1
Claude Code is steganographically marking requests
I inspected Claude Code for privacy reasons and found hidden system prompt markers based on API base URL and timezone.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,328 posts.
2
Why I’m done with Chrome
This blog is mainly reserved for cryptography, and I try to avoid filling it with random “someone is wrong on the Internet” posts. After all, that’s what Twitter is for! But from …
3
When you browse Instagram and find Tony Abbott's passport number
Do not get arrested challenge 2020
4
Reverse engineering Ticketmaster's rotating barcodes
"Screenshots won't get you in", but Chrome DevTools will.
5
Someone is pretending to be me
One random day - someone spills the beans. They were picked to impersonate me and get a job using my information.
6
The newest Instagram “exploit” is the goofiest I've seen
Yesterday, a slew of Instagram accounts, including some high profile ones like the Obama White House account, seemingly got hacked.
7
Ken Thompson's Unix Password
Somewhere around 2014 I found an /etc/passwd file in some dumps of the BSD 3 source tree, containing passwords of all the old timers such as Dennis Ritchie, Ken Thompson, Brian W. Kernighan, Steve Bourne and Bill Joy.
8
Bypassing airport security via SQL injection
We discovered a serious vulnerability in the Known Crewmember (KCM) and Cockpit Access Security System (CASS) programs used by the Transportation Security Administration.
9
10
Everyone knows your location: tracking myself down through in-app ads
How I tracked myself down using leaked location data in the in-app ads, and what I found along the way.
11
Whistleblower: Ubiquiti Breach “Catastrophic”
Last year, I posted a series of articles about a purported “breach” at Ubiquiti. My sole source for that reporting was the person who has since been indicted by federal prosecutors for his alleged wrongdoing – which includes providing false information to the press.
12
13
I tried creating a web browser, and Google blocked me
After 4 months of waiting, that is the response I got from Widevine, Google’s DRM for web browsers, regarding a license agreement. For the last 2 years I’ve been working on a web browser that now cannot be completed because Google, the creators of the open source browser Chrome, won’t allow DRM in an open source…
14
IoT hacking and rickrolling my high school district
This is the story of how I created a botnet of IPTVs to rickroll 10,000+ students for my senior prank.
15
In 2024, please switch to Firefox
This December, if there's one tech New Year's resolution I'd encourage you to have, it's switching to the only remaining ethical web browser, Firefox. According to recent posts on social media, Firefox's market share is slipping. We should not let that happen. There are two main reasons why switching is important…
16
How I bypassed Amazon's Kindle web DRM
As it turns out they don't actually want you to do this (and have some interesting ways to stop you)
17
Google Chrome silently installs a 4 GB AI model on your device without consent
Google Chrome is downloading a 4 GB Gemini Nano model onto users' machines without consent, with no opt-in, no opt-out short of enterprise tooling, and an automatic re-download every time the user deletes it. The pattern is identical to the Anthropic Claude Desktop case I wrote about last month, but the scale is…
18
The top-ranking HTML editor on Google is an SEO scam
I went down a rabbit-hole analysing a competitor and discovered a black-hat SEO operation involving tens of thousands of websites.
19
Thanks FedEx, this is why we keep getting phished
I've been getting a lot of those "your parcel couldn't be delivered" phishing attacks lately and if you're a human with a phone, you probably have been too. Just as a brief reminder, they look like this: These get through all the technical controls that exist at
20
21
Aaron Swartz was prosecuted for scraping, while Meta does it without consequence
Also here's a cool unrelated photo of a chipmunk because I need some chill
22
EU Parliament greenlights Chat Control 1.0
Today, the European Parliament allowed the suspicionless mass scanning of private communications ("Chat Control 1.0") to pass, a measure it had rejected twice in March. Although a majority of voting Members of the European Parliament (MEPs) actually opposed the regulation (314 against, 276 in favor,
23
Teen on Musk's DOGE team graduated from 'The Com'
Wired reported this week that a 19-year-old working for Elon Musk ‘s so-called Department of Government Efficiency (DOGE) was given access to sensitive US government systems even though his past association with cybercrime communities should have precluded him from gaining the necessary security clearances to do so…
24
Leaking the email of any YouTube user for $10k
What could've been the largest data breach in the world - an attack chain on Google services to leak the email address of any YouTube channel
25
A backdoor in a LinkedIn job offer
A fake recruiter, a crypto repo, and a remote code execution payload hidden in a test file.
26
Why is this fingerprinting script creating bioweapons?
I've always had a fascination with reverse-engineering browser fingerprinting scripts. Most of my time has been spent looking at the usual suspects (popular fingerprinting libraries like FingerprintJS and more sophisticated scripts used by anti-bots like Cloudflare Turnstile, Akamai, and others).
27
Wacom tablets track every app you open
I have a Wacom drawing tablet. I use it to draw cover illustrations for my blog posts, such as this one.
28
Accidental Google Pixel Lock Screen Bypass
David Schütz's bug bounty writeups
29
Instagram's Million Dollar Bug
How participation in Facebook's bug bounty not only led to the complete compromise of Instagram, but also legal threats and intimidation
30
Your Computer Isn't Yours
There have been several updates appended to this page as of 2020-11-16, please see below. Also available in: Türkçe Français Español Português Português…