bahrain and Singapore.
513
Vanishing from Hyundai’s data network
Finding and disabling the cellular modem for BlueLink in the Kona EV
514
My Lethal Trifecta talk at the Bay Area AI Security Meetup
I gave a talk on Wednesday at the Bay Area AI Security Meetup about prompt injection, the lethal trifecta and the challenges of securing systems that use MCP. It wasn’t …
515
Emailing a one-time code is worse than passwords
where my words occasionally escape /dev/null
516
Who got arrested in the raid on the XSS crime forum?
On July 22, 2025, the European police agency Europol said a long-running investigation led by the French Police resulted in the arrest of a 38-year-old administrator of XSS, a Russian-language cybercrime forum with more than 50,000 members. The action has triggered an ongoing frenzy of speculation and panic among XSS…
517
Spotting base64 encoded JSON, certificates, and private keys
A colleague spotted base64-encoded JSON in a long string of gibberish without any tools. I was amazed, until he explained how anyone can do it.
518
Passkeys are just passwords that require a password manager
You reset your passkey the same way you reset your password. But you’ll find that passkeys make it harder to switch between password…
519
AWS deleted my 10-year account and all data without warning
After 10 years as an AWS customer and open-source contributor, they deleted my account and all data with zero warning. Here's how AWS's 'verification' process became a digital execution, and why you should never trust cloud providers with your only copy of anything.
520
Self-Signed JWTs
An auth scheme where you let yourself in.
521
How did Facebook intercept competitor's encrypted mobile app traffic? (2024)
A technical investigation into information uncovered in a class action lawsuit that Facebook had intercepted encrypted traffic from user's devices running the Onavo Protect app in order to gain competitive insights.
522
523
What is gVisor?
It has been a really long time since I last wrote something here as life happens, things get busier, etc etc. I am now trying to get back into writing things down and here we go! So, imagine a tool or a service that allows you to run some arbitrary code via a shell. Either through a ssh or more commonly, via a web…
524
PSA: SQLite WAL checksums fail silently and may lose data
SQLite WAL has checksums, but on corruption it drops all the data and does not raise error
525
A valid HTML zip bomb
<h1 id="a-valid-html-zip-bomb"><a tabindex="0" class="anchor" href="/notes/html_zip_bomb">A valid HTML zip bomb</a></h1><p><img src="/notes/res/zip_bomb_file.svg" alt="Illustration d'une bombe zip" height="150" width="150"> Many sites have been affected by the aggressiveness of web crawlers designed to improve…
526
Jitsi privacy flaw enables one-click stealth audio and video capture
A Jitsi feature allows an attacker to transmit user's microphone and camera in the background without their consent.
527
Yes, the Book of PF, fourth edition is coming soon
© 2025 Peter N. M. Hansteen Long rumored and eagerly anticipated by some, the fourth edition of The Book of PF is now available for ...
528
Fun with gzip bombs and email clients
I served a 10MB gzip bomb as an image in HTML email. Most clients and proxies coped, iOS Mail crashed and Evolution wrote 100GB of cache to my disk.
529
530
SQL Injection as a Feature
Looking at old applications, we always wonder who in their right mind thought of building them so badly. But every repository has its story and every effort has noble origins. I encountered such an ap
531
532
When root meets immutable: OpenBSD chflags vs. log tampering
Rafael Sadowski
533
Fully homomorphic encryption and the dawn of a private internet
This article is archived on mirror.xyz , and attracted discussion on Hacker News Generated by this notebooklm Gene Spafford "Using encryption on the…
534
My bank keeps on undermining anti-phishing education
TLDR: my bank sent out emails with websites which looked a lot like phishing mails, so much so that this similarity could potentially be used against them legally by potential phishing victims Discussion at hackernews: https://news.ycombinator.com/item?id=44592377 Chapter 1: You’ve got mail As I was writing my first…
535
OpenAI – vulnerability responsible disclosure
Update with OpenAI response added What happened? On 29 May 2025 I privately reported a vulnerability to the OpenAI disclosure mailbox using an encrypted email. The flaw allows peeking at chat responses intended for other users. This content may contain personal data, confidential business plans, …
536
DOGE Denizen Marko Elez Leaked API Key for xAI
Marko Elez , a 25-year-old employee at Elon Musk’s Department of Government Efficiency (DOGE), has been granted access to sensitive databases at the U.S. Social Security Administration, the Treasury and Justice departments, and the Department of Homeland Security. So it should fill all Americans with a deep sense of…
537
Encrypting files with passkeys and age
Encrypting files with passkeys, using the WebAuthn prf extension and the TypeScript age implementation.
538
A technical look at Iran's internet shutdowns
This post is written by a human being (me).
539
Bypassing Google's big anti-adblock update
Hello, I'm Derin!
540
Supreme Court's ruling practically wipes out free speech for sex writing online
Am I now committing civil disobedience... just by keeping my personal literary website up as is?