1141
The double standard of webhook security and API security
Explore the surprisingly different security standards we apply to webhooks versus traditional API requests.
New
The latest blog posts to take off on Hacker News. 8,770 posts.
1142
Google shared my phone number
When people started calling my personal mobile number with questions about a voluntary organisation I'm involved with, I was confused: we weren't sharing that number. It turns out that Google had decided to take the number I used to verify my identity for Google Business some years prior and start putting it in Google…
1143
A thought on JavaScript "proof of work" anti-scraper systems
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
1144
Ten years of JSON Web Token and preparing for the future
Ten years ago this week, in May 2015, the JSON Web Token (JWT) became RFC 7519 . This was the culmination of a 4.5 year journey to create a simple JSON-based security token format and underlying JSON-based cryptographic standards. The full set of RFCs published together was:
1145
CAPTCHAs are over (in ticketing)
Behind the scenes blog of pretix, your friendly ticketing system from next door.
1146
There Is No Diffie-Hellman but Elliptic Curve Diffie-Hellman
When I first learned about Diffie-Hellman and especially elliptic curve Diffie-Hellman, I had one rather obvious question: Why elliptic curves? Why use this strange group that seems rather arbitrar…
1147
Tachy0n: The Last 0day Jailbreak
Siguza’s Blog
1148
I used o3 to find a remote zeroday in the Linux SMB implementation
In this post I’ll show you how I found a zeroday vulnerability in the Linux kernel using OpenAI’s o3 model. I found the vulnerability with nothing more complicated than the o3 API ̵…
1149
1150
Remote Prompt Injection in Gitlab Duo Leads to Source Code Theft
The Legit research team unearthed vulnerabilities in GitLab Duo.
1151
By default, Signal doesn't recall
Signal Desktop now includes support for a new “Screen security” setting that is designed to help prevent your own computer from capturing screenshots of your Signal chats on Windows. This setting is automatically enabled by default in Signal Desktop on Windows 11. If you’re wondering why we’re on...
1152
DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage
💡Update May 21, 2025: I've written a new detailed analysis of the heap dump dataset itself: TeleMessage customers include DC Police, Andreessen Horowitz, JP Morgan, and hundreds more Update May 26, 2025: I've published the source code for TeleMessage Explorer: a new open source research tool This morning,
1153
Have I Been Pwned 2.0
This has been a very long time coming, but finally, after a marathon effort, the brand new Have I Been Pwned website is now live! Feb last year is when I made the first commit to the public repo for the rebranded service, and we soft-launched the new brand
1154
O2 VoLTE: locating any customer with a phone call
Privacy is dead: For multiple months, any O2 customer has had their location exposed to call initiators without their knowledge.
1155
Leeks and Leaks
On the completely impossible situation of blocking the Tor .onion TLD to avoid leaks, but at the same time not block it to make users able to do what they want. dot-onion leaks The onion TLD is a Tor specific domain that does not mean much to the world outside of Tor. If you try … Continue reading Leeks and leaks →
1156
In Memoriam: John L. Young, Cryptome Co-Founder
John L. Young, who died March 28 at age 89 in New York City, was among the first people to see the need for an online library of official secrets, a place where the public could find out things that governments and corporations didn’t want them to know. He made real the idea – revolutionary in its...
1157
EU ruling: tracking-based advertising [...] across Europe has no legal basis
Landmark court decision against “TCF” consent pop ups on 80% of the internet
1158
1159
The cryptography behind passkeys
This post will examine the cryptography behind passkeys, the guarantees they do or do not give, and interesting cryptographic things you can do with them, such as generating cryptographic keys and storing certificates.
1160
Why are banks still getting authentication so wrong?
While recently traveling to the U.S., I was completely locked out of my TD Personal Banking account. TD relies heavily on SMS-based two-factor authenticat...
1161
Branch Privilege Injection: Exploiting branch predictor race conditions
Branch Privilege Injection ( CVE-2024-45332 ) brings back the full might of branch target injection attacks (Spectre-BTI) on Intel. Intel’s hardware mitigations against these types of attacks have held their ground for almost 6 years. In our work, we demonstrate how these mitigations can be broken due to a race…
1162
Rustls Server-Side Performance
In past years, the Rustls project has been happy to receive substantial investments from the ISRG. One of our goals has been to improve performance without compromising on safety. We last posted about our performance improvements in October of 2024, and we're back to talk about another round of improvements. What is…
1163
Can you trust that permission pop-up on macOS?
A security research blog.
1164
I hacked a dating app (and how not to treat a security researcher)
Update: This post received a large amount of attention on Hacker News — see the discussion thread.
1165
Demonstrably Secure Software Supply Chains with Nix
Discover how Nix can revolutionize your software supply chain security, enabling verifiable integrity and offline rebuilds from source.
1166
I ruined my vacation by reverse engineering WSC
describing my wsc adventure
1167
One-Click RCE in Asus's Preinstalled Driver Software
One-Click RCE in ASUS’s Preinstalled Driver Software Part Two of the ASUS series is out, read it here. Introduction This story begins with a conversation about new PC parts. After ignoring the advice from my friend, I bought a new ASUS motherboard for my PC. I was a little concerned about having a BIOS that would by…
1168
Sam Altman Wants Your Eyeball
Last week, OpenAI's CEO Sam Altman announced in San Francisco that the World project he co-founded, formerly known as Worldcoin, is opening six stores across the United States, allowing users of the project's app to scan their eyeballs. This is worrisome, to say the least.
1169
The dark side of account bans
I recently lost my Facebook account for two months, and was significantly cut off from certain aspects of society during that time. This is the dark side of account bans.
1170
Pakistani firm shipped fentanyl analogs, scams to us
A Texas firm recently charged with conspiring to distribute synthetic opioids in the United States is at the center of a vast network of companies in the U.S. and Pakistan whose employees are accused of using online ads to scam westerners seeking help with trademarks, book writing, mobile app development and logo…