31
I have recordings proving Coinbase knew about breach months before disclosure
I have recordings and emails showing attacks months before Coinbase's 'discovery'. Timeline, headers, and audio evidence.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 371 posts.
32
Unlocking free WiFi on British Airways
Personal website talking about some stuff I've made and technology
33
DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage
💡Update May 21, 2025: I've written a new detailed analysis of the heap dump dataset itself: TeleMessage customers include DC Police, Andreessen Horowitz, JP Morgan, and hundreds more Update May 26, 2025: I've published the source code for TeleMessage Explorer: a new open source research tool This morning,
34
I used o3 to find a remote zeroday in the Linux SMB implementation
In this post I’ll show you how I found a zeroday vulnerability in the Linux kernel using OpenAI’s o3 model. I found the vulnerability with nothing more complicated than the o3 API ̵…
35
Oracle attempt to hide cybersecurity incident from customers?
Being a provider of cloud SaaS (Software-as-a-service) solutions requires certain cybersecurity responsibilities — including being…
36
Two billion email addresses were exposed
I hate hyperbolic news headlines about data breaches, but for the "2 Billion Email Addresses" headline to be hyperbolic, it'd need to be exaggerated or overstated - and it isn't. It's rounded up from the more precise number of 1,957,476,021 unique email addresses, but other
37
Accessing Max Verstappen's passport and PII through FIA bugs
We found vulnerabilities in the FIA's Driver Categorisation platform, allowing us to access PII and password hashes of any racing driver with a categorisation rating.
38
“Super secure” messaging app leaks everyone's phone number
You can be, do, and have whatever you want, except for not spilling user information
39
Bruteforcing the phone number of any Google user
From rate limits to no limits: How IPv6's massive address space and a crafty botguard bypass left every Google user's phone number vulnerable
40
Amazon's AI crawler is making my Git server unstable
Please, just stop.
41
I got hacked: My Hetzner server started mining Monero
I got hacked, my server started mining Monero this morning.
42
"Localhost tracking" explained. It could cost Meta €32B
You just can't finish off Zuckerberg.
43
Chat Control proposal fails again after public opposition
The European Union’s controversial Chat Control proposal has been withdrawn once again following intense public pressure. This marks another defeat for legislation that would have mandated scanning of encrypted messages across the EU.
44
Moving away from US cloud services
Relying on US cloud services poses legal and political risks for EU users, so I'm moving away from US cloud services. Here's how and why I did it.
45
Snyk security researcher deploys malicious NPM packages targeting cursor.com
A security researcher at Snyk published 5 malicious software packages to the NPM registry. These packages appear to target Cursor.com
46
I hacked a dating app (and how not to treat a security researcher)
Update: This post received a large amount of attention on Hacker News — see the discussion thread.
47
Exploiting the IKKO Activebuds “AI powered” earbuds (2024)
So my journey with these earbuds started after I saw them on this Mrwhosetheboss video about pointless tech. This device seems to be also popular on TikTok. My suspicions were confirmed, this runs android. So of course i went ahead and bought them. 245 euros later... and they finally arrived!
48
Are Apple gift cards safe to redeem?
Link to: https://tidbits.com/2025/12/17/compromised-apple-gift-card-leads-to-apple-account-lockout/
49
Wanted to spy on my dog, ended up spying on TP-Link
I recently bought a cheap Tapo indoor camera to see what my dog gets up to when I am out of the house.
50
51
Why SSL was renamed to TLS in late 90s (2014)
The Netscape/Microsoft browser wars in the mid-90's were really vicious and competitive. They really had it out for each other. Netscape had...
52
Israel used Palantir technologies in pager attack in Lebanon
A New Book Quietly Reveals That Israel Used Palantir In It's Terrorist Attack On Lebanon.
53
Hacking Subaru: Tracking and controlling cars via the admin panel
On November 20, 2024, Shubham Shah and I discovered a security vulnerability in Subaru’s STARLINK admin panel that gave us unrestricted access to all vehicles and customer accounts in the United States, Canada, and Japan.
54
Reverse engineering Call of Duty anti-cheat
Interested in Anti-Cheat analysis? I highly recommend checking out Guided Hacking’s Anti-Cheat section. I’ve been reversing Black Ops Cold War for a while now, and I’ve finally decided to share my research regarding the user-mode anti-cheat inside the game. It’s not my intention to shame or promote cheating/bypassing…
55
One-Click RCE in Asus's Preinstalled Driver Software
One-Click RCE in ASUS’s Preinstalled Driver Software Part Two of the ASUS series is out, read it here. Introduction This story begins with a conversation about new PC parts. After ignoring the advice from my friend, I bought a new ASUS motherboard for my PC. I was a little concerned about having a BIOS that would by…
56
57
Investigating an “evil” RJ45 dongle
Reverse-engineering hardware can be difficult -- but sometimes, all you need is a comfy armchair and some Google Translate.
58
How a single line of code could brick your iPhone
Gui Rambo writes about his coding and reverse engineering adventures.
59
Right to root access
right to repair laws should include provisions requiring manufacturers to unlock a device's bootloader (to provide root access) upon consumer request.
60
15,000 lines of verified cryptography now in Python
In November 2022, I opened issue 99108 on Python’s GitHub repository, arguing that after a recent CVE in its implementation of SHA3, Python should embrace verified code for all of its hash-related infrastructure.