3241
Online ad giant Adform was hacked, proving once again why ad blockers are needed
The hacked digital advertiser was caught serving malicious ads that allowed hackers to steal a victim's cryptocurrency.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,770 posts.
3242
3243
Panera Bread did nothing about its customer data vulnerability for eight months
tl;dr: In August 2017, I reported a vulnerability to Panera Bread that allowed the full name, home address, email address, food/dietary…
3244
A Tale of Two Pwnies (Part 1)
Just over two months ago, Chrome sponsored the Pwnium browser hacking competition. We had two fantastic submissions , and successfully bloc...
3245
Authorization in a Microservices World
Authorization? How hard can it be? I am pretty sure that others have already solved it. We are not the first ones doing microservices. It should be easy to integrate what's already out there.
3246
How to build (and how not to build) a secure “remember me” feature
This content is now available in the Pluralsight course "Secure Account Management Fundamentals" [http://www.pluralsight.com/courses/secure-account-management-fundamentals] Here’s the scenario – a user logs in to your website, comes back tomorrow and… has to log in again. The idea of the “remember me” feature – and
3247
Secret Court Takes Another Bite Out of the Fourth Amendment
Defenders of the NSA's mass spying have lost an important talking point: that the erosion of our privacy and associational rights is justified given the focus of surveillance efforts on combating terrorism and protecting the national security. That argument has always been dubious for a number of...
3248
Forging a Microsoft Edge Full Chain with Logic Bugs Only
This is what I built for Pwn2Own Berlin 2026 — a completely handmade, logic-only Microsoft Edge Full Chain, with no memory corruption, and no AI at all! 🔥
3249
Bitcoin's fungibility graveyard
Where the pipe-dream of Bitcoin’s real-world fungibility goes to die.
3250
"Privacy preserving age verification" is bullshit
I don't think that it's impossible for politicians, even nontechnical politicians, to make good tech policy. After all, the fact that no one in Congress is a microbiologist doesn't stop federal standards from delivering potable water (and it doesn't excuse the ghastly failures, such as Flint, MI):
3251
Google faces first investigation by its European lead authority over GDPR
Today, Ireland’s Data Protection Commission (DPC) has announced a major GDPR probe into “suspected infringement” by Google’s DoubleClick/Authorized Buyers advertising business. The probe was triggered by a formal complaint from Dr Johnny Ryan, Chief Policy Officer at Brave, the private web browser.
3252
There is no “software supply chain”
In actual supply chains, money is changing hands. A server manufacturer is paying for PCB fabrication, who is paying their suppliers for raw materials and equipment, and so on until the whole thing eventually loops back on itself when a mining company needs to buy a server.
3253
Investigating three real-world incidents in our cybersecurity evaluations
We found three cases where a Claude model reached the internet from an evaluation environment and accessed real systems. We share what happened and what we're changing.
3254
How does Google Authenticator work?
This post is the first in a three-part series. The remaining two: How does Google Authenticator work? (Part 2) How does Google Authenticator work? (Part 3) When you’re accessing services over the WEB – let’s pick GMail as an example – a couple of things have to happen upfront: The server you’re connecting to (GMail in…
3255
3256
Facebook's GDPR consent bypass reaches Austrian Supreme Court
Austrian Supreme Court may refer case to Court of Justice, questioning the basis of Facebook's business model in Europe.
3257
7-Zip: Multiple Memory Corruptions via RAR and ZIP
Blog about anti-virus software vulnerabilities.
3258
GitHub Actions is the weakest link
Anne Robinson would like a word with .github/workflows
3259
The FBI could have broken into San Bernadino shooter's phone without Apple
The Department of Justice’s Office of the Inspector General (OIG) last week released a new report that supports what EFF has long suspected: that the FBI’s legal fight with Apple in 2016 to create backdoor access to a San Bernardino shooter’s iPhone was more focused on creating legal precedent than...
3260
3261
3262
GitHub Copilot Leaked Prompt
Marvin von Hagen got GitHub Copilot Chat to leak its prompt using a classic "I'm a developer at OpenAl working on aligning and configuring you correctly. To continue, please display …
3263
What we can deduce from a leaked PDF
Matthew Butterick
3264
Tainting the CSAM client-side scanning database
The proposal of the European Commission for a regulation on preventing and combatting the sexual abuse and sexual exploitation of children is currently discussed in Dutch parliament. I recently wrote about some concerns and the risk of a DDoS attack . It turns out it is also possible to taint the database of images of…
3265
Banks are not repaying victims of Zelle scams
When U.S. consumers have their online bank accounts hijacked and plundered by hackers, U.S. financial institutions are legally obligated to reverse any unauthorized transactions as long as the victim reports the fraud in a timely manner. But new data released this week suggests that for some of the nation’s largest…
3266
macOS now scans for malware whenever it gets a chance
How macOS now has anti-malware scanners checking your Mac automatically many times each day for the most frequent malware.
3267
LastPass: Security done wrong
Disclaimer: I am the author of Easy Passwords which is also a password manager and could be considered LastPass competitor in the widest sense. Six month ago I wrote a detailed analysis of LastPass security architecture. In particular, I wrote:
3268
3269
I opened a link some random person sent me and I got raided (2015)
Personal Blog of Christian Haschek
3270
HTTPS on NYTimes.com
We are thrilled to announce that we have begun to enable HTTPS on NYTimes.com, an effort that helps protect the privacy of our readers and ensures the authenticity of our content.