3781
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,337 posts.
3782
Securing Services with Rootless Containers
Some tips to improve security in applications deployed as containers.
3783
The dark side of big data
Everybody (1, 2, 3) is talking about big data and the chances that are not to be missed. So it would be fatal to miss this opportunity, for instance, by impo...
3784
Using Twitter to Build a Password Cracking List - 1978 passwords out of 4400
This is going to be a quick one. We're going to show how to use twitter to build a word list for cracking passwords. We'll use John the Rip...
3785
De-Anonymization via Clickjacking in 2019
This blog post is about my journey to understand the current practice of de-anonymization via the clickjacking technique whereby a malicious website is able to uncover the identity of a visitor, including his full name and possibly other personal information. I don’t present any new information here that isn’t already…
3786
3787
3788
How to design an elliptic-curve signature system
Earlier this month a new paper by Naomi Benger, Joop van de Pol, Nigel Smart, and Yuval Yarom hit the news . The paper explains how to recover secret keys from OpenSSL's implementation of ECDSA-secp256k1 using timing information from "as little as 200 signatures"; ECDSA-secp256k1 is the signature system used by…
3789
3790
Signal knows who you're talking to (2023)
Recently I got a friend to finally join me on Signal. He asked something about whether or not Signal is truly secure and private, like if it was safe from US government surveillance. I told him: “Well, it’s end-to-end encrypted, so they don’t know what we’re talking about, but they definitely know that we’re talking…
3791
What is the point of a public key fingerprint?
What is the point of a public key fingerprint? What does it do that the public key itself doesn't do. This post explains.
3792
3793
How secure is merely discarding (TRIMing) all of a SSD's blocks?
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
3794
Why Your Wi-Fi Router Doubles as an Apple AirTag
Apple and the satellite-based broadband service Starlink each recently took steps to address new research into the potential security and privacy implications of how their services geo-locate devices. Researchers from the University of Maryland say they relied on publicly available data from Apple to track the…
3795
Macs with T2, M1 chips cannot be restored to factory state without Apple
Modern Apple computers can no longer be fully used and maintained in 100% offline environments, or in ways that will reasonably ensure that the computer is…
3796
Firefox Local Files Theft – Not Patched Yet
Recently, I was performing a research on Same Origin Policy attacks, I managed to realize that the la version of Firefox (currently 67) is vulnerable to local files theft attack (on any supported OS), due to improper implementation of Same Origin Policy for file scheme URIs. Let’s go over the PoC details then I will…
3797
3798
Evolution Mail Users Easily Trackable
A dns-prefetch tag in an HTML email makes Evolution Mail do a DNS lookup on open, even with remote content blocked. The developers blame WebKitGTK.
3799
3800
Valid Signal privacy issues shrugged off while patches quietly rolled out
kelly kaoudis: application security, hacking, software engineering blog
3801
TIL: Some surprising code execution sources in bash
I ran across two surprising sources of code execution in bash (and probably other shells) recently.
3802
New prompt injection papers: Agents rule of two and the attacker moves second
Two interesting new papers regarding LLM security and prompt injection came to my attention this weekend. Agents Rule of Two: A Practical Approach to AI Agent Security The first is …
3803
Invisible Click Tracking Using “Empty” UTF-8 Characters
Have a look at this URL linking to this post: https://kaspars.net/blog/invisible-click-tracking Notice any tracking variables? Me neither! But check out the HTTP request and response in the network inspector of your browser -- it is redirecting to the "same" URL: URL encoded special characters in the browser console…
3804
Hacking Gmail’s UX with 'From' Fields – Another Phishing Vector
An Unexpected Consequence of a Bad Header
3805
64-Bit Linux Return-Oriented Programming
Update : Dongli Zhang reports that newer Linux versions organize the stack differently . The code below will need to be modified accordingly.
3806
Hacking Twitter's Javascript
New Twitter uses a massive amount of javascript (for a webapp). Nearly 1 Megabyte of minified, obfuscated javascript powers the site's frontend.
3807
3808
My Reddit AMA on the Law of Web Scraping
On Friday, I did a Reddit AMA with the r/WebScrapingInsider subreddit about the law of web scraping. You can see the entire discussion here. I posted an introduction to the AMA, which I am sharing here: __ Hi everyone, and...
3809
Android Bug Superior to Master Key
Assuming you enjoy this article, I encourage you to read the next one in the series: Yet Another Android Master Key Bug .
3810
