4051
Learning Bluetooth Hackery with BLE CTF
Do you want to get into tinkering and hacking Bluetooth LE devices? Up until now, doing so was very much a DIY process. You would h...
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,337 posts.
4052
The Irrevocable SSL Certificates of Cloudflare
moved this website 'worldofmatthew.com' away from CloudFlare back in August 2020.That should have been the end of the relation with CloudFlare for my website.
4053
Are we self-sovereign PKI yet?
Every end-to-end encrypted messenger ships a fingerprint UI. Almost nobody opens it. A note on what's actually missing.
4054
4055
4056
DuckDuckGo Searches Are Not Anonymous
DuckDuckGo didn't log IPs, but favicons loaded from Amazon S3 leaked every search term in the Referer header. It was fixed two days after I posted.
4057
4058
A Few Thoughts on Ray Ozzie’s “Clear” Proposal
Yesterday I happened upon a Wired piece by Steven Levy that covers Ray Ozzie’s proposal for “CLEAR”. I’m quoted at the end of the piece (saying nothing much), so I knew the piece was coming. …
4059
The security scanner that cried wolf
If you’ve ever been alarmed by how many security vulnerabilities your Docker image has, even after you’ve installed security updates, here’s what’s going on.
4060
4061
4062
Full EU chat control proposal attack on digital privacy and encryption
The French news service contexte.com has today published the latest Belgian Presidency's proposal for introducing indiscriminate chat control scanning of private messages for illegal content. The proposal covers the entire regulation and is therefore ready for endorsement. The proposal is to be disc
4063
Lizard Stresser Runs on Hacked Home Routers
The online attack service launched late last year by the same criminals who knocked Sony and Microsoft ’s gaming networks offline over the holidays is powered mostly by thousands of hacked home Internet routers, KrebsOnSecurity.com has discovered.
4064
4065
Securing your users' authentication
A few days ago, I saw an article about someone’s Playstation Network account getting stolen . The problem wasn’t so much that the account got stolen, as this apparently happens more often than not, but that Sony has created a system so convoluted that it’s possible for the thief to keep your account, without you…
4066
Using WolframAlpha to Hack Text CAPTCHA
I’ve been playing around with the Text CAPTCHA demo page and wondered how well WolframAlpha is at logic questions. As it turns out, Wolfram is pretty smart! Although, since a CAPTCHA requir…
4067
Court Documents Shed New Light on DOGE Activity at Treasury Department
New court documents shed light on what a 25-year-old DOGE worker named Marko Elez did inside Treasury Department payment systems, including what Treasury staff did to limit his access. The documents indicate that the situation is more nuanced than previously reported.
4068
UDP for games – encryption and DDoS protection
Quote: Yes, you DO need to encrypt your UDP traffic. And no, using UDP is NOT a valid excuse to skip encryption Another Quote: Personally, I prefer to think ...
4069
Android Security Auditing: Investigating Unauthorized Screenshots
About six months ago, I discovered something on my smartphone that horrified me: I went to undelete a file in DiskDigger, and I stumbled upon a plethora of unexpected jpegs: screenshots of my activity. Screenshots that I didn’t take. Screenshots of my conversations. Screenshots of my GPS position. And screenshots of…
4070
4071
1 Database Containing 35,000,000 Google Profiles. Implications?
UPDATE 2012-02-16: raver1975 released a SQL database w/35M Google Profiles as .torrent on The Pirate Bay. UPDATE 2011-06-10: Central question in the Google discussion is whether mass-aggregation of profile data…
4072
Malicious update/malware by a semi-advanced adversary
What do wedding venues and malware have in common? I got to spend my weekend investigating them. A short post about interesting malware, and lessons learned.
4073
Stealing checks worth millions and pwning a bank
Another long (hacker) story of mine! Once upon a time contracted to do a penetration test on a bank… I spent the better part of a week assessing every nook and cranny of the main web application. I mapped every function, and every web path, but the main website was very hardened. After spending a lot of time…
4074
Faking the TCP handshake
Update: This article has been superseded by a new post which hopefully explains it more clearly: Spoofing TCP connections without sequence number prediction
4075
NSA E-Mail Eavesdropping
More Snowden documents analyzed by the Guardian—two articles—discuss how the NSA collected e-mails and data on Internet activity of both Americans and foreigners. The program might have ended in 2011, or it might have continued under a different name. This is the program that resulted in that bizarre tale of Bush…
4076
Inside Arizona’s Pump Skimmer Scourge
Crooks who deploy skimming devices made to steal payment card details from fuel station pumps don’t just target filling stations at random: They tend to focus on those that neglect to deploy various tools designed to minimize such scams, including security cameras, non-standard pump locks and tamper-proof security…
4077
4078
Fun with your bank's secret questions & answers
My new bank, Ally Bank , configures a security question and answer for customer service calls. In addition to your SSN, date of birth, and mother's maiden name they also ask you the question you specify and wait for the answer you've provided. This is good, because many standard questions are…
4079
An NSFW filter for Marginalia search
… optional, that is. I’ve been working on an NSFW filter for Marginalia Search, as that is something some people have asked for, primarily API consumers. The search engine has had some domain based filtering for a while, based on the UT1 lists, but that isn’t a very comprehensive approach. We’ll land on a single…
4080
