2521
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,335 posts.
2522
How Tor Works: Part One
Security and Programming Blog
2523
Don't use bcrypt
(Edit: Some numbers for you people who like numbers) If you're already using bcrypt, relax, you're fine, probably. However, if you're ...
2524
You Don't Need Anubis
don't use anubis just to block llm scrapers
2525
Maybe you should store passwords in plaintext
“Never, ever, think about something else when you should be thinking about the power of incentives.” – Charlie Munger, American billionaire investor.
2526
2527
How random are TOTP codes?
I'm pretty sure that the 2FA codes generated by my bank's TOTP app have a bias towards the number 8 - because eight is an auspicious number. But is that just my stupid meaty brain noticing patterns where none exist? The TOTP algorithm uses HMAC, which in turn uses SHA-1. My aforementioned brain is not clever enough to…
2528
Securing Ubuntu
Table of Contents Initial Setup Setting up iptables and Fail2Ban Fail2Ban iptables rules Make shared memory read-only Setting up Bastille Linux Configuring Bastille sysctl hardening Setting up a chroot environment Securing nginx inside the chroot Extras Initial Setup Let’s login to our new machine and take some…
2529
2FA on the command line
OTP: One-Time Password TOTP: Time-based One-time Password algorithm 2FA: Two-factor authentication There is no shortage of OTP 2FA apps availiable for your phone, such as Google Authenticator or Duo Mobile. These apps take an initial secret code, and create a TOTP anytime you need a 2FA code for login.… …
2530
Guessing smart phone PINs by monitoring the accelerometer
“Practicality of Accelerometer Side Channels on Smartphones,” by Adam J. Aviv. Benjamin Sapp, Matt Blaze, and Jonathan M. Smith. Abstract: Modern smartphones are equipped with a plethora of sensors that enable a wide range of interactions, but some of these sensors can be employed as a side channel to surreptitiously…
2531
The RubyGems "Security Incident"
Ruby Central posted an extremely concerning “Incident Response Timeline” today, in which they make a number of exaggerated or purely misleading claims. Here’s my effort to set the record straight. First, and most importantly: I was a primary operator of RubyGems.org, securely and successfully, for over ten years. Ruby…
2532
2533
Service drains competitor's Adwords budget
The longer one lurks in the Internet underground, the more difficult it becomes to ignore the harsh reality that for nearly every legitimate online business there is a cybercrime-oriented anti-business. Case in point: Today’s post looks at a popular service that helps crooked online marketers exhaust the Google…
2534
2535
Apple EFI firmware passwords and the SCBO myth
My original goal when I started poking around Apple’s EFI implementation was to find a way to reset a MacBook’s firmware password. My preliminary research found references to a “magical” SCBO file that could be loaded onto a USB flash drive and booted to remove the password. The normal process workflow is to first…
2536
Microsoft Edge (Chromium) – Elevation of Privilege to Potential RCE
With some luck and a couple of XSS bugs I was able to break the new Edge
2537
2538
Microsoft Dependency Has Risks
There was a recent incident where Microsoft somehow allegedly blocked a mailbox of a sanctioned individual . Any organization highly depending on MS products that might come into the crosshair should ask - can this happen to me? What would be the cost? How much I invest into prevention of this scenario? In this…
2539
2540
A few thoughts on Fuchsia security
I want to say a few words about my current adventure. I joined the Fuchsia project at its inception and worked on the daunting task of buil...
2541
The xz backdoor thing reminds me of a story
This xz backdoor thing reminds me of a story I heard from friends that worked at a tech company that made cell phones. They had a great coder that worked on the project, he had put in work as a contractor for a few months, and due to the quality of his work he was hired in full time. After two months he simply stopped…
2542
PureVPN IPv6 Leak
Two findings in PureVPN on Ubuntu 24.04. After a reconnect the system takes a default IPv6 route outside the tunnel, and the ip6tables OUTPUT policy is still ACCEPT, so traffic leaves in the clear while the client reports connected.
2543
Arduino FIDO2 Authenticator
Introducing URU Card: an open-source, wallet-sized FIDO2 BLE authenticator based on ESP32, ATECC508A, OLED screen, and MPR121 touch keyboard. Join the project and start building your own secure authenticator.
2544
Post from "weev" (AT&T/ipad data hacker) on his arrest and treatment
A while ago, someone came to me and gave me some data involving AT&T iPad customers to publicize, the full story of which I’m sure you’re all familiar with from my previous excellent blog posts. I was subsequently raided by the FBI and arrested , though I have been under gag orders and haven’t been able to discuss the…
2545
Copy-Pasting URLs from Google Search Can Leak Previous Searches
Note: This information has been disclosed to Google appropriately, they have chosen to not fix this behavior.
2546
2547
I accidentally built a spying app
A personal story about creating new products and their unintended consequences
2548
Disqus Demonstrates How to Do Breach Disclosure Right
We all jumped on "the Equifax dumpster fire bandwagon" recently and pointed to all the things that went fundamentally wrong with their disclosure process. But it's equally important that we acknowledge exemplary handling of data breaches when they occur because that's behaviour that should be encouraged. Last week,
2549
2550
Little Snitch feature nobody knows about
Little Snitch by Objective Development is the first app that I install on a new Mac. In fact I just bought a new Mac, an M4 MacBook Pro with nano-texture display, and I installed Little Snitch via thumb drive even before connecting the Mac to the internet. While setting up my new Mac, which came with macOS 15.2…