211
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,333 posts.
212
Encrypted traffic interception on Hetzner and Linode targeting Jabber service
TL;DR: we have discovered XMPP (Jabber) instant messaging protocol encrypted TLS connection wiretapping (Man-in-the-Middle attack) of jabber.ru (aka xmpp.ru) service’s servers on Hetzner and Linode hosting providers in Germany. The attacker has issued several new TLS certificates using Let’s Encrypt service which were…
213
The “S” in MCP Stands for Security
Spoiler: it doesn’t. But it should.
214
I've locked myself out of my digital life
Imagine… Last night, lightning struck our house and burned it down. I escaped wearing only my nightclothes. In an instant, everything was vaporised. Laptop? Cinders. Phone? Ashes. Home server? A smouldering wreck. Yubikey? A charred chunk of gristle. This presents something of a problem. In order to recover my digital…
215
What happened to the Snowden archive
The last document from the Snowden archive was published on 29 May 2019. The Guardian stopped publishing documents in February 2014, Der Spiegel in January 2015, and The New York Times and ProPublica in August 2015. After that, only The Intercept was still publishing documents, with only a few exceptions, until it…
216
217
218
Post a boarding pass on Facebook, get your account stolen
Article removed for legal reasons, sorry. After receiving a Czech version of a cease and desist letter from a legal representative of A. F., I've removed the article. You'll find articles based on my story in “Recommended reading” below, go read them.
219
Swing VPN app is a DDoS botnet
tldr: Swing VPN is using its user base to DDOS sites using its users as a an attack botnet. Introduction It all started with a friend of mine complaining that his phone was doing a request to a specific app every few seconds. Initial assumption was that the phone was infected with a virus but a 2 minute investigation…
220
I'm Open Sourcing the Have I Been Pwned Code Base
Let me just cut straight to it: I'm going to open source the Have I Been Pwned code base. The decision has been a while coming and it took a failed M&A process to get here, but the code will be turned over to the public for the
221
222
Don't touch my clipboard
Looking for an em dash I was recently trying to find an em dash character to use in a piece of writing. Since I don’t have the shortcut memorized—for future reference, shift+option+minus on Mac—I did a quick search for it. I didn’t see one on the search results page to copy, so I clicked into the first result: “The…
223
224
225
The quiet renovation at Bitwarden
Back in March, I wrote about Bitwarden doubling their Premium price — and specifically how they did it. Buried in a feature announcement. Priced in fake...
226
The EARN IT act is an attack on end-to-end encryption
Yesterday a bipartisan group of U.S. Senators introduced a new bill called the EARN IT act. On its face, the bill seems like a bit of inside baseball having to do with legal liability for informati…
227
228
Nepenthes is a tarpit to catch AI web crawlers
Making web crawlers eat shit since 2023
229
230
231
Incident Report: CVE-2024-YIKES
A series of unfortunate events.
232
Password Rules Are Bullshit
Of the many, many, many bad things about passwords, you know what the worst is? Password rules. Let this pledge be duly noted on the permanent record of the Internet. I don’t know if there’s an afterlife, but I’ll be finding out soon enough, and I plan
233
Discovering that a Bluetooth car battery monitor is siphoning location data
Reverse engineering an Android app for a Bluetooth connected car battery monitor with some startling discoveries ...
234
Meta confirms 1000s of Instagram accounts were hacked by abusing its AI chatbot
Meta fixed the bug that let anyone trick its Meta AI chatbot into resetting the password on Instagram accounts that didn't have two-factor authentication.
235
HTTP Security Headers – A Complete Guide
A description of each security header, why it is important, and how to configure your website in a secure way.
236
TeamViewer installs suspicious font only useful for web fingerprinting
A weird almost unreadable font file bundled with TeamViewer for Windows software lets website detect if you’ve installed the software. Raises privacy concerns.
237
Sandboxed Mac apps can record screen any time without you knowing
I work with U.S. law firms as a non-testifying technical consulting expert on matters involving the Apple platform and iOS apps. Learn more about my litigation consulting.
238
The Problem with Perceptual Hashes
Apple just announced that they will use “perceptual hashing” to detect illegal photos on iPhones. I have some experience to share on this technology.
239
Mythos Finds a Curl Vulnerability
yes, as in singular one. Back in April 2026 Anthropic caused a lot of media noise when they concluded that their new AI model Mythos is dangerously good at finding security flaws in source code. Apparently Mythos was so good at this that Anthropic would not release this model to the public yet but instead … Continue…
240