31
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 263 posts.
32
I got my money back from a scammer by contacting his mom on Facebook (2016)
Personal Blog of Christian Haschek
33
HP printers try to send data back to HP about your devices and what you print
Last week my in-laws politely but firmly asked me to set up their new HP printer. I protested that I’m completely clueless about that sort of thing, despite my tax-return-job-title of “software engineer”. Still remonstrating, I was gently bundled into their study with an instruction pamphlet, a cup of tea, a promise…
34
35
A better zip bomb
This article shows how to construct a non-recursive zip bomb that achieves a high compression ratio by overlapping files inside the zip container. "Non-recursive" means that it does not rely on a decompressor's recursively unpacking zip files nested within zip files: it expands fully after a single round of…
36
Vendors must start adding physical on/off switches to devices that can spy on us
Update (May 15, 2019): This post was linked and its author quoted as a source in this Fast Company article on the same subject. Where's my webcam's off switch? Have you ever noticed that your webcam doesn't have an "off" switch? I looked on Amazon, and I couldn't find any webcams for sale that
37
Elliptic Curve Cryptography Explained
Fang-Pen Lin's blog about programming
38
Bypassing GitHub's OAuth Flow with a Head Request
For the past few years, security research has been something I’ve done in my spare time. I know there are people that make a living off of bug bounty programs, but I’ve personally just spent a few hours here and there whenever I feel like it.
39
Superhuman embeds tracking pixels in user emails
Over the past 25 years, email has weaved itself into the daily fabric of life. Our inboxes contain everything from very personal letters, to work correspondence, to unsolicited inbound sales pitches. In many ways, they are an extension of our …
40
Google Chrome Keystone is modifying /var symlink on non SIP Macs causing k-panic
Reports that some AVID Users Macs would no longer boot. It now may be that a Google Chrome Keystone update modifies /var on NON SIP Protected Macs.
41
VPN – Very Precarious Narrative
A very long article about commercial VPNs, their marketing strategies, and the truth behind their privacy and security claims.
42
Google AdWords Exploit Seen in the Wild
See the ad for ebay at the top of the results? Not particularly interesting, right?…
43
44
Myequifax.com Bypasses Credit Freeze Pin
Most people who have frozen their credit files with Equifax have been issued a numeric Personal Identification Number (PIN) which is supposed to be required before a freeze can be lifted or thawed. Unfortunately, if you don’t already have an account at the credit bureau’s new myEquifax portal , it may be simple for…
45
773M Password ‘Megabreach’ Is Years Old
My inbox and Twitter messages positively lit up today with people forwarding stories from Wired and other publications about a supposedly new trove of nearly 773 million unique email addresses and 21 million unique passwords that were posted to a hacking forum. A story in The Guardian breathlessly dubbed it “the…
46
47
48
It's Way Too Easy to Get a .gov Domain Name
Many readers probably believe they can trust links and emails coming from U.S. federal government domain names, or else assume there are at least more stringent verification requirements involved in obtaining a .gov domain versus a commercial one ending in .com or .org. But a recent experience suggests this trust may…
49
I was seven words away from being spear-phished
Three weeks ago I received a very flattering email from the University of Cambridge, asking me to judge the Adam Smith Prize for Economics:
50
51
How to increase your chances of finding a hidden camera
Take note of the title of this blog. What you read below will give you some additional knowledge that may help you identify a hidden camera but it certainly won’t guarantee that. We got lucky…
52
An Almost-Secret Algorithm Researchers Used to Break Thousands of RSA Keys
RSA encryption allows for anyone to send me messages that only I can decode. To set this up, I select two large random primes $latex p$ and $latex q$ (each of which is hundreds of bits long), and r…
53
First American Financial Corp. Leaked Hundreds of Millions of Insurance Records
The Web site for Fortune 500 real estate title insurance giant First American Financial Corp. [ NYSE:FAF ] leaked hundreds of millions of documents related to mortgage deals going back to 2003, until notified this week by KrebsOnSecurity. The digitized records — including bank account numbers and statements, mortgage…
54
Remote code execution vulnerability in apt/apt-get
tl;dr I found a vulnerability in apt that allows a network man-in-the-middle (or a malicious package mirror) to execute arbitrary code as root on a machine i...
55
How a double-free bug in WhatsApp turns to remote code execution
In this blog post, I’m going to share about a double-free vulnerability that I discovered in WhatsApp for Android, and how I turned it into an RCE. I informed this to Facebook. Facebook acknowledged and patched it officially in WhatsApp version 2.19.244. Facebook reserved CVE-2019-11932 for this issue.
56
57
49% of workers, forced to change passwords, reuse same one with minor change
A new survey has revealed some alarming news about the way users are choosing their passwords in their homes and workplace.
58
#include </etc/shadow>
This blog is written by Hanno Böck. Unless noted otherwise, its content is licensed as CC0 .
59
MyPayrollHR CEO Arrested, Admits to $70M Fraud
Earlier this month, employees at more than 1,000 companies saw one or two paycheck’s worth of funds deducted from their bank accounts after the CEO of their cloud payroll provider absconded with $35 million in payroll and tax deposits from customers . On Monday, the CEO was arrested and allegedly confessed that the…
60
Looking Back at the Snowden Revelations
Edward Snowden recently released his memoirs. In some parts of the Internet, this has rekindled an ancient debate: namely, was it all worth it? Did Snowden’s leaks make us better off, or did …