4021
‘Carbon Dating’ the Internet Archive with OpenTimestamps
tl;dr: You can now use our searchable database to download Bitcoin timestamps for items in the Internet Archive.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,337 posts.
4022
Ways to leak your data: apps’ circumvention of the Android permissions system
50 ways to leak your data: an exploration of apps’ circumvention of the Android permissions system Reardon et al., USENIX Security Symposium 2019 The problem is all inside your app, she said to me …
4023
Stark Industries Solutions: An Iron Hammer in the Cloud
Two weeks before Russia invaded Ukraine in February 2022, a large, mysterious new Internet hosting firm called Stark Industries Solutions materialized and quickly became the epicenter of massive distributed denial-of-service (DDoS) attacks on government and commercial targets in Ukraine and Europe. An investigation…
4024
Man Robbed of 16 Bitcoin Sues Young Thieves’ Parents
In 2018, Andrew Schober was digitally mugged for approximately $1 million worth of bitcoin. After several years of working with investigators, Schober says he’s confident he has located two young men in the United Kingdom responsible for using a clever piece of digital clipboard-stealing malware to siphon his crypto…
4025
De-Googling TOTP Authenticator Codes
I've been slowly removing Google apps from my life, and one of the last ones left is Authenticator. In this post I look at migrating codes out of Authenticator to a command-line OTP tool, and the steps involved.
4026
Security through obscurity is underrated (2020)
Some thoughts about cyber security, technology and life - https://utkusen.com/. Click to read Utku Sen’s Substack, a Substack publication with hundreds of subscribers.
4027
Domain hacks with unusual Unicode characters
Unicode contains a range of symbols which don't get much use. For example, there are separate symbols for TradeMark - ™, Service Mark - ℠, and Prescriptions - ℞. Nestling among the "Letterlike Symbols" are two curious entries. Both of these are single characters: Telephone symbol - ℡ Numero Sign - № What's interesting…
4028
4029
Breach at Sonic Drive-In May Have Impacted Millions of Credit, Debit Cards
Sonic Drive-In , a fast-food chain with nearly 3,600 locations across 45 U.S. states, has acknowledged a breach affecting an unknown number of store payment systems. The ongoing breach may have led to a fire sale on millions of stolen credit and debit card accounts that are now being peddled in shadowy underground…
4030
Law Enforcement Undermines Tor
Few weeks ago, the German political magazine Panorama and STRG_F reported that law enforcement agencies infiltrated the Tor network in order to expose criminals. The reporters had access to documents showing four successful deanonymizations. I was given the chance to review some documents. In this post, I am…
4031
JavaScript Obfuscation Techniques by Example
Code level discussion of web scraping, gray hat automation, growth hacking and bounty hunting
4032
Microsoft ‘Mortally Wounds’ SHA-1
Microsoft has announced that CAs in its root program may not issue certs signed using the SHA-1 algorithm, starting just over two years from now, and that Windows will start refusing to recognise such certs starting just over 3 years from now.
4033
I'm not a fan of Deno's security model (2024)
this has been bothering me for a while now, so I want to write down my thoughts so I can get it out of my head and move on. we’re gonna talk about how Deno approaches security, specifically with its permissions system, and why I think this approach is fundamentally insecure and misleading.
4034
Root a Mac in 10 seconds or less
Often times, physical access to a machine means game over. While people like to think that OSX is immune to most security threats, even Apple computers can be susceptible to physical attacks. Mac OSX is capable of booting into single user mode by holding a special key combination (Command-S). From this point, an…
4035
The Information Apocalypse (2018)
My friend Aviv was recently the subject of a popular Buzzfeed article about the possibility of an impending “information apocalypse”. tl;dr: Aviv extrapolates from the fake news crisis that started in 2016 to a world in which anyone can create AI-assisted misinformation campaigns indistinguishable from reality to the…
4036
4037
Pakistani firm shipped fentanyl analogs, scams to us
A Texas firm recently charged with conspiring to distribute synthetic opioids in the United States is at the center of a vast network of companies in the U.S. and Pakistan whose employees are accused of using online ads to scam westerners seeking help with trademarks, book writing, mobile app development and logo…
4038
Turning my ESP32 into a DNS sinkhole to fight doomscrolling
A fun project that I learned a lot from.
4039
Restic Cryptography
tl;dr: this is not an audit and I take no responsibility for your backups, but I had a quick look at the crypto and I think I’m going to use restic for my personal backups.
4040
Homeland Security Spying on Reddit Users
Leak show feds tracking anti-ICE Reddit users like "Budget-Chicken-2425"
4041
Authentication for Single Page Apps
Wow! This takes me back! Please check the date this post was authored, as it may no longer be relevant in a modern context.
4042
F-Secure Anti-Virus: Remote Code Execution via Solid RAR Unpacking
Blog about anti-virus software vulnerabilities.
4043
Narrative Jailbreaking for Fun and Profit
Posted on Monday 23 Dec 2024. 1,634 words, 1 link. By Matt Webb.
4044
Unravelling Konami's Arcade DRM
It’s well known that Konami doesn’t have complex protection on its arcade systems. Programmed World was a fan-made network replacement and update service for Konami arcade games with no support outside of Japan. Nothing of its scale and quality had been seen before, and nothing has been seen since, despite other…
4045
Deobfuscating World of Warships' Python Scripts
An in-depth analysis of how World of Warships obfuscates its game scripts and how to mostly deobfuscate them automatically.
4046
Remote code execution affecting most iOS/macOS apps
CVE-2017-2416 Remote code execution triggered by malformed GIF in ImageIO framework, affecting most iOS/macOS apps ImageIO Available for: iPhone 5 and later, iPad 4th generation and later, iPod tou…
4047
Seized Genesis Market data is now searchable in Have I Been Pwned
A quick summary first before the details: This week, the FBI in cooperation with international law enforcement partners took down a notorious marketplace trading in stolen identity data in an effort they've named "Operation Cookie Monster". They've provided millions of impacted email addresses and passwords to Have I
4048
Beyond public key encryption
One of the saddest and most fascinating things about applied cryptography is how little cryptography we actually use. This is not to say that cryptography isn’t widely used in industry —…
4049
4050
Cryptanalysis of Meow Hash
The creators of Meow hash made security claims; we break them all.