541
Facebook's Hypocrisy on Apple's New iOS 14 Privacy Feature
In their latest attempt to disrupt the iOS anti-ad tracking feature, Facebook has stooped to a new low
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,768 posts.
542
I wrote to Flock's privacy contact to opt out of their domestic spying program
I wrote to Flock’s privacy contact to opt out of their …
543
I Hacked into Facebook's Legal Department Admin Panel
Alaa Abdulridha — Engineering Director at SerpApi & Cybersecurity Researcher. Expert in web application penetration testing, reverse engineering, bug bounty programs, and secure code development. Passionate about discovering vulnerabilities, building scalable systems, and teaching practical cybersecurity techniques.
544
Highly Evasive Attacker Leverages SolarWinds Supply Chain
Transform cyber defense with Mandiant. Engage frontline experts for incident response, threat intelligence services, and cyber risk management.
545
Unlocking free WiFi on British Airways
Personal website talking about some stuff I've made and technology
546
We hacked Gemini's Python sandbox and leaked its source code (at least some)
Leaked Google's internal google3 source and confidential security protos out of Gemini's Python sandbox by exfiltrating a 579 MB binary in 10 MB chunks.
547
I decompiled the White House's new app
The official White House Android app has a cookie/paywall bypass injector, tracks your GPS every 4.5 minutes, and loads JavaScript from some guy's GitHub Pages.
548
Security issue related to the NPM registry
We're sharing details of recent incidents on the npm registry, our investigations, and how we’re continuing to invest in the security of npm.
549
DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage
💡Update May 21, 2025: I've written a new detailed analysis of the heap dump dataset itself: TeleMessage customers include DC Police, Andreessen Horowitz, JP Morgan, and hundreds more Update May 26, 2025: I've published the source code for TeleMessage Explorer: a new open source research tool This morning,
550
Want your images back? That'll be $5
We're in the era of trillion-dollar companies, but that doesn't mean you should leave $5 on the table!
551
Blacksmith – Rowhammer bit flips on all DRAM devices today despite mitigations
We demonstrate that it is possible to trigger Rowhammer bit flips on all DRAM devices today despite deployed mitigations on commodity off-the-shelf systems with little effort. This result has a significant impact on the system’s security as DRAM devices in the wild cannot easily be fixed, and previous work showed…
552
EasyList is in trouble and so are many ad blockers
One of the world’s most popular ad blocking filter lists, EasyList, has run into a serious issue that threatens to tank it, as well as many open-source projects that rely on it. See if this affects you personally, and how you can help.
553
China's New Cybersecurity Program: No Place to Hide
Chinese distributors can help foreign companies reach customers without setting up a business in China. The wrong agreement can leave a supplier locked into years of poor sales, trademark disputes, or regulatory problems. Here are ten issues we address before a client signs.
554
Age Verification Laws: A Backdoor to Surveillance
I’m old enough to remember when age verification bills were pitched as a way to ‘save the kids from porn’ and shield them from other vague dangers lurking in the digital world (like…“the transgender”). We have long cautioned about the dangers of these laws, and pointed out why they are likely to...
555
1-Click GitHub Token Stealing via a VSCode Bug
My blog, mostly about programming
556
Chrome’s address bar will use https:// by default
Starting in version 90, Chrome’s address bar will use https:// by default, improving privacy and even loading speed for users visiting webs...
557
Experian’s credit freeze security is still a joke
In 2017, KrebsOnSecurity showed how easy it is for identity thieves to undo a consumer’s request to freeze their credit file at Experian , one of the big three consumer credit bureaus in the United States. Last week, KrebsOnSecurity heard from a reader who had his freeze thawed without authorization through Experian’s…
558
If you've nothing to hide, you've got nothing to fear
Since 1851 Amsterdam had a registry that recorded the following innocent pieces of data about the residents: Name, Date of birth, Address, Marital Status, Parents, Profession, Religion, Previous Addresses and Date of Death if deceased. For many years this system served well and was kept meticulously up to date.
559
I used o3 to find a remote zeroday in the Linux SMB implementation
In this post I’ll show you how I found a zeroday vulnerability in the Linux kernel using OpenAI’s o3 model. I found the vulnerability with nothing more complicated than the o3 API ̵…
560
Latest Firefox Brings Privacy Protections Front and Center
Our push this year has been building privacy-centric features in our products that are on by default. With this move, we’re taking the guesswork out of h
561
562
WARP is here
Today, after a longer than expected wait, we're opening WARP and WARP+ to the general public. If you haven’t heard about it yet, WARP is a mobile app designed for everyone which uses our global network to secure all of your phone’s Internet traffic.
563
Gas Pump Skimmers
What’s the first thing that should scare you? There’s three. And the next? The label ‘46’. They’ve got so many in the field criminals need to number them just to keep track.
564
Who is Facebook's mysterious “Lan Tim 2”?
Facebook has an interesting feature. It will let you see which companies have associated your off-Facebook activity with your Facebook account. If you visit: https://www.facebook.com/off_facebook_activity/ you'll see what companies are snitching on you to Facebook. Alice St⭕️llmeyer@StollmeyerEU#AirBnB shares your…
565
566
OpenAI, the US government and Persona built an identity surveillance machine
53MB of source code leaked from a government endpoint. 269 verification checks. biometric face databases. SAR filings to FinCEN. and the same company that verifies your ChatGPT account.
567
I read the federal government’s Zero-Trust Memo so you don’t have to
Yesterday, the Office and Management and Budget (OMB) released a memo:“Moving the U.S. Government Towards Zero Trust Cybersecurity Principles”. The memo…
568
New NSA Leak Shows MITM Attacks Against Major Internet Services
The Brazilian television show “Fantastico” exposed an NSA training presentation that discusses how the agency runs man-in-the-middle attacks on the Internet. The point of the story was that the NSA engages in economic espionage against Petrobras, the Brazilian giant oil company, but I’m more interested in the tactical…
569
Fuck passwords
I’m so tired of passwords. So, so, so tired. Most people don’t understand this. Most people use the same password everywhere. Most people can just mechanically type out password3 in every password box, smirking to themselves at how clever they are, because who would ever guess 3 instead of 1? I don’t do that. Let me…
570
Another free CA as an alternative to Let's Encrypt
As the use of HTTPS continues to increase across the Web, we need more support from Certificate Authorities that issue the certificates to make it all work. I'm a huge fan of Let's Encrypt and what they're doing, but if we want to encrypt the entire Web,