1681
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,334 posts.
1682
Counterfeit Macbook charger teardown: convincing outside but dangerous inside
What's inside a counterfeit Macbook charger? After my Macbook charger teardown , a reader sent me a charger he suspected was counterfeit. ...
1683
Storing Passwords Securely
Why "SHA 256-bits enterprise-grade password encryption" is only slightly better than storing passwords in plain text, and better ways to do it.
1684
Why offer an Onion Address rather than just encourage browsing-over-Tor?
There are a bunch of reasons to launch an onion site, and a bunch of benefits, all of which have provided value to platforms such as Facebook, the BBC or NYT Onions. The first benefits are authenti…
1685
I Can Crack Your App With Just A Shell (And How To Stop Me)
Hi, I'm Kenneth. I’m a Swiss transplant in San Francisco. I’m an angel investor, and an engineer at AngelList & CSC. Previously, I was co-founder of FreshPay and the architect behind Chartboost. When I'm not working, you can find me either photographing some remote corner of the world, or hacking away on an…
1686
Behind the 6-digit code: Building HOTP and TOTP from scratch
Personal website of Doğaç Eldenk.
1687
No, Safari 14 does not block Google Analytics
This article aims to subdue the rumors that Safari 14 will block Google Analytics (and other similar libraries) by default. It will not.
1688
1689
Pervasive Monitoring Is an Attack
That’s the title of RFC 7258 , also known as BCP 188 (where BCP stands for “Best Current Practice”); it represents Internet Engineering Task Force consensus on the fact that many powerful well-funded entities feel it is appropriate to monitor people’s use of the Net, without telling those people. The consensus is…
1690
Hotel Wifi JavaScript Injection
So I’m checking my blog on the hotel wifi, like ya do, and I notice something a little off with the style. There’s a dark colored bar at the top of the page that shouldn’t be there. That’s funny. Maybe a recent Firefox update changed how they treat CSS?
1691
1692
1693
1694
Cryptography is a science, not engineering
If we were still in the 1990s, I would agree with Thomas. 1990s cryptography was full of holes, and the best you could hope for was to know how your tools were broken so you could try to work around their deficiencies. This was a time when DES and RC4 were widely used, despite having well-known flaws. This was a time…
1695
Microsoft mishandling example.com
TL;DR: Since at least February 2020, Microsoft's Autodiscover service has incorrectly routed the IANA-reserved example.com to Sumitomo Electric Industries' mail servers at sei.co.jp , potentially sending test credentials there.
1696
CSRF in Doorkeeper OAuth2 gem
I read a post about CSRF on DigitalOcean (in Russian) by Sergey Belove . My first reaction was, obviously, how come ? DigitalOcean is not k...
1697
1698
America’s Open Wound
The CIA is not your friend
1699
Duck Duck Go: Illusion of Privacy (2013)
There have been several articles in the press recently about users flocking to DuckDuckGo in the wake of the recent NSA snooping revel...
1700
The Insecurity of Debian
The difference in security defaults between Debian and Red Hat.
1701
1702
NSO Group Hacked
NSO Group, the Israeli cyberweapons arms manufacturer behind the Pegasus spyware—used by authoritarian regimes around the world to spy on dissidents, journalists, human rights workers, and others—was hacked. Or, at least, an enormous trove of documents was leaked to journalists. There’s a lot to read out there…
1703
1704
Heap-overflowing Llama.cpp to RCE
Retr0's Threat Research
1705
Dumping Lego NXT firmware off of an existing brick (2025)
Catgirls can have little a RCE, as a treat
1706
‘Jackpotting’ Attacks Hit U.S. ATMs
ATM “ jackpotting ” — a sophisticated crime in which thieves install malicious software and/or hardware at ATMs that forces the machines to spit out huge volumes of cash on demand — has long been a threat for banks in Europe and Asia, yet these attacks somehow have eluded U.S. ATM operators. But all that changed this…
1707
Reading the Silk Road configuration
Many of us believe it wasn't the FBI who discovered the hidden Silk Road server, but the NSA (or other intelligence organization). We believ...
1708
Bypassing GitHub Actions policies in the dumbest way possible
TL;DR : GitHub Actions provides a policy mechanism for limiting the kinds of actions and reusable workflows that can be used within a repository, organization, or entire enterprise. Unfortunately, this mechanism is trivial to bypass . GitHub has told me that they don’t consider this a security issue (I disagree), so…
1709
1710