Topics /
The most popular blog posts about security & privacy on Hacker News. 4,333 posts.
Here in Austria, you need to be either vaccinated against, tested negative for, or have recovered from COVID-19 to go to the pub (or pretty much everywhere) right now. If you don't want to carry around your paperwork proving one of those, you can alternatively show your Green Pass QR code to be let in.
Looking at a dataset of 350 million ssl connections inspires some initial questions:
In their latest attempt to disrupt the iOS anti-ad tracking feature, Facebook has stooped to a new low
I wrote to Flock’s privacy contact to opt out of their …
Alaa Abdulridha — Engineering Director at SerpApi & Cybersecurity Researcher. Expert in web application penetration testing, reverse engineering, bug bounty programs, and secure code development. Passionate about discovering vulnerabilities, building scalable systems, and teaching practical cybersecurity techniques.
Personal website talking about some stuff I've made and technology
The official White House Android app has a cookie/paywall bypass injector, tracks your GPS every 4.5 minutes, and loads JavaScript from some guy's GitHub Pages.
💡Update May 21, 2025: I've written a new detailed analysis of the heap dump dataset itself: TeleMessage customers include DC Police, Andreessen Horowitz, JP Morgan, and hundreds more Update May 26, 2025: I've published the source code for TeleMessage Explorer: a new open source research tool This morning,
We're in the era of trillion-dollar companies, but that doesn't mean you should leave $5 on the table!
My blog, mostly about programming
In 2017, KrebsOnSecurity showed how easy it is for identity thieves to undo a consumer’s request to freeze their credit file at Experian , one of the big three consumer credit bureaus in the United States. Last week, KrebsOnSecurity heard from a reader who had his freeze thawed without authorization through Experian’s…
Since 1851 Amsterdam had a registry that recorded the following innocent pieces of data about the residents: Name, Date of birth, Address, Marital Status, Parents, Profession, Religion, Previous Addresses and Date of Death if deceased. For many years this system served well and was kept meticulously up to date.
In this post I’ll show you how I found a zeroday vulnerability in the Linux kernel using OpenAI’s o3 model. I found the vulnerability with nothing more complicated than the o3 API ̵…
Facebook has an interesting feature. It will let you see which companies have associated your off-Facebook activity with your Facebook account. If you visit: https://www.facebook.com/off_facebook_activity/ you'll see what companies are snitching on you to Facebook. Alice St⭕️llmeyer@StollmeyerEU#AirBnB shares your…
53MB of source code leaked from a government endpoint. 269 verification checks. biometric face databases. SAR filings to FinCEN. and the same company that verifies your ChatGPT account.
The Brazilian television show “Fantastico” exposed an NSA training presentation that discusses how the agency runs man-in-the-middle attacks on the Internet. The point of the story was that the NSA engages in economic espionage against Petrobras, the Brazilian giant oil company, but I’m more interested in the tactical…
I’m so tired of passwords. So, so, so tired. Most people don’t understand this. Most people use the same password everywhere. Most people can just mechanically type out password3 in every password box, smirking to themselves at how clever they are, because who would ever guess 3 instead of 1? I don’t do that. Let me…
As the use of HTTPS continues to increase across the Web, we need more support from Certificate Authorities that issue the certificates to make it all work. I'm a huge fan of Let's Encrypt and what they're doing, but if we want to encrypt the entire Web,
How many web servers are running on your machine right now? Do all of those development web servers have a secure login, and restrictive CORS permissions? You don’t know? Allow me to check for you:
[German]Brief information, which is already here with me since August 2021, but which I have not yet addressed in the blog. David Xanatos has pointed out to me that Microsoft is refusing to sign…
I recommend turning Dependabot off and replacing it with a pair of scheduled GitHub Actions, one running govulncheck, and the other running CI against the latest version of your dependencies.
i dissected some firmware for a Hanwha Wisenet XNP-9300RW and found that it had github admin tokens in it, also miltech is weird
I’ve been doing the local usergroup circuit with this lately and have been asked to write it up.
So while I work with police departments regularly, I think it is critically important that technology be used reasonably. While this may be off-putting to some of my clients, I worked with the Inst…
David Schütz's bug bounty writeups
I originally wrote this for my friends and family in 2015, to explain why the latest Facebook privacy policy is really harmful. It’s since been read b
TLDR: Bank of America is a horrible business and it should be ashamed by how bad it is. Two weeks ago, I suddenly received emails informing me that my Bank of America…
