1801
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,768 posts.
1802
Downloading Software Safely Is Nearly Impossible
Let’s say you have a brand-new Windows laptop and you’re just oh, so happy. You’re pretty sure the NSA did not interdict it during shipment , and thus that it comes only with the flaky goatware Microsoft, Lenovo, and any number of Lenovo’s business partners intended for it to have. Now all you need is an SSH client so…
1803
Testing Phone-Sized Faraday Bags
Complex software is, to put it mildly, hard to get right (for details, see almost any other posting on this or any other security blog). Especially for gadgets that are rich with microphones, cameras, location and environmental sensors, and communication links (such as, you know, smartphones), errors and security…
1804
Using Silk Road
History, background, visiting, ordering, using, & analyzing the drug market Silk Road 1
1805
Microsoft finds privilege escalation vulnerability in Huawei driver
Our discovery of two privilege escalation vulnerabilities in a driver highlights the strength of Microsoft Defender ATP’s sensors. These sensors expose anomalous behavior and give SecOps personnel the intelligence and tools to investigate threats, as we did.
1806
1807
DHS asks Mozilla to take down MafiaaFire add-on
From time to time, we receive government requests for information, usually market information and occasionally subpoenas. Recently the US Department of Homeland Security contacted Mozilla and reque…
1808
Ad blocking is under attack (2017)
Well, this is huge, so I'd like to draw your attention to what's happening right now. This is a very alarming case, and it concerns every ad blocker user.
1809
How kernel anti-cheats work
Modern kernel anti-cheat systems are, without exaggeration, among the most sophisticated pieces of software running on consumer Windows machines. They operate at the highest privilege level available to software, they intercept kernel callbacks that were designed for legitimate security products, they scan memory…
1810
The NSA: An Inside View
In which I relate my experience as an NSA employee and impart my thoughts on the policies in place, my former coworkers, and the current cyber war.
1811
I have a lot to say about Signal’s Cellebrite hack
This blog post is based off of a talk I gave on May 12, 2021 at the Stanford Computer Science Department’s weekly lunch talk series on computer security topics. Full disclosure: I’ve done some consulting work for Signal, albeit not on anything like this issue. (I kinda doubt
1812
CatalanGate: Spyware operation against Catalans using Pegasus and Candiru
The Citizen Lab, in collaboration with Catalan civil society groups, has identified at least 65 individuals targeted or infected with mercenary spyware, including members of the European Parliament, Catalan Presidents, legislators, jurists, and members of civil society organisations.
1813
1814
Microsoft is spying on users of its AI tools
Microsoft announced that it caught Chinese, Russian, and Iranian hackers using its AI tools—presumably coding tools—to improve their hacking abilities. From their report: In collaboration with OpenAI, we are sharing threat intelligence showing detected state affiliated adversaries—tracked as Forest Blizzard, Emerald…
1815
Tailscale state file encryption no longer enabled by default
View changes to the Tailscale client and service.
1816
Zxcvbn: realistic password strength estimation
Dash knows your context, your team, and your work, so your team can stay organized, easily find and share knowledge, and keep projects secure, all from one place.
1817
Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App
How an open redirect in Harvest’s Outlook Calendar integration leaked the OAuth tokens of connected Microsoft accounts, with a step-by-step proof of concept.
1818
Introducing s2n, a New Open-Source TLS Implementation
February 22, 2022: s2n has been renamed to s2n-tls. See details. At Amazon Web Services, strong encryption is one of our standard features, and an integral aspect of that is the TLS (previously called SSL) encryption protocol. TLS is used with every AWS API and is also available directly to customers of many AWS…
1819
1820
1821
Obsidian plugin was abused to deploy a remote access trojan
A sophisticated campaign is abusing the Obsidian note-taking app to deliver a new RAT, PHANTOMPULSE, to targets in the finance and crypto sectors using...
1822
The Microsoft MFA system almost brought me to a nervous breakdown
Update 12/10/21, 10:15 UTC: I never imagined this post would reach the front page on Hacker News and gather so much support. Thank you all…
1823
Archive.today is directing a DDoS attack against my blog
Around January 11, 2026, archive.today (aka archive.is, archive.md, etc) started using its users as proxies to conduct a distributed denial of service (DDOS) attack against Gyrovague, my personal b…
1824
Detect breaches with Canary credit cards
Detect breaches with Canary credit cards! TL;DR; Today we’re releasing a new Canarytoken type: actual credit cards! Head over to canarytokens.org; We give you a valid credit card (number, expiration, and CVC); If anyone ever attempts to use that card you’ll be notified. We recommend placing one anywhere you store…
1825
Gitlab Blocked Iranians’ Access
Ahmad Haghighi’s personal page.
1826
New DHS policy on demands for passwords to travelers’ electronic devices
US Customs and Border Protection, a component of the Department of Homeland Security, today posted a revised policy on Border Searches of Electronic Devices and a Privacy Impact Assessment of some of the changes made by the new policy.
1827
1828
Notes by djb on using Fil-C
I'm impressed with the level of compatibility of the new memory-safe C/C++ compiler Fil-C (filcc, fil++). Many libraries and applications that I've tried work under Fil-C without changes, and the exceptions haven't been hard to get working.
1829
Websites are tracking you via browser fingerprinting
New research provides first evidence of the use of browser fingerprints for online tracking.
1830
Facebook Disabled My Account After I Criticized Them
Facebook unfriended me. Why? So far as I can tell, it’s because I’ve been using Facebook to advocate for decentralization of social media. And apparently th ...