3391
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,335 posts.
3392
Abuse of Youtube's copyright infringement claim process for doxxing purposes
UPDATE: it appears that the pathetic cowards who perjured themselves filing these maliciously false copyright infringement claims have chick...
3393
Analysis and reverse-engineering of the original Starlink router
Honestly, I love the design of this thing. It reminds me of something from the good old sci-fi.
3394
Revisiting Apple Notes (6): The Protobuf
TL;DR : This post explains portions of two protobufs used by Apple, one for the Note format itself and another for embedded objects. More importantly, it explains how you can figure out the structure of protobufs.
3395
3396
3397
Feudal Security
It’s a feudal world out there. Some of us have pledged our allegiance to Google: We have Gmail accounts, we use Google Calendar and Google Docs, and we have Android phones. Others have pledged allegiance to Apple: We have Macintosh laptops, iPhones, and iPads; and we let iCloud automatically synchronize and back up…
3398
Progressive Web Apps (PWAs) Phishing
Providing security research and red team techniques
3399
3400
SendGrid appends a tracking pixel even when disabled
Commenting, venting, or ranting. Usually about entrepreneurship, tech, or self-reflection.
3401
The Insecurity of Secret IT Systems
We now know a lot about the security of the Rapiscan 522 B x-ray system used to scan carry-on baggage in airports worldwide. Billy Rios, director of threat intelligence at Qualys, got himself one and analyzed it. And he presented his results at the Kaspersky Security Analyst Summit this week. It’s worse than you might…
3402
Google Exploit – Steal Account Login Email Addresses
I found a bug that allowed me to find anyone with a Google+ account's login email address. This could be used to target specific people for spear phishing.
3403
Shellcode Injection
Injecting shellcode by overflowing the buffer - Demonstration
3404
How Dirty COW works from the Linux kernel’s perspective
Dirty COW (CVE-2016-5195) is one of the most publicised local privilege escalation vulnerabilities in 2016, courtesy to its catchy name, cute logo, potential damages, and the fact that it was discovered in the wild by a researcher Phil Oester, meaning it was already under active use at the time of discovery.
3405
3406
I don't trust Signal
I don't trust Signal because it pretends to be things which it provably isn't and forces use of their controlled the network. This means that if Signal wanted to, they could intercept messages. In this article I show receipts, that while each individual issue is not back-breaking: casts huge doubts to me on if i…
3407
TikTok: Logs, Logs, Logs
We are in 2020 and the US president is about to ban TikTok, a video-sharing social network mobile app, because “it poses a risk to US…
3408
3409
Android betrays tethering data
Software engineer, Free, Open Source Software Consultant, Innovator, Fedora & Debian Developer
3410
GDID Windows – Cut the tracker that follows you even under VPN
The GDID helped catch a hacker despite his VPN. I set up a VM to see if it can be neutralized: what works, what doesn't, and the scripts to stop it from ...
3411
Signs you're a dangerous terrorist: using Signal, moving zines
The unusually long sentences criminalize being an anti-fascist activist, reading the wrong zines, and using the wrong communication apps. They're incredibly dangerous.
3412
HTTPS adoption has reached the tipping point
That's it - I'm calling it - HTTPS adoption has now reached the moment of critical mass [https://en.wikipedia.org/wiki/The_Tipping_Point] where it's gathering enough momentum that it will very shortly become "the norm" rather than the exception it so frequently was in the past.
3413
Security Is a Useless Controls Problem
We're all a bunch of chimps in a cage
3414
Everyone is watching what you do online. How user tracking with cookies works
Have you ever wondered how after you visit a website you start seeing ads about that website everywhere. This post explains how user tracking enables it.
3415
Two U.S. men charged in 2022 hacking of DEA portal
Two U.S. men have been charged with hacking into a U.S. Drug Enforcement Agency (DEA) online portal that taps into 16 different federal law enforcement databases. Both are alleged to be part of a larger criminal organization that specializes in using fake emergency data requests from compromised police and government…
3416
I hacked Gumroad’s API and broke a bunch of tools
A critical security vulnerability in Gumroad's API allowed anyone to generate unauthorized license keys for paid products without making a purchase.
3417
Cyberpower crushes coup
Rewriting the rulebook on coups, time to add cyberpower
3418
3419
Further hardening glibc malloc() against single byte overflows
Introduction Back in 2014, while at Project Zero, I exploited a buffer overflow of a single NUL byte in glibc . Tavis Ormandy had found th...
3420