901
OAuth Will Murder Your Children
Written pieces, talks, and other bits by Zach Holman.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,333 posts.
902
Android App Reverse Engineering 101
Learn to reverse engineer Android applications!
903
GDPR – A Practical Guide for Developers (2017)
You’ve probably heard about GDPR. The new European data protection regulation that applies practically to everyone. Especially if you are working in a big company, it’s most likely that there’sContinue reading
904
An analysis of the Nomx secure communications device
With slick marketing, catchy taglines and some pretty bold claims about their security, nomx claim to have cracked email security. Let's see if they have.
905
Why I Quit Using Google
So I was recently asked why I prefer to use free and open source software over more conventional and popular proprietary software and services. A few years ago I was an avid Google user. I was deep…
906
Why Is Location Data No Longer Private?
The past month has seen one blockbuster revelation after another about how our mobile phone and broadband providers have been leaking highly sensitive customer information, including real-time location data and customer account details. In the wake of these consumer privacy debacles, many are left wondering who’s…
907
Feeling safer online with Firefox
The latest privacy and security improvements in Firefox [This post originally appeared on Medium ] Firefox is the only browse...
908
Flatpak: A security nightmare – two years later
Flatpak - a security nightmare
909
Can you trust that permission pop-up on macOS?
A security research blog.
910
Homomorphic encryption in iOS 18
A mathematical miracle enables Apple's servers to process your photos while never knowing anything about them
911
Okta Bcrypt incident lessons for designing better APIs
Hello there! If you follow tech news, you might have heard about the Okta security incident that was reported on 1st of November. The TLDR of the incident was …
912
Edward Snowden: Saving Us from the United Stasi of America
In my estimation, there has not been in American history a more important leak than Edward Snowden’s release of NSA material – and that definitely includes the Pentagon Papers 40 years ago. Snowden’s whistleblowing gives us the possibility to roll back a key part of what has amounted to an “executive coup” against the…
913
NCSC, GCHQ, UK Gov't expunge advice to “use Apple encryption”
This is some really embarrassing timing on the Home Office’s (HO’s) part: a few weeks ago when news first broke of the HO’s demand for a backdoor in Apple ADP, I pointed out to MP…
914
Things to Use Instead of JSON Web Tokens
You might have heard that you shouldn't be using JWT. That advice is correct - you really shouldn't use it. In general, specifications that allow the attacker to choose the algorithm for negotiation have more problems than ones that don't (see TLS). N libraries need to implement M different encryption and decryption…
915
RCE Vulnerability in QBittorrent
[…] Security has unveiled a critical vulnerability that has lingered in the popular torrent client qBittorrent for over 14 […]
916
So I reverse engineered two dating apps
In this post I show some of my findings during the reverse engineering of the apps Coffee Meets Bagel and The League. I have identified several critical vulnerabilities during the research, all of which have been reported to the affected vendors. Introduction In these unprecedented times, more and more people are…
917
What happened after 2k people tried to hack my AI assistant
I built hackmyclaw.com , where anyone could email Fiu, my OpenClaw assistant, and try to make it leak the contents of a secrets.env file.
918
919
920
921
Email obfuscation: What works in 2026?
Here are some of the best techniques for keeping email addresses hidden from spammers—along with the statistics on how likely they are to be broken.
922
The internet is held together with spit and baling wire
A visualization of the Internet made using network routing data. Image: Barrett Lyon, opte.org.
923
924
There are no secure smartphones
Modern smartphones have a CPU chip, and a baseband chip which handles radio network communications (GSM/UMTS/LTE/etc.) This chip is connected to the CPU via DMA. Thus, unless an IOMMU is used, the baseband has full access to main memory, and can compromise it arbitrarily.
925
Interview with the Guy Who Tried to Frame Me for Heroin Possession
In April 2013, I received via U.S. mail more than a gram of pure heroin as part of a scheme to get me arrested for drug possession. But the plan failed and the Ukrainian mastermind behind it soon after was imprisoned for unrelated cybercrime offenses. That individual recently gave his first interview since finishing…
926
The Secret API of Banks
Interacting with bank data often requires trusting 3rd parties with your credentials. What if there were a more secure way to explore transactions?
927
How to properly manage SSH keys for server access
This article was on the hacker news frontpage. You can find the related discussion here. Every developer needs access to some servers for example to check the application logs. Usually, this is done using public-private key encryption where each developer generates their own public-private key pair. The public keys of…
928
WorstFit: Unveiling Hidden Transformers in Windows ANSI
📌 This is a cross-post from DEVCORE. The research was first published at Black Hat Europe 2024. Personally, I would like to thank splitline, the co-author of this research & article, whose help
929
The RCE that AMD won't fix
After reporting a RCE in AMD's auto-update software, they decided to not patch it due to it requiring a man-in-the-middle attack to perform.
930
Breaking Git with a carriage return and cloning RCE
tl;dr: On Unix-like platforms, if you use git clone --recursive on an untrusted repo, it could achieve remote code execution. Update to a fixed version of Git and other software that embeds Git (including GitHub Desktop).