631
Avoid ISP Routers (2024)
Avoid ISP routers
New
The latest blog posts to take off on Hacker News. 679 posts.
632
How to turn off Apple Intelligence
Learn how to turn off Apple Intelligence on iPhone, iPad, or Mac. Asurion Experts show you step-by-step how to manage your Apple devices’ smart features.
633
Hell is overconfident developers writing encryption code
Overconfident developers that choose to write their own cryptography code have plagued the information security industry since before it was even an industry. This in and of itself isn’t inhe…
634
FBI, Dutch police disrupt 'Manipulaters' phishing gang
The FBI and authorities in The Netherlands this week seized dozens of servers and domains for a hugely popular spam and malware dissemination service operating out of Pakistan. The proprietors of the service, who use the collective nickname “ The Manipulaters ,” have been the subject of three stories published here…
635
California law enforcement misused state databases more than 7k times in 2023
The Los Angeles County Sheriff’s Department (LACSD) committed wholesale abuse of sensitive criminal justice databases in 2023, violating a specific rule against searching the data to run background checks for concealed carry firearm permits.The sheriff’s department’s 6,789 abuses made up a majority...
636
Decompiling 2024: A Year of Resurgance in Decompilation Research
The year 2024 was a resurgent year for decompilation. Academic publications from that year made up nearly 30% of all top publications ever made in decompilation. In this post, I do a summarization and retrospective of both the academic and ideological progress of decompilation in 2024. Hint: decompilation research is…
637
Exposed DeepSeek database leaking sensitive information, including chat history
A publicly accessible database belonging to DeepSeek allowed full control over database operations, including the ability to access internal data. The exposure includes over a million lines of log streams with highly sensitive information.
638
We got hit by an alarmingly well-prepared phish spammer
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
639
The protester's guide to smartphone security
Your phone is an essential tool, but it also represents a huge risk to your privacy and security. Understanding these best practices when it comes to securing your smartphone will help keep you and your data safe.
640
What's OAuth2, anyway?
Why the OAuth2 protocol was designed the way it is and how it works.
641
Texas Is Enforcing Its State Data Privacy Law. So Should Other States
States need to have and use data privacy laws to bring privacy violations to light and hold companies accountable for them. So, we were glad to see that the Texas Attorney General’s Office has filed its first lawsuit under Texas Data Privacy and Security Act (TDPSA) to take the Allstate Corporation...
642
Little Snitch feature nobody knows about
Little Snitch by Objective Development is the first app that I install on a new Mac. In fact I just bought a new Mac, an M4 MacBook Pro with nano-texture display, and I installed Little Snitch via thumb drive even before connecting the Mac to the internet. While setting up my new Mac, which came with macOS 15.2…
643
Susctl CVE-2024-54507: A particularly 'sus' sysctl in the XNU kernel
A very sus sysctl in the XNU kernel.
644
Shifting Cyber Norms: Microsoft security POST-ing to you
tl;dr: Microsoft and other email security scanners will visit the links in email you transmit, and run the JavaScript in those links, including calls that lead to POSTs going out. This used to be unacceptable, since POSTs have side effects. Yet here we are. This breaks even somewhat sophisticated single-use sign-on /…
645
Hacking Subaru: Tracking and controlling cars via the admin panel
On November 20, 2024, Shubham Shah and I discovered a security vulnerability in Subaru’s STARLINK admin panel that gave us unrestricted access to all vehicles and customer accounts in the United States, Canada, and Japan.
646
Federal Court (Finally) Rules Backdoor Searches of Data Unconstitutional
In a landmark ruling, a federal district court held that backdoor searches of databases full of Americans’ private communications collected under Section 702 ordinarily require a warrant. Congress should uphold its responsibility to protect civil rights and civil liberties by refusing to renew Section 702 absent a…
647
Mastercard DNS error went unnoticed for years
The payment card giant MasterCard just fixed a glaring error in its domain name server settings that could have allowed anyone to intercept or divert Internet traffic for the company by registering an unused domain name. The misconfiguration persisted for nearly five years until a security researcher spent $300 to…
648
Reverse engineering Call of Duty anti-cheat
Interested in Anti-Cheat analysis? I highly recommend checking out Guided Hacking’s Anti-Cheat section. I’ve been reversing Black Ops Cold War for a while now, and I’ve finally decided to share my research regarding the user-mode anti-cheat inside the game. It’s not my intention to shame or promote cheating/bypassing…
649
Build a tiny CA for your homelab with a Raspberry Pi
Let's make a tiny, standalone CA! We'll use a Raspberry Pi 4, YubiKey 5 NFC, and Infinite Noise TRNG.
650
Amazon's AI crawler is making my Git server unstable
Please, just stop.
651
Windows BitLocker – Screwed Without a Screwdriver
Breaking up-to-date Windows 11 BitLocker encryption -- on-device but software-only
652
EFF statement on U.S. Supreme Court's decision to uphold TikTok ban
Shutting down a communications platform or forcing its reorganization based on concerns of foreign propaganda and anti-national manipulation is an eminently anti-democratic tactic, one that the US has previously condemned globally.
653
Investigating an “evil” RJ45 dongle
Reverse-engineering hardware can be difficult -- but sometimes, all you need is a comfy armchair and some Google Translate.
654
Trusting clients is probably a security flaw
If your service needs to trust the clients, hold my Big Mac
655
Let's talk about AI and end-to-end encryption
Recently I came across a fantastic new paper by a group of NYU and Cornell researchers entitled “How to think about end-to-end encryption and AI.” I’m extremely grateful to see th…
656
Bypassing disk encryption on systems with automatic TPM2 unlock
oddlama's personal web page and blog
657
JTAG 'Hacking' the Original Xbox in 2023
Released in November 2001, the original Xbox was Microsoft’s first venture into the game console industry. With its hardware closely resembling a cheap but v...
658
Six day and IP address certificate options in 2025
Update: January 15, 2026 Six-day and IP address certificates are now generally available. See 6-day and IP Address Certificates are Generally Available for details. This year we will continue to pursue our commitment to improving the security of the Web PKI by introducing the option to get certificates with six-day…
659
Nepenthes is a tarpit to catch AI web crawlers
Making web crawlers eat shit since 2023
660
Nevada court shuts down police use of federal loophole for civil forfeiture
RENO, Nev.—In a major victory for property rights, today a Washoe County judge ruled that Nevada law enforcement cannot use a federal program to bypass […]