Topics /
The most popular blog posts about security & privacy on Hacker News. 4,333 posts.
Facebook and its sister properties Instagram and WhatsApp are suffering from ongoing, global outages. We don’t yet know why this happened, but the how is clear: Earlier this morning, something inside Facebook caused the company to revoke key digital records that tell computers and other Internet-enabled devices how to…
The Internet is a dangerous place in the best of times. Sometimes Internet engineers find ways to mitigate the worst of these threats, and sometimes they fail. Every now and then, however, a major …
Learn how to pair lock your iPhone to break law enforcement forensics tools and protect your data.
This is a blog post for my presentation at the conference POC2024. The slides are uploaded here.
by guest blogger Kieran McCarthy There are few, if any, legal domains where hypocrisy is as baked into the ecosystem as it is with web scraping. Some of the biggest companies on earth—including Meta and Microsoft—take aggressive, litigious approaches to...
Despite the fact that I use really long passwords and two-factor authentication wherever it's available I still worry that someone might b...
Relying on US cloud services poses legal and political risks for EU users, so I'm moving away from US cloud services. Here's how and why I did it.
In this blog post, I will talk about my successful experiment in machine learning using TensorFlow to automate solving the 4Chan CAPTCHA.
Here's how it normally plays out: It all begins when a company pops up online and makes some sort of ludicrous statement related to their security posture, often as part of a discussion on a public social media platform such as Twitter. Shortly thereafter, the masses descend on said
This article was discussed on Hacker News ( later ), on reddit ( also ), featured in BSD Now 294 . Also check out this Endlessh analysis .
Let’s talk about what we’re talking about. JWT stands for JSON Web Tokens, a reasonably well defined standard for authenticated tokens. Specifically they have a header with format information, a payload, and a signature or message authentication code. The core idea is that whoever has the corresponding verification…
The HTML capture attribute is interesting because it allows you to activate a user's camera with just HTML. This article covers it in more depth.
A number of financial institutions in and around New York City are dealing with a rash of super-thin “deep insert” skimming devices designed to fit inside the mouth of an ATM’s card acceptance slot. The card skimmers are paired with tiny pinhole cameras that are cleverly disguised as part of the cash machine. Here’s a…
Apple's Hide My Email feature is one of the most under-rated privacy launches of the past year, and here's why.
A 28-year-old Kansas man was shot and killed by police officers on the evening of Dec. 28 after someone fraudulently reported a hostage situation ongoing at his home. The false report was the latest in a dangerous hoax known as “ swatting ,” wherein the perpetrator falsely reports a dangerous situation at an address…
A security researcher at Snyk published 5 malicious software packages to the NPM registry. These packages appear to target Cursor.com
One of the more interesting things I've had the opportunity to hack on is the Tesla Model 3. It has a built in web browser, free premium LTE, and over-the-air software updates. It's a network connected computer on wheels that drives really fast.
Today, we deployed HTTPS by default on Stack Overflow. All traffic is now redirected to https:// and Google links will change over the next few weeks. The ac...
900 Sites, 125 million accounts, 1 vulnerability
In early 2016 I realized that it was possible to use zero-width characters, like zero-width non-joiner or other zero-width characters like the zero-width space to fingerprint text. Even with just a single type of zero-width character the presence or non-presence of the non-visible character is enough bits to…
Xerox scanners/photocopiers randomly alter numbers in scanned documents Please see the “condensed time line” section (the next one) for a time line of how the Xerox saga unfolded. It for example depicts that I did not push the thing to the public right away, but gave Xerox a lot of time before I did so. <iframe…
Update: This post received a large amount of attention on Hacker News — see the discussion thread.
Discover what 11,599 SSH login attempts reveal after running a honeypot for 30 days. Learn key cybersecurity insights—read now to protect your systems!
So my journey with these earbuds started after I saw them on this Mrwhosetheboss video about pointless tech. This device seems to be also popular on TikTok. My suspicions were confirmed, this runs android. So of course i went ahead and bought them. 245 euros later... and they finally arrived!
When building applications that display untrusted content, security designers have a major problem— if an attacker has full control of a block of pixels, he can make those pixels look like anything…
Request to Google : ungrey the “OEM unlocking” toggle in the factory, before shipping store.google.com devices to customers. Do not make your customers connect the device to the Internet before they are allowed to install the operating system they want.
The headline is pretty self-explanatory so in the interest of time, let me just jump directly into the details of how this all works. There's been huge interest in this incident, and I've seen near-unprecedented traffic to Have I Been Pwned [https://twitter.com/troyhunt/status/
