Topics /
The most popular blog posts about security & privacy on Hacker News. 4,335 posts.
A TCP reset attack is executed using a single packet of data, no more than a few bytes in size. A spoofed TCP segment, crafted and sent by an attacker, tricks two victims into abandoning a TCP connection, interrupting possibly vital communications between them.
imessage-exporter ’s goal is to provide the most comprehensive representation of iMessage data available. Message data is stored in a legacy format that appears to be a stream that represents objects.
Dmitry.GR: Wireless picture frames that run for years on batteries
Code level discussion of web scraping, gray hat automation, growth hacking and bounty hunting
Part 1: Finding the rootkit It's monday morning and I am for coffee in downtown Thessaloniki, a partner calls: - On machine XXX mysqld is not starting since Saturday. - Can I drink my coffee and come over later to check it ? Is it critical ? - Nope, come over anytime you can... Around
Remember Apple’s failed attempt to detect CSAM in images? Would that have been similar to the way that Visual Look Up works? Is this the thin end of the wedge?
blog about networking, cameras, old gear, and xmpp
Yesterday (Sept. 12) we scanned the entire Internet for port 22 -- the port reserved for "SSH", the protocol used by sysadmins to remotely l...
It’s sunday evening; there’s a lot to be said for being a stay-at-home-dad, and honestly I actually like having stuff like meal-prep and laundry to do, after 35+ years of “All Uni…
I’ve written a lot on the “War on Photography,” where normal people are harassed as potential terrorists for taking pictures of things in public. This article is different; it’s about recording the police: Allison’s predicament is an extreme example of a growing and disturbing trend. As citizens increase their…
Link to: http://blog.unroll.me/we-can-do-better/
After a long day of exhausting conversations about Hybrid Post-Quantum Cryptography, random jackasses trying to play gotcha with endpoint attacks against end-to-end encrypted messaging apps, and me…
Update: taking this down for now until some questions about the deterministicbuilds are answered; currently I do not believe the Zcash trusted setup shouldbe...
If you sell Web-based software for a living and ship code that references an unregistered domain name, you are asking for trouble. But when the same mistake is made by a Fortune 500 company, the results can range from costly to disastrous. Here’s the story of one such goof committed by Fiserv [ NASDAQ:FISV ], a $15…
Who wants free stuff? C’mon, everybody wants a free lunch, right? Yes, yes they do and that’s precisely the trigger used in scams like this one. Recently I wrote about the mechanics of another Facebook scam [https://www.troyhunt.com/2012/10/she-did-what-in-school-mechanics-
I was a remote opening keynote speaker at ACM SCORED 2023 , which we decided meant that I sent a video to play and I was on Discord during the talk for attendees to text directly with question as the video played, and then we did some live but still remote Q&A after the talk.
A common question I get about specs is how to model bad actors. Usually this is one of two contexts: The spec involves several interacting agents sharing a protocol, but some of the nodes are faulty or malicious: they will intentionally try to subvert the system. The spec involves an agent subject to outside forces…
I've been using Brave for a couple months now after using Firefox for around 25 years. I think Brave will be a permanent change.
How the connected car became an advertising surface. From Stellantis startup pop-ups to GSTV pumps to Gulp Radio aisles, and the consent infrastructure the automobile never developed.
If you’re a programmer, a systems administrator, or really any type of IT worker, you probably have your favorite go-to IP addresses for troubleshooting.
When they start using Docker, people often ask: “How do I get inside my containers?” and other people will tell them “Run an SSH server in your containers!” but that’s a very bad practice. We will see why it’s wrong, and what you should do instead.
This post is about a Man in the Middle (MitM) vulnerability in KeePass 2’s automatic update check. KeePass – the free and open source password manager – uses, in all versions up to the current 2.33, unencrypted HTTP requests to check for new software versions. An attacker can abuse this automatic update check – if…
Browsers have always been an arena for fighting and flaming over why your browser is the best and has the most features, while all others are inferior and un...
It has been a really long time since I last wrote something here as life happens, things get busier, etc etc. I am now trying to get back into writing things down and here we go! So, imagine a tool or a service that allows you to run some arbitrary code via a shell. Either through a ssh or more commonly, via a web…
