3031
Skype contact lists may have been exposed (2017)
UPDATE: February 14, 2019: Since writing this article in late 2017, Microsoft seems to have made a change that makes it a bit harder to reverse
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,770 posts.
3032
TSA’s Roadmap for Airport Surveillance Moves in a Dangerous Direction
The Transportation Security Administration has set out an alarming vision of pervasive biometric surveillance at airports, which cuts against the right to privacy, the “right to travel,” and the right to anonymous association with others.The FAA Reauthorization Act of 2018, which included language...
3033
3034
Important security vulnerabilities in OpenVPN
UPDATE: OpenVPN fuzzers now released. Summary I’ve discovered 4 important security vulnerabilities in OpenVPN. Interestingly, these were not found by the two recently completed audits of Open…
3035
How are cyber criminals rolling in 2025?
Speaking of earning a living, would you expect them to pay for web hosting/ cloud providers?
3036
3037
Demystifying CORS
CORS (Cross-Origin Resource Sharing) is subject tinged with dread for many web developers. Like tales of a mythical sea beast, every developer has a story to tell about the day CORS seized upon one of their web requests, dragging it down into the inexorable depths, never to be seen again.
3038
AWS Security Primer
I was preparing some AWS Security related training. Soon, I realized that this topic is too huge to fit into my brain. So I s...
3039
Bypassing Safari 17's advanced audio fingerprinting protection
Explore how Safari 17’s new anti-fingerprinting techniques affect audio fingerprinting and browser differentiation.
3040
How many users block Google analytics? (2017)
Comparing Google Analytics with server logs
3041
3042
The coming industrialisation of exploit generation with LLMs
Recently I ran an experiment where I built agents on top of Opus 4.5 and GPT-5.2 and then challenged them to write exploits for a zeroday vulnerability in the QuickJS Javascript interpreter. I adde…
3043
Google Introduces Passkey Authentication
By: Arnar Birgisson and Diana K Smetters, Identity Ecosystems and Google Account Security and Safety teams Starting today , you can create a...
3044
How Cloudflare blocked a monumental 7.3 Tbps DDoS attack
In mid-May 2025, blocked the largest DDoS attack ever recorded: a staggering 7.3 terabits per second (Tbps).
3045
3046
No strcpy either
Some time ago I mentioned that we went through the curl source code and eventually got rid of all strncpy() calls. strncpy() is a weird function with a crappy API. It might not null terminate the destination and it pads the target buffer with zeroes. Quite frankly, most code bases are probably better off completely ……
3047
3048
Real-world stories of how we’ve compromised CI/CD pipelines
Cutting-edge cyber security research from NCC Group. Find public reports, technical advisories, analyses, & other novel insights from our global experts.
3049
Unencrypted patient medical information is being broadcast across Vancouver
The Open Privacy Research Society is a non-profit Canadian group based in Vancouver, British Columbia. We believe that moral systems enable consent. Our society exists to invent, create, build, test, publish, deploy, promote, and to encourage the development of such systems
3050
Security audit of account and payment services
Assured AB were contracted to perform a security assessment of our account and payment services between 2022-11-07 and 2022-11-29.
3051
Shutting down our unencrypted public DNS service
On the 16th January 2023 we will shut down our legacy public DNS service, currently reachable from this IP: 193.138.218.74
3052
Intercepting Zoom's encrypted data with BPF
How to use Rust and BPF to intercept the data sent and received by programs that use OpenSSL.
3053
No boundaries for user identities: Web trackers exploit browser login managers
In this second installment of the “No Boundaries” series, we show how a long-known vulnerability in browsers’ built-in password managers is abused by third-party scripts for tracking on more than a thousand sites. by Gunes Acar, Steven Englehardt, and Arvind Narayanan We show how third-party scripts exploit browsers’…
3054
3055
Better Random Number Generation for OpenSSL, Libc, and Linux Mainline
中文版 In 2015, AWS introduced s2n, a new open source implementation of the TLS/SSL protocols that protect the privacy and integrity of data moving over a network. s2n was designed to be secure, simple, small, and fast. The project is thriving, and we use it extensively. In February, our CISO Stephen Schmidt shared that…
3056
Biometric YubiKey
Learn more about what's happening within the tech and cybersecurity industry and the developments in our business and security keys within our Yubico Blog.
3057
Cname cloaking, a disguise of third-party trackers
An in-depth exploration of a new method used by tracking companies to disguise their third-party trackers as first-party trackers.
3058
Spectre and the end of langsec
wingolog: article: spectre and the end of langsec
3059
3060
China's Great Cannon
This post describes our analysis of an attack tool that we identify as separate from, but co-located with, the Great Firewall of China.