151
MS Paint and Photos inivisibly watermark even locally generated output with GUID
Reverse engineering reveals how Paint and Photos embed a server-issued GUID into the pixels of locally generated AI images.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,333 posts.
152
The All-Seeing “i”: Apple Just Declared War on Your Privacy
“Under His Eye,” she says. The right farewell. “Under His Eye,” I reply, and she gives a little nod.
153
Avoid Non-Microsoft Antivirus Software
Robert O'Callahan. Christian. Kiwi. Software guy. All content human-authored unless otherwise noted.
154
Defeating a 40-year-old copy protection dongle
That’s right — this little device is what stood between me and the ability to run an even older piece of software that I recently unearthed during an expedition of software archaeology.
155
I don't like passkeys
Why passkeys are a step back for personal security: examining account lockout risks, platform lock-in, hardware key limits, and fragile recovery flows.
156
Let's build a Chrome extension that steals as much data as possible
Today's adventure: DIY whole hog data exfiltration
157
Breaking GitHub Private Pages for $35k
Abusing CRLF, cache poisoning, and other misconfigurations for a no-interaction XSS against GitHub Private Pages.
158
The Bitcoin whitepaper is hidden in every copy of macOS
I just discovered that every copy of macOS ships with a hidden PDF of Satoshi Nakamoto's Bitcoin whitepaper. But why?
159
Don't use third party auth to sign in
If a website offers you to sign-in using Google (or any third-party service, say Facebook, Github, etc.), don’t use that feature.
160
"Pwned Passwords" V2 With Half a Billion Passwords
Last August, I launched a little feature within Have I Been Pwned [https://haveibeenpwned.com/] (HIBP) I called Pwned Passwords [https://www.troyhunt.com/introducing-306-million-freely-downloadable-pwned-passwords/]. This was a list of 320 million passwords from a range of different data breaches which organisations…
161
Root shell on a credit card terminal
In this project, I started to reverse engineer payment card terminals because they seemed to be an interesting target for security research, given the high stakes involved. Although I initially didn’t know much about this industry, I did expect a ton of security features and a very security-hardened device. And to…
162
Why are anime catgirls blocking my access to the Linux kernel?
Hey… quick question, why are anime catgirls blocking my access to the Linux kernel?
163
Jailbreaking the Switch 2
ns2jb is a software-only, tethered jailbreak for the Switch 2. It allows running arbitrary native code as any ordinary sysmodule, and as the built-in fs sysmodule. This lets us run homebrew, reverse engineer and mod Switch 2 games, back up save files off the Switch, and access most of the Switch 2’s peripherals…
164
165
Delve – Fake Compliance as a Service
How Delve managed to falsely convince hundreds of customers they were compliant and then lied about it when exposed and called out
166
167
Pay up or we’ll make Google ban your ads
A new email-based extortion scheme apparently is making the rounds, targeting Web site owners serving banner ads through Google’s AdSense program. In this scam, the fraudsters demand bitcoin in exchange for a promise not to flood the publisher’s ads with so much bot and junk traffic that Google’s automated anti-fraud…
168
Tracking friends and strangers using WhatsApp
You and your good buddy, Steve Steveington, are in training for an arduous charity walk. You signed up together on the spur of the moment and pledged to hold each other accountable whilst you got in shape for the big day. However, you have developed reason to suspect that Steve Steveington is losing his commitment to…
169
Reverse engineering a $1B Legal AI tool exposed 100k+ confidential files
Update: This post received a large amount of attention on Hacker News — see the discussion thread.
170
Read this before you buy that TV streaming stick
Security experts have been sounding the alarm for years about the risks of using generic TV boxes that promise unlimited content streaming for a one-time fee, warning that they secretly rent the user’s Internet connection out to strangers. But a groundbreaking new analysis finds these devices also routinely spoof…
171
Whistleblower: DOGE Siphoned NLRB Case Data
A security architect with the National Labor Relations Board (NLRB) alleges that employees from Elon Musk ‘s Department of Government Efficiency (DOGE) transferred gigabytes of sensitive data from agency case files in early March, using short-lived accounts configured to leave few traces of network activity. The NLRB…
172
RFC 35140: HTTP Do-Not-Stab (2023)
Date: March 7, 2111
173
A German ISP changed their DNS to block my website
One of Germany's biggest ISPs changed how their DNS works, right after I exposed an organization that they’re part of.
174
Hacking my “smart” toothbrush
After buying a new Philips Sonicare toothbrush I was surprised to see that it reacts to the insertion of a brush head by blinking an LED. A quick online search reveals that the head communicates with the toothbrush handle to remind you when it’s time to buy a new one. From the Philips product page: seems to be REALLY…
175
Technical analysis of the Signal clone used by Trump officials
💡Update May 3, 2025: I have posted a follow-up, Here's the source code for the unofficial Signal app used by Trump officials. Update May 4, 2025: Another followup, and a big one: The Signal Clone the Trump Admin Uses Was Hacked Update May 6, 2025: I've written
176
The curious case of the Raspberry Pi in the network closet (2019)
Personal Blog of Christian Haschek
177
Curl will not accept vulnerability reports during July 2026
The curl project will not accept or otherwise handle any vulnerability reports during the month of July 2026. We call it the curl summer of bliss. curl's submission form on Hackerone will be paused starting July 1, 2026. Summer of bliss starts: July 1, 2026. 00:00 CEST Submissions resume: August 3 2026. 09:00 CEST The…
178
DarkSide ransomware gang quits after servers, Bitcoin stash seized
The DarkSide ransomware affiliate program responsible for the six-day outage at Colonial Pipeline this week that led to fuel shortages and price spikes across the country is running for the hills. The crime gang announced it was closing up shop after its servers were seized and someone drained the cryptocurrency from…
179
Cloudflare Turnstile requiring fingerprintable WebGL
Since about a week, Cloudflare Turnstile (their "Verify you're human" device verification) has been looping indefinitely in my webkit-gtk based browser . Preventing access to quite few websites ( previously , but it even went worse lately). Turns out it's because Cloudflare wants to have a fingerprint of your device…
180