751
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,333 posts.
752
Why I Wrote PGP (1999)
"Whatever you do will be insignificant, but it is very important that you do it." -Mahatma Gandhi
753
Burner Phone 101
Hosted by the Brooklyn Public Library, this Burner Phone 101 workshop introduced participants to phone-related risk modeling, privacy-protective smartphone practices, the full spectrum of burner phone options, and when to leave phones behind entirely.
754
OnePlus OxygenOS built-in analytics
We take a look at the analytics built into the OxygenOS, the flavour of Android built by phone manufacturer OnePlus.
755
Hacking Google Bard – From Prompt Injection to Data Exfiltration
Recently Google Bard got some powerful updates, including Extensions. Extensions allow Bard to access YouTube, search for flights and hotels, and also to access …
756
Apple memory holed its broken promise for an OCSP opt-out
When you launch an app, macOS connects to Apple's OCSP service to check whether the app's Developer ID code signing certificate has been revoked by Apple. In November 2020, Apple's OCSP service experienced a mass outage , preventing Mac users worldwide from launching apps. In response and remedy to this outage, Apple…
757
Apple Confirms “Back Doors”, Downplays Their Severity
Apple responded to allegations of hidden services running on iOS devices with this knowledge base article . In it, they outlined three of the big services that I outlined in my talk. So again, Apple has, in a traditional sense, admitted to having backdoors on the device specifically for their own use.
758
759
Why the password "this is fun" is 10 times more secure than "J4fS!2"
Baekdal is your premium site for media reports and trend analysis. Subscribe from €7.55/month
760
The weakest link by far is Apple
Apple tech support gave the hackers access to my iCloud account. Amazon tech support gave them the ability to see a piece of information — a partial credit card number — that Apple used to release information. In short, the very four digits that Amazon considers unimportant enough to display in the clear on the web…
761
You cannot simply publicly access private secure links, can you?
turns out, you can even search for them with powerful search engines!
762
Running a Tor Exit Node for Fun and E-mails
The Tor Project is a non-profit organization in the United States that created Tor, The Onion Router, a free software that creates an open network of volunteers which helps people anonymize their traffic by routing it through three or more other computers before it reaches its final destination.
763
Tor is a great sysadmin tool (2020)
Using Tor to aid various system administration tasks, including checking firewall rules, bypassing internal network restrictions and connecting to remote systems that are behind NAT/CGNAT.
764
An Almost-Secret Algorithm Researchers Used to Break Thousands of RSA Keys
RSA encryption allows for anyone to send me messages that only I can decode. To set this up, I select two large random primes $latex p$ and $latex q$ (each of which is hundreds of bits long), and r…
765
MarkMonitor left 60k domains for the taking
Thanks to Nagli and d0xing for helping figure out what was happening with this issue.
766
Zoom Security Exploit: Cracking private meeting passwords
Short version: Zoom meetings were default protected by a 6 digit numeric password, meaning 1 million maximum passwords. I discovered a vulnerability in the Zoom web…
767
Frontier AI has broken the open CTF format
Why frontier AI has broken the open CTF format, hollowed out the scoreboard, and made competitive CTF performance a weaker signal than it used to be.
768
First American Financial Corp. Leaked Hundreds of Millions of Insurance Records
The Web site for Fortune 500 real estate title insurance giant First American Financial Corp. [ NYSE:FAF ] leaked hundreds of millions of documents related to mortgage deals going back to 2003, until notified this week by KrebsOnSecurity. The digitized records — including bank account numbers and statements, mortgage…
769
SHA-3 Buffer Overflow
Update: This result appeared in the proceedings of CT-RSA 2023. A preprint is available.
770
Remote code execution vulnerability in apt/apt-get
tl;dr I found a vulnerability in apt that allows a network man-in-the-middle (or a malicious package mirror) to execute arbitrary code as root on a machine i...
771
How a double-free bug in WhatsApp turns to remote code execution
In this blog post, I’m going to share about a double-free vulnerability that I discovered in WhatsApp for Android, and how I turned it into an RCE. I informed this to Facebook. Facebook acknowledged and patched it officially in WhatsApp version 2.19.244. Facebook reserved CVE-2019-11932 for this issue.
772
Getting any Facebook user's friend list and partial payment card details
I enjoy breaking websites.
773
ProtonMail Rewrites Your Emails
I switched to ProtonMail a few years back after getting fed up with Google. It’s been mostly acceptable, but a few months ago the Android client started mangling emails – if I hit “send” too soon, it would send out only part of what I’d typed; I had to wait 10 seconds or so after I finished typing before hitting send…
774
An American Privacy Emergency
Scott’s foreword: Cynthia Dwork is Gordon McKay Professor of Computer Science at Harvard, and a pioneer in the fields of differential privacy and algorithmic fairness. On my recent travels to…
775
Signal Adds Cryptocurrency Support
According to Wired, Signal is adding support for the cryptocurrency MobileCoin, “a form of digital cash designed to work efficiently on mobile devices while protecting users’ privacy and even their anonymity.” Moxie Marlinspike, the creator of Signal and CEO of the nonprofit that runs it, describes the new payments…
776
Apple's SSL/TLS bug
Yesterday, Apple pushed a rather spooky security update for iOS that suggested that something was horribly wrong with SSL/TLS in iOS but gave no details. Since the answer is at the top of the Hacker News thread, I guess the cat's out of the bag already and we're into the misinformation-quashing stage now.
777
778
DOGE as a National Cyberattack
In the span of just weeks, the US government has experienced what may be the most consequential security breach in its history—not through a sophisticated cyberattack or an act of foreign espionage, but through official orders by a billionaire with a poorly defined government role. And the implications for national…
779
“Invalid username or password” is a useless security measure
Login attempts fail because computer users can't remember their email or didn't input the right password. Most websites on the Internet won't tell you which one is actually incorrect.
780
