3481
Flattr now deletes your web browsing history within 3 months
Flattr improves customer privacy protections by automatically deleting collected data when its no longer needed for its core service.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,335 posts.
3482
Zero Day Vulnerability in many Wordpress Themes
Big News [April 24th, 2012]: I’ve launched Wordfence to permanently fix your WordPress site’s security issues. Read this now.
3483
Whois: Fragile, Unparseable, Obsolete
A rather unstructured look at one of the older and infuriatingly trivial internet protocols: WHOIS
3484
NVD Damage Continued
There is something about having your product installed in over twenty billion instances all over the world and even out of the globe. In my case it helps me remain focused on and committed to working on the security aspects of curl. Ideally, we will never have our heartbleed moment. Security is also a generally ……
3485
The lack of HTTPS at Amazon: identifying items purchased via information leakage
If you were to browse Amazon right now and someone was eavesdropping on your connection, they could tell exactly what you were looking at. They could even tell what you've bought.
3486
Visitor Tracking Without Cookies (or How To Abuse HTTP 301s)
A technique for abusing HTTP 301 redirects and random numbers to uniquely track users; even those who have cookies disabled in their web browsers.
3487
Zigfrid – A Passive RFID Fuzzer
Zigfrid is the end result of my RFID tinkering. Since I will most definitely forget most things described here in the (very) near future, I share this for those few who might find it interesting. P…
3488
3489
GitHub Copilot: Remote Code Execution via Prompt Injection (CVE-2025-53773)
This post is about an important, but also scary, prompt injection discovery that leads to full system compromise of the developer’s machine in GitHub …
3490
A shallow survey of formal methods for C code
Two interesting things in formally verified software happened recently. The big one was the release of SeL4 - a formally verified L4 microkernel. The second was much smaller, but closer to my usual scope: a paper which showed the correctness of sections of a couple of the assembly implementations of Curve25519.
3491
AEADs: getting better at symmetric cryptography
I gave a talk a couple of weeks ago at the Yahoo Unconference . The conference was at the end of a particually hard week for a bunch of reasons and I fear that the talk wasn't that great. (Afterwards I got home about 3pm and pretty much slept until the following morning.) This post is a, hopefully clearer…
3492
Anti-Cheat Expert: all your pixels are belong to us
a blog about exploring reverse engineering, hypervisor development and software programming.
3493
Why Isn’t Telegram End-to-End Encrypted by Default (2017)
telegra.ph/why-isnt-telegram-end-to-end-encrypted-by-default-08-142021127 points145 commentscited by 11 details
I've been getting this question more often this year. It's based on the wrong assumption that some other popular messaging apps such as WhatsApp are "end-to-end encrypted by default", while Telegram is not. This post is intended to disprove this myth that has been so carefully crafted by Facebook/WhatsApp marketing…
3494
The dark side of account bans
I recently lost my Facebook account for two months, and was significantly cut off from certain aspects of society during that time. This is the dark side of account bans.
3495
Unsolicited messages on Keybase
What is Keybase? Keybase ( keybase.io ) is a platform designed to help users send and receive encrypted communications as well as secu...
3496
3497
Stealing Facebook access_tokens using CSRF in device login flow
I enjoy breaking websites.
3498
3499
I'm giving up on HPKP
HTTP Public Key Pinning is a very powerful standard that allows a host to instruct a browser to only accept certain public keys when communicating with it for a given period of time. Whilst HPKP can offer a lot of protection, it can also cause a lot of harm too.
3500
“Why do you work in security instead of something more lasting?”
This post grew out of a friend on Facebook asking (I paraphrase) "why do you spend your time on security instead of using your brainpower f...
3501
Malware in the browser: how you might get hacked by a Chrome extension
A case study of a Chrome extension that turned out to be some nasty botnet malware.
3502
UEFI Secure Boot on the Raspberry Pi
UPDATE: this post unexpectedly ended up on Hacker News and I received a lot of comments. The two most important points being made are (1) that Secure Boot on the RPi as …
3503
Fighting cryptojacking and doing good things with content security policies
If you've landed on this page because you saw a strange message on a completely different website then followed a link to here, drop a note to the site owner and let them know what happened. If, on the other hand, you're on this page because you're
3504
The NSA is not made of magic (2014)
I am regularly asked what is the most surprising thing about the Snowden NSA documents. It’s this: the NSA is not made of magic. Its tools are no different from what we have in our world, it’s just better-funded. X-KEYSCORE is Bro plus memory. FOXACID is Metasploit with a budget. QUANTUM is AirPwn with a seriously…
3505
Where the term "Zero Day" comes from
After seeing a FOIA request earlier today that someone created asking for FBI training documents that teach staff how to understand/communicate using hacker leet-speak, I was reminded about something I’ve wanted to put in virtual ink for a while.
3506
Breaking the Zyzzyva encryption
The article here sums up pretty well the debacle that North American tournament Scrabble players have been faced with since the…
3507
Reverse Engineering the Comtech AHA363 PCIe Gzip Accelerator Board
All this work was done in November last year. I haven’t worked on it since, but others have shown interest in picking this up, so it’s about time this gets thrown out in the open.
3508
How 4chan hacked ReCAPTCHA to win the TIME 100 Poll
This morning Time.com published the final result for their annual TIME 100 Poll. Time reports that the new owner of the title ‘Worlds’s most influential person, is moot’. What T…
3509
Sinkholed: A DNS Horror Story (2019)
On 26 Nov 2019 at 14:55 UTC, I logged into my server that hosts my website to perform a simple maintenance activity. Merely three minutes later, at 14:58 UTC, the domain name susam.in used to host this website was transferred to another registrant without any authorisation by me or without any notification sent to me…
3510
