Topics /
The most popular blog posts about security & privacy on Hacker News. 312 posts.
[German]Brief information, which is already here with me since August 2021, but which I have not yet addressed in the blog. David Xanatos has pointed out to me that Microsoft is refusing to sign…
ssh-keygen can sign and verify signatures, and it's way better than PGP
ebin.city is a short 4-character .city domain available for buy. Listed at $100 — secure it before someone else does.
I was debugging my WiFi settings this week when I noticed something strange. WiFi Analyzer was showing two hidden networks coming from my router, one for each frequency: 2.4GHz and 5GHz. Networks which I haven't configured and didn't appear in my router's admin interface. WTF?
Last year, I posted a series of articles about a purported “breach” at Ubiquiti. My sole source for that reporting was the person who has since been indicted by federal prosecutors for his alleged wrongdoing – which includes providing false information to the press.
In a Twitter discussion last week on ransomware attacks, KrebsOnSecurity noted that virtually all ransomware strains have a built-in failsafe designed to cover the backsides of the malware purveyors: They simply will not install on a Microsoft Windows computer that already has one of many types of virtual keyboards…
As part of my MSc, I have to take an online exam. Obviously, this means I am highly likely to cheat by looking up things on Wikipedia or by having a bit of paper with notes on it. EVIL! So, the exam body requires me to install ProctorU. It's a service which lets someone watch you through your laptop camera while you…
Browse the comments on virtually any story about a ransomware attack and you will almost surely encounter the view that the victim organization could have avoided paying their extortionists if only they’d had proper data backups. But the ugly truth is there are many non-obvious reasons why victims end up paying even…
Google recently announced the rollout of their Federated Learning of Cohorts (FLoC), a new advertising-surveillance initiative that seeks to replace third-party cookies with a new user profiling technique that garners data generated by the browser itself.
Facebook and its sister properties Instagram and WhatsApp are suffering from ongoing, global outages. We don’t yet know why this happened, but the how is clear: Earlier this morning, something inside Facebook caused the company to revoke key digital records that tell computers and other Internet-enabled devices how to…
The headline is pretty self-explanatory so in the interest of time, let me just jump directly into the details of how this all works. There's been huge interest in this incident, and I've seen near-unprecedented traffic to Have I Been Pwned [https://twitter.com/troyhunt/status/
Financial services giant Intuit this week informed 1.4 million small businesses using its QuickBooks Online Payroll and Intuit Online Payroll products that their payroll information will be shared with big-three consumer credit bureau Equifax starting later this year unless customers opt out by the end of this month.
The other day, I was creating a new account on the web. It was financial in nature, which means it gets one of my most secure passwords. I used Password Safe to generate this 16-character alphanumeric password: :s^Twd.J;3hzg=Q~ Which was rejected by the site, because it didn’t meet its password security rules. It took…
The last thing we want is for an advertising network to access the Camera or Microphone on our computer. But, while looking for something else, I stumbled upon messages in the Safari JavaScript console saying that an iframe loaded from safeframe.googlesyndication.com tried to do exactly that.
Today, out of curiosity, I googled for php mysql email register . This returns tutorials, how-tos, code snippets. Most results include flawed DB statements. This usually means something like
There is more than enough written on the mechanics of and mitigations for the recent severe RCE in log4j . On prevention, this is the most interesting widely-reshared insight I have seen:
The landscape of security is changing quite a bit. We've gone from basic username and password to 2FA, facial recognition, fingerprint recognition, and so
This Christmas, a family member sent me a URL to a family Zoom call. However, they didn’t send me a direct link to Zoom. Instead, they sent me a
Virtually all compilers — programs that transform human-readable source code into computer-executable machine code — are vulnerable to an insidious attack in which an adversary can introduce targeted vulnerabilities into any software without being detected, new research released today warns. The vulnerability…
Get ready for the CCPA compliance scams from Princeton.
Wireless and firmware hacking, PhD life, Technology
