3901
How to earn money by hacking a “walking for money” app
Or how to reverse engineer React Native apps, and abuse API.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,337 posts.
3902
3903
Don’t Hash Secrets
Building secure systems is difficult. It would be nice if we had a bunch of well-designed crypto building blocks that we could assemble in all sorts of ways and be certain that they would, no matte…
3904
Mozilla shouldn't copy Chrome's permission prompt for extensions
As Mozilla’s Web Extensions project is getting closer towards being usable, quite a few people seem to expect some variant of Chrome’s permission prompt to be implemented in Firefox. So instead of just asking you whether you want to trust an add-on Firefox should list exactly what kind of permissions an add-on needs…
3905
3906
Yet Another "People Plug in Strange USB Sticks" Story
I’m really getting tired of stories like this: Computer disks and USB sticks were dropped in parking lots of government buildings and private contractors, and 60% of the people who picked them up plugged the devices into office computers. And if the drive or CD had an official logo on it, 90% were installed. Of course…
3907
I Built an Ld_preload Worm
Teenagers' hands are the devil's playthings.
3908
Keeping Passwords in Source Control
I learned a neat tip from my co-worker, Craig Silverstein ( more on Craig joining Khan Academy ), recently and I thought others might find it to be useful.
3909
3910
Authorize, don't authenticate
Hold on to your data by keeping it in your own database
3911
3912
Block web scanners with ipset and iptables
Anybody who runs an internet-facing webserver has seen their fair share of spammy scanners in the logs. It varies server to server, but some of mine get up to 15,000 scans per day. Almost all of these are harmless network mappers, but they still annoy me. Many are compromised hosts or belong to hackers & organized…
3913
3914
Rackspace passwords are visible to customer service
I just had a very disturbing conversation with a Rackspace Cloud CSR. It went something like this: CSR: Can I have your account user name a...
3915
3916
3917
Do Evil with ESP8266: Slow Down the WiFi
While hackers do good most of the time, we occasionally do evil and play a prank. The ESP8266, unlike JSON , allows me to do evil. Thus, I programmed the microcontroller for an evil purpose: slow down the WiFi.
3918
Inside PostHog: SSRF, ClickHouse SQL Escape and Default Postgres Creds to RCE
It was yet another day at the office. Our team was internally discussing moving to a different platform analytics solution. Our team was really leaning more towards Posthog. It’s one of the brilliant -I personally believe it’s the best- products on the market. And that’s where the story has begun… We have a somewhat…
3919
3920
“Stylish” is back, and you still shouldn't use it
2 days after I published ‘“Stylish” browser extension steals all your internet history’, Stylish was pulled from the Chrome and Firefox stores. The story echoed around parts of the internet for a few days, my name was misspelled on several right-wing British news websites, and I felt that I’d helped make the world a…
3921
PSA: Internet Archive "glitch" deletes years of user data and accounts
Recently at Internet Archive a “glitch” (their choice of word) deleted a great many accounts, including my account that had been at archive.org/details/@ging...
3922
Affiliates flock to scam gambling machine
Last month, KrebsOnSecurity tracked the sudden emergence of hundreds of polished online gaming and wagering websites that lure people with free credits and eventually abscond with any cryptocurrency funds deposited by players. We’ve since learned that these scam gambling sites have proliferated thanks to a new Russian…
3923
Design Patterns for Securing LLM Agents Against Prompt Injections
This new paper by 11 authors from organizations including IBM, Invariant Labs, ETH Zurich, Google and Microsoft is an excellent addition to the literature on prompt injection and LLM security. …
3924
Fingerprinting Firefox users with cached intermediate CA certificates
Fingerprinting Firefox users with cached intermediate CA certificates (#fiprinca) ...
3925
Faking Bluetooth LE
Dmitry.GR: Creating BTLE-compliant advertisement packets, so that iOS and android devices can see and parse them.
3926
Reverse-Engineering Claude Web's MicroVM: Uncovering Anthropic's Hidden Antspace
Full stack developer, open sourceror, serial entrepreneur.
3927
macOS code injection for fun and no profit (2024)
Fun little vacation project for fun and zero profit.
3928
Break a dozen secret keys, get a million more for free
[An in-depth blog post by Daniel J. Bernstein, crossposted between the ECRYPT blog and the cr.yp.to blog .]
3929
TLS Symmetric Crypto
At this time last year, the TLS world was mostly running on RC4-SHA and AES-CBC. The Lucky 13 attack against CBC in TLS had just been published and I had spent most of January writing patches for OpenSSL and NSS to implement constant-time CBC decoding. The RC4 biases paper is still a couple of week away, but it's…
3930