3211
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,335 posts.
3212
Zero-knowledge proofs, Zcash, and Ethereum
Part 3 of a series on “Privacy on the Blockchain”.
3213
Building a WebAuthn Click Farm
How I built a click farm to “bypass” Cloudflare’s CAPTCHA killer with some cheap USB security keys, an Arduino, and a bit of python.
3214
Curryfinger – Find the Server Behind the CDN
CURRYFINGER quickly and effectively identifies the real hosts behind CDN networks like CloudFlare - and outperforms existing tools. Find out how to use it.
3215
Neat trick for getting private info for Facebook, GMail, Twitter and Digg users
Hidden img and script tags with onload and onerror let any site tell if you're logged into GMail, Facebook, Twitter or Digg. Google called it expected.
3216
Podman rootless containers and the Copy Fail exploit
On April 29th CVE-2026-31431 was publicly disclosed at https://copy.fail/ . This vulnerability allows a local unprivileged user to obtain a root shell by running the Python script shared by the author.
3217
Modern TLS/SSL on 16-bit Windows
Lately, there's been an resurgence of new programs written for retro computers—everything from a Slack client to many Wordle clones, to a Mastodon client. But most of these programs, if they connect to the Internet, require a proxy running on a modern computer to handle the SSL/TLS connection, which almost all APIs…
3218
The Ethics of Running a Data Breach Search Service
No matter how much anyone tries to sugar coat it, a service like Have I been pwned [https://haveibeenpwned.com/] (HIBP) which deals with billions of records hacked out of other peoples' systems is always going to sit in a grey area. There are degrees, of course; at one end
3219
Digital ID – The New Chains of Capitalist Surveillance
From The world is entering an era where identity is no longer a matter of personal relationships, lived experience, or even paperwork. Increasingly, it is reduced to biometric scans, algorithmic ve…
3220
3221
3222
ISP Advertisement Injection - CMA Communications
Apple Inc. endorsing H&R Block with a beautiful bright green banner ad, compliments of CMA Communications. Tired from the day’s ev...
3223
So I lost my OpenBSD FDE password (2016)
The other day I set up a new OpenBSD instance with a nice RAID array, encrypted with Full Disk Encryption. And promptly proceeded to forget part of the passphrase.
3224
Microsoft Uses Trademark Law to Disrupt Trickbot Botnet
Microsoft Corp. has executed a coordinated legal sneak attack in a bid to disrupt the malware-as-a-service botnet Trickbot , a global menace that has infected millions of computers and is used to spread ransomware. A court in Virginia granted Microsoft control over many Internet servers Trickbot uses to plunder…
3225
3226
Myspace lets you hijack any account just by knowing the person’s birthday
In April this year whilst roaming the plains of the wild world web, I stumbled across an old Myspace account of mine. Attempting to gain access and delete the account I discovered a business process so flawed it deserves its own place in history. I wrote to Myspace describing my
3227
Equifax or Equiphish?
More than a week after it said most people would be eligible to enroll in a free year of its TrustedID identity theft monitoring service, big three consumer credit bureau Equifax has begun sending out email notifications to people who were able to take the company up on its offer. But in yet another security stumble…
3228
I Hacked My Car Guides: Creating Custom Firmware
Notice Note: As of 2022/10/25 the information in this series is slightly outdated. See Part 5 for more up to date information. I take no responsibility for any damages due to the information or steps provided on this site. The content is for educational purposes only. You modify your own car’s firmware at your…
3229
Bypassing Gemma and Qwen safety with raw strings
How a Single Function Call Gates Safety Alignment in Gemma, Qwen, and Other Open-Source LLMs
3230
Stop adding email tracking links to phone numbers
My Chinese takeaway delivery was late. Very late. I flipped open the confirmation email sent by Just-Eat to double-check I had all the details correct. At the bottom was a "click to call" link. Hurrah! I clicked dial, and this is what filled my screen: An absurdly long phone number. Bemused, I went to inspect the link…
3231
Look before you paste from a website to terminal
All about making life easier and efficient with Linux
3232
3233
Write Fuzzable Code
“An obvious way to deal with embedded interpreters — which someone must have thought of and tried, but I don’t have any pointers — would be to have an API for teaching the fuzzer how to see coverage of the language being interpreted.”
3234
Weaponizing PostScript
In a recent pentesting assignment, there was a service which converted uploaded files to PDF/A format, to make them safer for handling. Afte...
3235
GDPR complaints against Google’s deceptive practices to track user location
Based on new research published today by BEUC’s Norwegian member Forbrukerrådet, seven consumer groups are filing complaints against Google with their national data protection authorities.
3236
3237
The Web Authentication Arms Race – A Tale of Two Security Experts
Web authentication systems have evolved over the past ten years to counter a growing variety of threats. This post will present a fictional arms race between a web application developer and an attacker, showing how different threats can be countered with the latest security technologies.
3238
3239
Cracking Encrypted PDFs
I performed a brute-force attack on the password of an encrypted PDF and a brute-force attack on the key of (another) encrypted PDF, both PDFs are part of a challenge published by John August. The …
3240
