3991
Olympics 2012: A Bruce Schneier Moment
An east London estate, where 700 people live, has received leaflets saying a "Higher Velocity Missile system" could be placed on a water tower. ...
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,337 posts.
3992
The Plausibly Deniable DataBase (PDDB)
The problem with building a device that is good at keeping secrets is that it turns users into the weakest link.
3993
We Were Wrong About the GPLs
an unsurprising admission in Conservancy v. Vizio
3994
Doge to Fired CISA Staff: Email Us Your Personal Data
A message posted on Monday to the homepage of the U.S. Cybersecurity & Infrastructure Security Agency (CISA) is the latest exhibit in the Trump administration’s continued disregard for basic cybersecurity protections. The message instructed recently-fired CISA employees to get in touch so they can be rehired and then…
3995
Lesser known mobile adtech domains where data is sent
AppGoblin has now run over 40k apps in an emulator, tracking millions of API calls thousands of advertising domains. Unfortunately, some of them are dark, meaning they have no landing page of any kind, and I’m unclear who controls these domains.
3996
Spoofing Google Search Results
By adding two parameters to any Google Search URL, you can replace search results with a Knowledge Graph card of your choice. A malicious user can use this to generate false information or ‘fake news’.
3997
Zero-knowledge attestation
U2F/FIDO tokens (a.k.a. “Security Keys”) are a solid contender for doing something about the effectiveness of phishing and so I believe they're pretty important. I've written a fairly lengthy introduction to them previously and, as mentioned there, one concerning aspect of their design is that they permit attestation…
3998
Nice Security Mindset Example
A real-world one-way function: Alice and Bob procure the same edition of the white pages book for a particular town, say Cambridge. For each letter Alice wants to encrypt, she finds a person in the book whose last name starts with this letter and uses his/her phone number as the encryption of that letter. To decrypt…
3999
Practical Reverse Engineering Part 4 - Dumping the Flash
Fourth post in the series, detailing how to dump the router's flash chip directly with an SPI programmer, then split and decompress the resulting image into ...
4000
4001
Let's Clarify Some Misunderstandings Around Sign in with Apple
tl;dr This is a good move for users in the iOS ecosystem, and is primarily designed as an alternative for apps that currently use "Sign in with [Facebook/Twitter/Google]" to avoid leaking sensitive user info. Yes, Apple is entering the ...
4002
4003
Maybe we shouldn't skip SHA-3
David Wong writes about cryptography, security, and programming.
4004
Reassessing Airport Security
News that the Transportation Security Administration missed a whopping 95% of guns and bombs in recent airport security “red team” tests was justifiably shocking. It’s clear that we’re not getting value for the $7 billion we’re paying the TSA annually. But there’s another conclusion, inescapable and disturbing to…
4005
You don't need to burn off your fingertips (and other biometric myths)
111 years ago almost to the day, a murder was committed which ultimately led to the first criminal trial to use fingerprints as evidence [https://www.smithsonianmag.com/history/first-case-where-fingerprints-were-used-evidence-180970883/] . We've all since watched enough crime shows to understand that fingerprints are
4006
Trust-based moderation systems
master's thesis research into subjective, trust-based moderation systems
4007
Ten years isn't long enough for maximum age settings
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
4008
The Sad State of HTML Email Input Fields and IDNs
Chrome and Firefox disagree on IDN addresses in type=email inputs: punycode, validity and the value JavaScript sees. Feature detection is the workaround.
4009
4010
The NX bit is not just about security
While I’m taking a short break from low-level programming, here’s a story by a friend of mine, Sonya, about debugging a seemingly impossible bug in ARM code. This bug hunting saga started several months ago. While developing a bare-metal hypervisor on ARM64 for postmarketOS, I hit a strange bug: if I enabled the…
4011
Handling secrets (somewhat) securely in shells
Sometimes, you need to deal with secrets in an interactive shell. Say, for example, you want to do things with the API of a GitLab instance for which you require authentication:
4012
Why the NSA Dump Isn't from an Insider
Between Lies and Bad Analysis
4013
Hacking the Meta Ray-Ban smartglasses
Back in July I wanted to check out the pwn2own targets for 2026. Since the rules hadn’t been released yet, I decided I would check last year’s targets in the hope that it would be simil…
4014
4015
How to Create HTML/ZIP/PNG Polyglot Files
Learn How to Create HTML/ZIP/PNG Polyglot Files!
4016
Bad Smart Watch Authentication
IDO based smart watches are a security nightmare, and there's likely millions of them out there
4017
W^X policy violation affects Windows drivers compiled in VS 2013 and previous
Back in June, I was doing some analysis on a Windows driver and discovered that the INIT section had the read, write, and executable characteristics flags set. Windows executables (drivers included…
4018
4019
4020
Senator Feinstein Admits the NSA Taps the Internet Backbone
We know from the Snowden documents (and other sources) that the NSA taps the Internet backbone through secret agreements with major US telcos., but the US government still hasn’t admitted it. In late August, the Obama administration declassified a ruling from the Foreign Intelligence Surveillance Court. Footnote 3…