1
Announcing the first SHA-1 collision
Posted by Marc Stevens (CWI Amsterdam), Elie Bursztein (Google), Pierre Karpman (CWI Amsterdam), Ange Albertini (Google), Yarik Markov (Goog...
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,646 posts.
2
No Cookie for You
The developer community remains the heart of GitHub, and we’re committed to respecting the privacy of developers using our product.
3
Claude Code is steganographically marking requests
I inspected Claude Code for privacy reasons and found hidden system prompt markers based on API base URL and timezone.
4
Motorola announces a partnership with GrapheneOS
Motorola announces three new B2B solutions at MWC 2026, including GrapheneOS partnership, Moto Analytics and more.
5
Why I’m done with Chrome
This blog is mainly reserved for cryptography, and I try to avoid filling it with random “someone is wrong on the Internet” posts. After all, that’s what Twitter is for! But from …
6
Reading privileged memory with a side-channel
Posted by Jann Horn, Project ZeroWe have discovered that CPU data cache timing can be abused to e...
7
When you browse Instagram and find Tony Abbott's passport number
Do not get arrested challenge 2020
8
Reverse engineering Ticketmaster's rotating barcodes
"Screenshots won't get you in", but Chrome DevTools will.
9
Apple's plan to “think different” about encryption opens a backdoor to your life
Apple has announced impending changes to its operating systems that include new “protections for children” features in iCloud and iMessage. If you’ve spent any time following the Crypto Wars, you know what this means: Apple is planning to build a backdoor into its data storage system and its messaging system.
10
Someone is pretending to be me
One random day - someone spills the beans. They were picked to impersonate me and get a job using my information.
11
12
The newest Instagram “exploit” is the goofiest I've seen
Yesterday, a slew of Instagram accounts, including some high profile ones like the Obama White House account, seemingly got hacked.
13
Ken Thompson's Unix Password
Somewhere around 2014 I found an /etc/passwd file in some dumps of the BSD 3 source tree, containing passwords of all the old timers such as Dennis Ritchie, Ken Thompson, Brian W. Kernighan, Steve Bourne and Bill Joy.
14
Court: Suspicionless Searches of Travelers’ Phones and Laptops Unconstitutional
Government Must Have Reasonable Suspicion of Digital Contraband Before Searching Electronic Devices at the U.S. Border
15
Firefox Send: Free encrypted file transfer service
At Mozilla, we are always committed to people’s security and privacy. It’s part of our long-standing Mozilla Manifesto. We are continually looking for
16
Launching in 2015: A Certificate Authority to Encrypt the Entire Web
Today EFF is pleased to announce Let’s Encrypt, a new certificate authority (CA) initiative that we have put together with Mozilla, Cisco, Akamai, IdenTrust, and researchers at the University of Michigan that aims to clear the remaining roadblocks to transition the Web from HTTP to HTTPS.Although...
17
Bypassing airport security via SQL injection
We discovered a serious vulnerability in the Known Crewmember (KCM) and Cockpit Access Security System (CASS) programs used by the Transportation Security Administration.
18
Anyone can access deleted and private repository data on GitHub
You can access data from deleted forks, deleted repositories and even private repositories on GitHub. And it is available forever. This is known by GitHub, and intentionally designed that way.
19
20
Everyone knows your location: tracking myself down through in-app ads
How I tracked myself down using leaked location data in the in-app ads, and what I found along the way.
21
Whistleblower: Ubiquiti Breach “Catastrophic”
Last year, I posted a series of articles about a purported “breach” at Ubiquiti. My sole source for that reporting was the person who has since been indicted by federal prosecutors for his alleged wrongdoing – which includes providing false information to the press.
22
23
Axios compromised on NPM – Malicious versions drop remote access trojan
Hijacked maintainer account used to publish poisoned axios releases including 1.14.1 and 0.30.4. The attacker injected a hidden dependency that drops a cross platform RAT. We are actively investigating and will update this post with a full technical analysis.
24
I tried creating a web browser, and Google blocked me
After 4 months of waiting, that is the response I got from Widevine, Google’s DRM for web browsers, regarding a license agreement. For the last 2 years I’ve been working on a web browser that now cannot be completed because Google, the creators of the open source browser Chrome, won’t allow DRM in an open source…
25
IoT hacking and rickrolling my high school district
This is the story of how I created a botnet of IPTVs to rickroll 10,000+ students for my senior prank.
26
Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer
Cellebrite makes software to automate physically extracting and indexing data from mobile devices. They exist within the grey – where enterprise branding joins together with the larcenous to be called “digital intelligence.” Their customer list has included authoritarian regimes in Belarus, Russi...
27
1.1.1.1: Fast, privacy-first consumer DNS service
Cloudflare's mission is to help build a better Internet. We're excited today to take another step toward that mission with the launch of 1.1.1.1 — the Internet's fastest, privacy-first consumer DNS service. This post will talk a little about what that is and a lot about why we decided to do it.
28
Zoom Acquires Keybase
You're reading the Keybase blog. There are more posts . When you're done, you can install Keybase .
29
Google’s GDPR Workaround
Brave presents new RTB evidence, and has uncovered a mechanism by which Google appears to be circumventing its purported GDPR privacy protections.
30
Our investigation into the suspicious pressure on Archive.today
Some time ago, we were contacted by a group fighting against online CSAM, demanding that AdGuard DNS blocks the Archive.today website. This was only the beginning of a much larger story…