961
Why I use Firefox
I’m interested in HTML, CSS, and making the web less annoying
New
The latest blog posts to take off on Hacker News. 4,333 posts.
962
TOTP Codes in the Terminal
The demise of Authy desktop has brought about a number of changes, probably the one of which I most appreciate is a mobile app which lets me edit codes: with 2FAS I can edit labels on codes, and I’...
963
Thanks FedEx, this is why we keep getting phished
I've been getting a lot of those "your parcel couldn't be delivered" phishing attacks lately and if you're a human with a phone, you probably have been too. Just as a brief reminder, they look like this: These get through all the technical controls that exist at
964
A beginner's guide to constant-time cryptography (2017)
For programmers new to cryptography, there are plenty of “known unknowns” – unfamiliar terms like “elliptic curves” and “random oracles”, and unnecessarily long acronyms (“RSASSA-PKCS-v1_5”, like really?). But what really gives cryptography its reputation is the unknown unknowns. The things that catch even experienced…
965
Exodus Bitcoin Wallet: $490k swindle
Edit: There’s a short follow-up to this post: Exodus Bitcoin Wallet: Follow up. tl;dr: A Bitcoin investor was recently scammed out of 9 Bitcoin (worth around $490K) in a fake “Exodus wallet” desktop application for Linux, published in the Canonical Snap Store. This isn’t the first time, and if nothing changes, it…
966
Microsoft is spying on users of its AI tools
Microsoft announced that it caught Chinese, Russian, and Iranian hackers using its AI tools—presumably coding tools—to improve their hacking abilities. From their report: In collaboration with OpenAI, we are sharing threat intelligence showing detected state affiliated adversaries—tracked as Forest Blizzard, Emerald…
967
U.S. Internet leaked years of internal, customer emails
The Minnesota-based Internet provider U.S. Internet Corp. has a business unit called Securence , which specializes in providing filtered, secure email services to businesses, educational institutions and government agencies worldwide. But until it was notified last week, U.S. Internet was publishing more than a…
968
Reverse-engineering an encrypted IoT protocol
Extract metrics from your GoodWe solar PV system, and improve its security too
969
Nextdoor's Heisensubscribe (and Other Dark Patterns)
Nextdoor's notification settings are hostile. This is not an isolated incident.
970
Final Decision on Chromebook Case in Denmark
The Danish DPA issues an injunction in the Chromebook case
971
Companies embracing SMS for account logins should be blamed for SIM-swap attacks
[UPDATE Since this was posted in 2024 : Major US telcos like AT&T, T-Mobile, and Verizon have suffered a months-long breach (the ongoing Salt Typhoon attack). These companies, of course, pass along the unencrypted SMSes vital to countless log in flows, account re-activations, and password resets. They are now known to…
972
973
I also hacked my car
Gonçalo MB. My personal website, projects, contacts and stuff.
974
Google has another secret browser
another hidden browser which is accessible by a link
975
The C bounded model checker: criminally underused
Follow along on a google colab: https://colab.research.google.com/github/philzook58/philzook58.github.io/blob/master/pynb/cbmc_tut.ipynb
976
Why Certificate Lifecycle Automation Matters
If you’ve perused the ActivityPub feed of certificates whose keys are known to be compromised , and clicked on the “Show More” button to see the name of the certificate issuer, you may have noticed that some issuers seem to come up again and again. This might make sense – after all, if a CA is issuing a large volume…
977
GitHub Spam
Spam on GitHub is getting out of control and affecting 10,000's of users daily. GitHub is seemly doing nothing about it, here is the proof.
978
I looked through attacks in my access logs
I've been self-hosting for over a decade. It's freeing because I own my data, and do not depend on any platform other than my cloud host, which I can easily switch off. Self-hosting gives much insight into what it takes to run a cloud service. Anyone
979
I hacked a train toilet
The other day I rode on a Class 800 train in the UK. This is the “Intercity Express” train designed to replace the venerable HST (Intercity 125 with Mark 3 coaches, a train of which I have many memories and which I will dearly miss).
980
981
Rook to XSS: How I hacked chess.com with a rookie exploit
Playing Chess is one of the many hobbies I like to do in my spare time, apart from tinkering around with technology. However, I'm not very good at it, and after losing many games, I decided to see if I could do something I'm much better at; hacking the system!
982
Breaking Free from DRM: Hacking My Air Purifier
I searched the web for a deal on a decent air purifier and the Xiaomi 4 Pro seemed to meet all my requirements. The filter size, scheduler and air volume ticked all the boxes. I set it up and thought nothing of it until last week my room was lit with the ‘ 0% remaining ’ replace filter warning. I had set my unit up to…
983
Forging signed commits on GitHub
Creating fake signed commits
984
985
Canadian man stuck in triangle of e-commerce fraud
A Canadian man who says he’s been falsely charged with orchestrating a complex e-commerce scam is seeking to clear his name. His case appears to involve “triangulation fraud,” which occurs when a consumer purchases something online — from a seller on Amazon or eBay , for example — but the seller doesn’t actually own…
986
Escaping surveillance capitalism, at scale
Self-hosting and paid subscriptions promise an escape from surveillance capitalism. What guarantees do they really offer, and at what cost?
987
Hacking into an insurance company by exploiting their premium calculator
A vulnerable API on Toyota Tsusho Insurance Broker India’s premium calculator website exposed Microsoft corporate cloud credentials.
988
RSA is deceptively simple and fun
While reading Real-World Cryptography , I came across the "million message attack" . This is an attack that Daniel Bleichenbacher demonstrated in 1998, which effectively broke RSA with a particular encoding function called PKCS #1 . It was only mentioned briefly, so I dug in and decided to try to understand the…
989
The Naz.API Credential Stuffing List
It feels like not a week goes by without someone sending me yet another credential stuffing list. It's usually something to the effect of "hey, have you seen the Spotify breach", to which I politely reply with a link to my old No, Spotify Wasn't Hacked blog post
990
Passwordless: a different kind of hell?
It's no secret that authenticating into services is an unresolved topic. With time, we have managed