Topics /
The most popular blog posts about security & privacy on Hacker News. 4,337 posts.
Digital comics publisher JManga is collapsing . Two weeks from now you will no longer be able to "purchase" anything from them. Two months from now, anything that was "purchased" from them will cease to exist. If you spent hundreds of pounds in their store then, well, that's bad luck for you. This…
Back in March, Rolf Weber wrote about a potential vulnerability in the WhatsApp protocol that would allow Facebook to defeat perfect forward secrecy by forcibly change users’ keys, allowing it—or more likely, the government—to eavesdrop on encrypted messages. It seems that this vulnerability is real: WhatsApp has the…
WhatsApp is not private or secure. Please consider using Signal instead.
Use share buttons for Facebook, Twitter and Google Plus in your blog, that does not expose your users to tracking, or violate their privacy. Use share links to do this
After more revelations, and expert analysis, we still aren't precisely sure what crypto the NSA can break. But everyone seems to agree that...
This post is a textual version of a talk I gave at The 35th Chaos Computer Congress at the end of 2018. You can watch the talk that was recorded by the wonderful C3VOC team below if that’s your preferred medium:
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
TL;DR: is your refrigerator running malware? If so, you better catch it!
This is an introductory article about shell injection, a security vulnerability allowing an attacker to execute arbitrary code on the user's machine. This is a well-studied problem, and there are simple and efficient solutions to it. It's relatively easy to design library API in such a way as to shield the application…
tl;dr I have received a nice “your server is sending spam” email on a Saturday morning, this is what happened next. As a foreword, this server is not holding critical information and his mostly used to host static content and maintain former projects. Basically this is what happens when you leave upgrade undone on…
derailed by dangling pointers
Short-lived political campaigns rarely build formal security programs and often assume they're too small to attract serious attackers, but campaigns across the United States have been targeted by document theft and credential phishing. Six observed attacker tactics map to a short list of defensive priorities, starting…
NOTE: This article is old, this hack is no longer necessary, as Debian includes dehydrated that makes all the work. Free SSL certificates for everyone! the https://letsencrypt.org/ initiative backed by Akamai, Cisco, Mozilla and EFF, is going to offer free certificates. On this post I am going to explain how I have…
What are Linux keyring, gnome-keyring, Secret Service, and D-Bus - a brief overview and usage examples
In my last post I covered the basics of kernel debugging in macOS. In this post we will put some of that to use and work through the process of reversing a macOS kernel module. As I said in my last post, in macOS there is a kernel module named “Don’t Steal Mac OS X” (DSMOS) which registers a function with the Mach-O…
Exploring blockchain, math, and smart contracts through a security lens.
A few days ago, someone called PixelMelt published a way for Amazon's customers to download their purchased books without DRM. Well… sort of. In their post "How I Reversed Amazon's Kindle Web Obfuscation Because Their App Sucked" they describe the process of spoofing a web browser, downloading a bunch of JSON files…
A few mongth ago, Google released a new product - Hangouts Chat application, which is surely an answer to Slack . Hangouts Chat might be us...
N ow I a fourfold vision see A nd a fourfold vision is given to me T is fourfold in my supreme delight A nd three fold in soft Beulahs night A nd twofold Always. May God us keep F rom Single vision & Newtons sleep. — W illiam B lake
This is an opinionated, “quick-start” guide to using passkeys as a web developer. It’s hopefully broadly applicable, but one size will never fit all authentication needs and this guide ignores everything that’s optional. So take it as a worked example, but not as gospel.
Every iPhone, iPad and iPod touch has an associated Unique Device Identifier (UDID). You can think of the UDID as a serial number burned into the device - one that can't be removed or changed 1 . This number is exposed to app developers through an API, without requiring the device owner's permission or knowledge.
A while ago I took up the challenge to get Offensive Security Web Expert (OSWE) certified. During this journey I learned many awesome things. The most important lesson learned was that with source code and a debugger, I could find vulnerabilities exponentially faster than by using traditional Blackbox/Bug-Bounty…
Internet home of Raimondas Sasnauskas. Stories of my journey.
My favorite music player is Audacious . It follows the Winamp Classic tradition of not trying to manage my music library. Instead it waits patiently for me to throw files and directories at it. These selections will be informally grouped into transient, disposable playlists of whatever I fancy that day.
