1021
I found a 1-click exploit in South Korea's biggest mobile chat app
Stealing another KakaoTalk user’s chat messages with a simple 1-click exploit.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,333 posts.
1022
1023
The dark side of the Mac App Store
In the last 30 days, I have been closely monitoring the Mac App Store and have made a disturbing discovery. In the midst of the OpenAI…
1024
1025
1026
Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop
Have you ever been told that the company’s data on laptops is protected thanks to BitLocker? Well it turns out that this depends on BitLocker’s configuration…
1027
Lessons in website security anti-patterns by Tesco
Update, 14 Feb 2014: A year and a half on from writing this, Tesco has indeed suffered a serious security incident almost certainly as a result of some of the risks originally detailed here. Read more about it in The Tesco hack – here’s how it (probably) happened [https://www.
1028
A determined 'hacker' decrypts RDS-TMC
RDS-TMC uses an encryption algorithm simple enough to be run using pen-and-paper hardware.
1029
Leaving Gmail for Mailbox.org
This was a tough decision, having used Gmail since 2007/2008. However, I had to draw the line and stop giving Google my data for free. The problem with email is …
1030
Hacker in Snowflake extortions may be a U.S. soldier
Two men have been arrested for allegedly stealing data from and extorting dozens of companies that used the cloud data storage company Snowflake , but a third suspect — a prolific hacker known as Kiberphant0m — remains at large and continues to publicly extort victims. However, this person’s identity may not remain a…
1031
The Day I Fell in Love with Fuzzing
In 2007 I wrote a pair of modding tools, binitools , for a space trading and combat simulation game named Freelancer . The game stores its non-art assets in the format of “binary INI” files, or “BINI” files. The motivation for the binary format over traditional INI files was probably performance: it’s faster to load…
1032
A Kernel Hacker Meets Fuchsia OS
Fuchsia is a general-purpose open-source operating system created by Google. It is based on the Zircon microkernel written in C++ and is currently under active development. The developers say that Fuchsia is designed with a focus on security, updatability, and performance. As a Linux kernel hacker, I decided to take a…
1033
Moving Away from Gmail
tl;dr: I like PurelyMail and I will slowly switch all my online accounts to use it. I've been using it for almost three months and I didn't have any issues (except with some Hotmail/Outlook addresses). I have a GMail account since 2006 (that's the date
1034
Sending spammers to password purgatory
How best to punish spammers? I give this topic a lot of thought because I spend a lot of time sifting through the endless rubbish they send me. And that's when it dawned on me: the punishment should fit the crime - robbing me of my time - which means that
1035
I didn't reverse-engineer the protocol for my blood pressure monitor in 24 hours
The personal website of James Belchamber.
1036
Chrome connects to three random domains at startup
When you start Chrome, it attempts to connect to three random domains. I've seen a few theories about why exactly this happens that brush up against the nefarious. The true rationale is incredibly mundane: hopefully this short summary will clear things up.
1037
What is Differential Privacy?
Yesterday at the WWDC keynote, Apple announced a series of new security and privacy features, including one feature that’s drawn a bit of attention — and confusion. Specifically, Apple …
1038
1039
How github was hacked
So I commited in rails/rails repo I simply added a <input value=USER_ID name=public_key[user_id]> field to Public key update form, where U...
1040
Show HN: I'm building a browser for reverse engineers
In the expanding world of AI my heart still lies in AST transforms, browser fingerprinting, and anti-bot circumvention. But my workflow felt... primitive.
1041
1042
Xkcd Password Generator
The button below will generate a random phrase consisting of four common words. According to yesterday’s xkcd strip, such phrases are hard to guess (even by brute force), …
1043
How does Apple privately find offline devices?
At Monday’s WWDC conference, Apple announced a cool new feature called “Find My”. Unlike Apple’s “Find my iPhone”, which uses cellular communication and the lost…
1044
TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy
Hi friends and welcome to the last post for this year! Whenever someone asks me how to get started with reverse engineering, I always give the same advice: buy…
1045
First-party isolation in Firefox: what breaks if you enable it?
Firefox’s FPI system keeps websites from tracking your movements across websites. This gives excellent privacy protections but at a cost of web compatibility.
1046
Worst CAPTCHA Ever
By definition, CAPTCHA should be easy to read by humans but hard to read by machines. Apparently, they don’t agree with that at D&B:
1047
Facebook doesn't like privacy countermeasures
German tech-news site Heise changed their "Like" buttons to be locally-hosted images that only transform into real Facebook "Like" buttons once you click them -- meaning that if you don't click anything, Facebook can't track you, and that actually "liking" the page requires two clicks. (Also presumably meaning that…
1048
1049
Getting Started with Security Keys
How to stay safe online and prevent phishing with FIDO2, WebAuthn and security keys. A look into YubiKeys, TOTP authenticator apps, passwordless and more.
1050
