301
A Recipe for Steganogravy
how to hide juicy data in plain sight
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 356 posts.
302
Parallel Reconstruction of Lawful TLS Wiretapping
Transport Layer Security (TLS) is the protocol involved in getting the lock icon to appear in your browser next to the URL. Under the hood it uses a bunch of really cool numbers for encryption. Some numbers are considered private and need securing; some are considered public and are fine for sharing. You can mix your…
303
Memory safety absolutists
When seeing the title of this post, I bet in some people's minds, the first thought was "Rust devs!". This connection is not unfounded. Rust devs tend to be passionate about memory safety. Some of it, I'm sure, may have been caused by a classic language wars attitude: my language is better than yours, and here is why…
304
Ad-tech is fascist tech
A core tenet of the enshittification hypothesis is that all the terrible stuff we're subjected to in our digital lives today is the result of foreseeable (and foreseen) policy choices, which created the enshittogenic policy environment in which the worst people's worst ideas make the most money:
305
Disable Your SSH access accidentally with scp
Here's an interesting bug I ran into recently: After transferring some files to my server via scp, I couldn't log in via SSH anymore - my key was rejected by sshd.
306
307
GDID Windows – Cut the tracker that follows you even under VPN
The GDID helped catch a hacker despite his VPN. I set up a VM to see if it can be neutralized: what works, what doesn't, and the scripts to stop it from ...
308
Signs you're a dangerous terrorist: using Signal, moving zines
The unusually long sentences criminalize being an anti-fascist activist, reading the wrong zines, and using the wrong communication apps. They're incredibly dangerous.
309
Who Is Planting Backdoors in Ledger Crypto Wallets?
The theft last week of an estimated $100 million in crypto using a hardware backdoor planted in Ledger wallets points to a sophisticated and systematic attack aimed at subverting crypto wallets sold by legitimate resellers in Asia and Europe
310
“Disregard That” Attacks
Why you shouldn't share your context window with others
311
Linux Internals: How /proc/self/mem writes to unwritable memory (2021)
Introduction An obscure quirk of the /proc/*/mem pseudofile is its “punch through” semantics. Writes performed through this file will succeed even if the destination virtual memory is marked unwritable. In fact, this behavior is intentional and actively used by projects such as the Julia JIT compiler and rr debugger…
312
Soatok's Informal Guide to Threat Models
After a long day of exhausting conversations about Hybrid Post-Quantum Cryptography, random jackasses trying to play gotcha with endpoint attacks against end-to-end encrypted messaging apps, and me…
313
I switched to Brave
I've been using Brave for a couple months now after using Firefox for around 25 years. I think Brave will be a permanent change.
314
The Car That Watches You Back: The Advertising Infrastructure of Modern Cars
How the connected car became an advertising surface. From Stellantis startup pop-ups to GSTV pumps to Gulp Radio aisles, and the consent infrastructure the automobile never developed.
315
316
X-Clacks-Overhead
A small HTTP-header tribute to Sir Terry Pratchett
317
Anyone on the Internet Can Ring Your Doorbell
Behind a cheap Temu doorbell sits an IoT backend where device IDs are sequential and requests are forgeable with a string baked into every firmware. One signed call lifts any device's persistent password and lets anyone on the Internet hijack the next live call.
318
The beauty and terror of modding Windows
Let's talk about the "Windows Baseline Security Mode," too.
319
Supply chain nightmare: How Rust will be attacked and what we can do to mitigate
An essential part of being able to say "I told you so" is in fact having told you so. Well, here we are. For those living under a rock (lucky
320
A Blackstone real estate company exposed SSN digits, DOBs, addresses and more
Update: This post received some attention on Hacker News — see the discussion thread.
321
Rooting, firmware analysis and persistent credentials of TP-Link TL-841N
round 2: rooting & analysing firmware of the TP-Link TL-WR841N
322
Web-based cryptography is always snake oil
Nowadays, there is an epidemic of web applications purporting to offer “end-to-end” encryption. Examples might range from a file upload service, which allows you to upload and share files of arbitrary size and promises “end-to-end encryption”; or a web-based password safe service which claims that it can't see your…
323
Signing data structures the wrong way
Domain separation bugs have bitten Bitcoin, Ethereum, TLS, and AWS. Snowpack solves this by embedding random domain separators directly in the IDL.
324
Cloudflare's AI Psychosis
There was a time Cloudflare just made the internet better by staying hidden like Batman’s identity: protect & fight the bad people, for the sake of the global city of the Gotham… err I mean the in
325
Cert Authorities Check for DNSSEC from Today
From 15 March 2026, CAs must validate DNSSEC on CAA lookups and ACME checks. I've run DNSSEC for 14 years; see if your registrar supports it.
326
Sandboxing AI Agents in Linux
Like many developers, I find myself more and more using AI agents to help with software development. I currently use Claude Code, the co...
327
France's tax agency got hacked (in French)
Après l'ANTS, le piratage de la DGFiP marque un nouveau palier. Experts de l'État numérique, de la cybersécurité et du politique décryptent cet incident.
328
Securing Services with Rootless Containers
Some tips to improve security in applications deployed as containers.
329
My Reddit AMA on the Law of Web Scraping
On Friday, I did a Reddit AMA with the r/WebScrapingInsider subreddit about the law of web scraping. You can see the entire discussion here. I posted an introduction to the AMA, which I am sharing here: __ Hi everyone, and...
330
My adventure in designing API keys
Hello everyone, It has been quite a long time since my last blog, the last couple of months had been very busy and packed with a lot of work so I barely had much time to write blogs. Time runs so fast that the last time when I wrote a blog I was still a DevOps Engineer and now I am a Product Developer lol.