1021
Zero-day flaws in authentication, identity, authorization in HashiCorp Vault
Check Point's AI Security Solutions deliver AI-driven threat prevention and unified security management for advanced protection across enterprise networks.
New
The latest blog posts to take off on Hacker News. 8,770 posts.
1022
Emailing a one-time code is worse than passwords
where my words occasionally escape /dev/null
1023
Who got arrested in the raid on the XSS crime forum?
On July 22, 2025, the European police agency Europol said a long-running investigation led by the French Police resulted in the arrest of a 38-year-old administrator of XSS, a Russian-language cybercrime forum with more than 50,000 members. The action has triggered an ongoing frenzy of speculation and panic among XSS…
1024
Spotting base64 encoded JSON, certificates, and private keys
A colleague spotted base64-encoded JSON in a long string of gibberish without any tools. I was amazed, until he explained how anyone can do it.
1025
Passkeys are just passwords that require a password manager
You reset your passkey the same way you reset your password. But you’ll find that passkeys make it harder to switch between password…
1026
AWS deleted my 10-year account and all data without warning
After 10 years as an AWS customer and open-source contributor, they deleted my account and all data with zero warning. Here's how AWS's 'verification' process became a digital execution, and why you should never trust cloud providers with your only copy of anything.
1027
Hiding secret codes in light protects against fake videos
A team of Cornell computer science researchers has developed a way to “watermark” light in videos, which they can use to detect if video is fake or has been manipulated, another potential tool in the fight against misinformation.
1028
Self-Signed JWTs
An auth scheme where you let yourself in.
1029
How did Facebook intercept competitor's encrypted mobile app traffic? (2024)
A technical investigation into information uncovered in a class action lawsuit that Facebook had intercepted encrypted traffic from user's devices running the Onavo Protect app in order to gain competitive insights.
1030
1031
What is gVisor?
It has been a really long time since I last wrote something here as life happens, things get busier, etc etc. I am now trying to get back into writing things down and here we go! So, imagine a tool or a service that allows you to run some arbitrary code via a shell. Either through a ssh or more commonly, via a web…
1032
Critical vulnerability in AI coding platform Base44 allowing unauthorized access
New discovery underscores security implications of AI-powered development and the rise of Vibe Coding Platforms.
1033
Sign in with Google in Chrome
Many websites such as Yelp show an annoying “Sign in with Google” banner when you visit.
1034
How we rooted Copilot
After a long week, the Eye Security Research Team thought it was time for a small light-hearted distraction. So we rooted Copilot.
1035
Exploiting zero days in abandoned hardware
We successfully exploited two discontinued network devices at DistrictCon’s inaugural Junkyard competition in February, winning runner-up for Most Innovative Exploitation Technique. Our exploit chains demonstrate why end-of-life hardware poses persistent security risks.
1036
Google spoofed via DKIM replay attack: A technical breakdown
Learn how a Google spoof used a DKIM replay attack to bypass email security and trick users with a fake subpoena in this real-world phishing case.
1037
PSA: SQLite WAL checksums fail silently and may lose data
SQLite WAL has checksums, but on corruption it drops all the data and does not raise error
1038
A valid HTML zip bomb
<h1 id="a-valid-html-zip-bomb"><a tabindex="0" class="anchor" href="/notes/html_zip_bomb">A valid HTML zip bomb</a></h1><p><img src="/notes/res/zip_bomb_file.svg" alt="Illustration d'une bombe zip" height="150" width="150"> Many sites have been affected by the aggressiveness of web crawlers designed to improve…
1039
Jitsi privacy flaw enables one-click stealth audio and video capture
A Jitsi feature allows an attacker to transmit user's microphone and camera in the background without their consent.
1040
Yes, the Book of PF, fourth edition is coming soon
© 2025 Peter N. M. Hansteen Long rumored and eagerly anticipated by some, the fourth edition of The Book of PF is now available for ...
1041
Lumo: Privacy-first AI assistant
Lumo gives you the power to solve problems big and small, while keeping your personal data confidential. Try it now.
1042
Brave blocks Microsoft Recall by default
Starting in version 1.81 for Windows users, Brave browser will block Microsoft Recall from automatically taking screenshots of your browsing activity.
1043
Fun with gzip bombs and email clients
I served a 10MB gzip bomb as an image in HTML email. Most clients and proxies coped, iOS Mail crashed and Evolution wrote 100GB of cache to my disk.
1044
1045
Subliminal learning: Models transmit behaviors via hidden signals in data
We study subliminal learning , a surprising phenomenon where language models learn traits from model-generated data that is semantically unrelated to those traits. For example, a "student" model learns to prefer owls when trained on sequences of numbers generated by a "teacher" model that prefers owls. This same…
1046
What went wrong inside recalled Anker PowerCore 10000 power banks?
Investigate Anker’s recalled power banks. See how CT scanning uncovers battery defects and improves safety in lithium-ion designs.
1047
SQL Injection as a Feature
Looking at old applications, we always wonder who in their right mind thought of building them so badly. But every repository has its story and every effort has noble origins. I encountered such an ap
1048
SecretSpec: Declarative Secrets Management
Fast, Declarative, Reproducible, and Composable Developer Environments using Nix.
1049
Ring introducing new feature to allow police to live-stream access to cameras
Ring founder Jamie Siminoff is back at the helm of the surveillance doorbell company, and with him is the surveillance-first-privacy-last approach that made Ring one of the most maligned tech devices. Not only is the company reintroducing new versions of old features which would allow police to...
1050
