31
Things not available when someone blocks all cookies
The personal blog of Thomas Steiner
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 292 posts.
32
“Magic links” can end up in Bing search results, rendering them useless
I recently started verifying user email addresses during signup to prevent bots, mistyped emails, and also to ensure that addresses are…
33
Nintendo Switch prevents downgrades by irreparably blowing its own fuses (2020)
How the Nintendo Switch uses irreversible hardware fuses to prevent firmware downgrades.
34
Decrypting your own HTTPS traffic with Wireshark
Code level discussion of web scraping, gray hat automation, growth hacking and bounty hunting
35
36
Using HTTP Basic Auth in 2022
Field notes on shipping fast, privacy-first, evergreen web products.
37
Chat control: EU Commission presents mass surveillance plan on May 11
Next week on Wednesday (May 11), the EU Commission will present an EU draft law on mandatory chat control to the public for the first time. Similar to Apple's highly controversial "SpyPhone" plans, the Commission wants to oblige all providers of email, chat and messaging services to search for susp
38
Apple AirTags draining battery of devices close by
If you have AirTags in the vicinity of your iPad it drains its battery for no reason. The past months I’ve been wondering why my iPad Pro always needed to be recharged when I used to use it without charging for weeks. I’m not the only one…
39
40
SELinux is unmanageable; just turn it off if it gets in your way
I’ve been an SELinux complexity apologist for years. Lately, I’ve concluded that every implementation with difficult-to-configure policies is just unmanageable.
41
42
You don’t want to be on Cloudflare’s naughty list
My home IP ended up on Cloudflare’s naughty list for six days. Most websites and many apps loaded slowly, partially, or not at all. Just had to wait it out.
43
Activision’s faulty anti-cheat software
Activision’s blind faith in the infallibility of their RICOCHET anti-cheat software , combined with a buggy and unstable Call of Duty: Modern Warfare II release, has resulted in faulty, permanent, and unappealable player account bans that prevent users from starting even the single-player game. These bans leave…
44
Google has most of my email because it has all of yours (2014)
Republished by Slate. Translations available in French (Français), Spanish (Español), Chinese (中文) For almost 15 years, I have run my own email server which I use for all of my non-work corresponde…
45
46
Node.js packages don't deserve trust
Another week, another npm supply chain attack . Yikes! People on hacker news are wringing their hands about what should be done. The problem seems dire.
47
What’s in a PR statement: LastPass breach explained
The LastPass statement on their latest breach is full of omissions, half-truths and outright lies. I’m providing the necessary context for some of their claims.
48
SHA-3 Buffer Overflow
Update: This result appeared in the proceedings of CT-RSA 2023. A preprint is available.
49
50
The 0.5 MB of nothing in all Apple Music files (2020)
Six percentage of each music files you’ve bought from Apple Music (iTunes Store) contain, literally, nothing. Why is Apple padding their music with zero-bytes?
51
Retrieving your browsing history through a CAPTCHA
Web developer and cybersecurity researcher
52
Google removed my Yubikeys from a Google account 'just to be safe'
The world's worst security flow
53
IRS to ditch biometric requirement for online access
The Internal Revenue Service (IRS) said today it will be transitioning away from requiring biometric data from taxpayers who wish to access their records at the agency’s website. The reversal comes as privacy experts and lawmakers have been pushing the IRS and other federal agencies to find less intrusive methods for…
54
Reverse engineering yet another eBook format
In the distant past I was super into removing DRM from books and magazines (check out my posts on that topic: Removing Edge Magazine DRM , Removing Zinio DRM ). This interest eventually faded away, mostly because I just stopped using websites that wouldn’t allow me to download and own the products I paid for (kudos to…
55
Experian, you have some explaining to do
Twice in the past month KrebsOnSecurity has heard from readers who had their accounts at big-three credit bureau Experian hacked and updated with a new email address that wasn’t theirs. In both cases the readers used password managers to select strong, unique passwords for their Experian accounts. Research suggests…
56
57
58
Privacy vs. “I have nothing to hide” (2019)
A recent post received numerous comments asking why I was so concerned about privacy and asking what I have to hide. Here's my reply...
59
You don't need that CORS request
A low code optimization
60
Hacking the Apple Webcam (Again)
$100,500 Apple Bug Bounty for hacking the webcam via a Safari Universal Cross-Site Scripting (UXSS) bug. CVE-2021-30861, CVE-2021-30975