331
iMessage, explained
This blog post is going to be a cursory overview of the internals iMessage, as I’ve discovered during my work on pypush, an open source project that reimplements iMessage.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,333 posts.
332
Your compliance obligations under the UK’s Online Safety Bill
L ast month I wrote a post about the UK’s “world-leading” vision for age-gating the open web. It got a bit of attention . That post, sadly, encompassed only one aspect of your compliance obligations under the Online Safety Bill . In this post, I’m going to tell you about the rest.
333
Does Apple really log every app you run? A technical look
Apple’s launch of macOS Big Sur was almost immediately followed by server issues which prevented users from running third-party apps on their computers. While a workaround was soon found by people on Twitter, others raised some privacy concerns related to that issue.
334
Chrome again exempts Google from user site data settings
Six years ago I published a blog post Chrome exempts Google sites from user site data settings that received quite a bit of attention: Michael Tsai , Hacker News The Register , The Verge , and Gizmodo , among others. The blog post was about a Google Chrome bug that mysteriously exempted Google-owned sites from the…
335
Web fingerprinting is worse than I thought
Explore top no verification casino sites in Australia offering instant crypto withdrawals, huge pokies libraries, and safe anonymous gambling.
336
My smart sleep mask broadcasts users' brainwaves to an open MQTT broker
I recently got a smart sleep mask from Kickstarter. I was not expecting to end up with the ability to read strangers' brainwaves and send them electric impul...
337
OnionShare makes it easy to publish anonymous, uncensorable websites
I’m excited to announce that OnionShare 2.2 is released! You can download it from onionshare.org. When I first wrote OnionShare in 2014, it let you anonymously and securely send files to people. It worked like this: OnionShare zips up the files, starts a local web server on
338
Carnegie Mellon CS Professor challenges Sony by mirroring Geohot's PS3 hacks
Request for materials: I would like to receive tutorial information on: Sony PS3 access protection mechanisms, the Elliptical Curve Digital Signature Algorithm ( ECDSA ), the structure of the PS3 hypervisor, METLDR, signing tools, and any other topics necessary for a person reasonably skilled in computer science to be…
339
Brave, the false sensation of privacy
ebin.city is a short 4-character .city domain available for buy. Listed at $100 — secure it before someone else does.
340
341
Setting up a home VPN server with WireGuard
Motivation For a moderately security conscious geek like myself, there can be a number of reasons to want to set up a home VPN server: Accessing your home computer via screen sharing without exposing it to the Internet (and thereby to potential evil-doers). Accessing servers with IP white lists (common case for…
342
Sinkholed
On 26 Nov 2019 at 14:55 UTC, I logged into my server that hosts my website to perform a simple maintenance activity. Merely three minutes later, at 14:58 UTC, the domain name susam.in used to host this website was transferred to another registrant without any authorisation by me or without any notification sent to me…
343
Bruteforcing the phone number of any Google user
From rate limits to no limits: How IPv6's massive address space and a crafty botguard bypass left every Google user's phone number vulnerable
344
You can now ask Google to remove your phone number, email or address from search
Google said this week it is expanding the types of data people can ask to have removed from search results, to include personal contact information like your phone number, email address or physical address. The move comes just months after Google rolled out a new policy enabling people under the age of 18 (or a…
345
Open source firmware is important for security
Why open source firmware is important for security.
346
macOS has checked app signatures online for over 2 years
Why does it take 2 years to realise that macOS has been checking signing certificate validity online?
347
Instead of “auth”, we should say “permissions” and “login”
Most computer systems we interact with have an auth system of some kind. The problem is, that sentence is at best unclear and at worst nonsense. "Auth" can mean at least two things: authentication or authorization [1] . Which do we mean for an "auth system"? It's never perfectly clear and, unfortunately, we often mean…
348
Hidden Networks in TP-Link Routers
I was debugging my WiFi settings this week when I noticed something strange. WiFi Analyzer was showing two hidden networks coming from my router, one for each frequency: 2.4GHz and 5GHz. Networks which I haven't configured and didn't appear in my router's admin interface. WTF?
349
Mullvad exit IPs are surprisingly identifying
Update 5/29: Mullvad has begun rolling out a mitigation feature on their servers that scrambles exit IP positions, thereby fixing this issue. IPs are still deterministically selected based on the pubkey. Mullvad is one of the few VPN providers that offers multiple exit IPs for its servers. If two people connect to the…
350
Face ID, Touch ID, No ID, PINs and Pragmatic Security
I was wondering recently after poring through yet another data breach how many people actually use multi-step verification. I mean here we have a construct where even if the attacker has the victim's credentials, they're rendered useless once challenged for the authenticator code or SMS which is
351
CAN Injection: Keyless car theft
This is a detective story about how a car was stolen - and how it uncovered an epidemic of high-tech car theft. It begins with a tweet. In April 2022, my friend Ian Tabor tweeted that vandals had been at his car, pulling apart the headlight and unplugging the cables.
352
353
Major European payment processor can't send email to Google Workspace users
Viva.com, one of Europe's largest payment processors, sends verification emails without a Message-ID header — a requirement of RFC 5322 since 2008. Google Workspace rejects them outright. Their support team's response to my detailed bug report: your account has a verified email, so there's no problem.
354
Ubiquiti all but confirms breach response iniquity
Last year, I posted a series of articles about a purported “breach” at Ubiquiti. My sole source for that reporting was the person who has since been indicted by federal prosecutors for his alleged wrongdoing – which includes providing false information to the press.
355
Stupid security things
My mate Lars Klint shared this tweet the other day: > Your password is not unique. pic.twitter.com/ga4GwxtzrQ [https://t.co/ga4GwxtzrQ] — Lars Klint (@larsklint) April 16, 2017 [https://twitter.com/larsklint/status/853507749488975873] Naturally, I passed it on [https://twitter.com/troyhunt/status/853517036131041280]…
356
Unlocking any car from X brand in most of the world
I've always had a soft spot for this particular car brand. Our family has owned a few of them over the years, and they've served us incredibly well. In 2023, I bought a new four wheel drive/SUV from them, and it was the first time I had
357
Publishers Haven't Realized How Big a Deal GDPR Is
Baekdal is your premium site for media reports and trend analysis. Subscribe from €7.55/month
358
Amazon's AI crawler is making my Git server unstable
Please, just stop.
359
I got hacked: My Hetzner server started mining Monero
I got hacked, my server started mining Monero this morning.
360
The xz attack shell script
Andres Freund published the existence of the xz attack on 2024-03-29 to the public oss-security@openwall mailing list. The day before, he alerted Debian security and the (private) distros@openwall list. In his mail, he says that he dug into this after “observing a few odd symptoms around liblzma (part of the xz…