Topics /
The most popular blog posts about security & privacy on Hacker News. 4,333 posts.
This case involves Apple’s handling of user-uploaded files hosted in private iCloud storage. Instead of adopting PhotoDNA to scan hosted files for CSAM, Apple created its own proprietary alternative, NeuralHash, which apparently wasn’t as good. So Apple U-turned on its...
Self-hosted and privacy-respecting blog software that puts the domain, data, and reader relationship back in your hands. Private alternatives to Medium, vetted since 2015.
Imagine, just for a moment, that the Government wanted to keep a record of everyone's sexuality. They need to know this detailed demographic data because it will be highly useful in civic planning. It will help them work out what provision needs to be made for sexual health services, how many children are likely to be…
Romance fraud has been growing as an issue for years. It's not uncommon to see news stories with bewildered victims explaining just how deeply they'd been sucked in. After receiving a number of opener
A classically trained sysadmin shouting into the void.
Republished by Slate. Translations available in French (Français), Spanish (Español), Chinese (中文) For almost 15 years, I have run my own email server which I use for all of my non-work corresponde…
I reverse engineered the hardware and firmware of my Egret GT E-Scooter. I describe how I got in, analysed communication between components, and reverse engineered firmware. I speak about writing custom firmware for the display unit.
I found a stranger texting my 12-year-old on a 'kid-safe' Gabb phone. Parental controls are broken.
[UPDATE Since this was posted in 2024 : Major US telcos like AT&T, T-Mobile, and Verizon have suffered a months-long breach (the ongoing Salt Typhoon attack). These companies, of course, pass along the unencrypted SMSes vital to countless log in flows, account re-activations, and password resets. They are now known to…
Most people who have frozen their credit files with Equifax have been issued a numeric Personal Identification Number (PIN) which is supposed to be required before a freeze can be lifted or thawed. Unfortunately, if you don’t already have an account at the credit bureau’s new myEquifax portal , it may be simple for…
At last – we’ve done it! I’ve anticipated this day for ages – the day when the first commercially available mass market hardware device based our own secure operating system landed on my desk.
This article is archived on mirror.xyz , and attracted discussion on Hacker News Generated by this notebooklm Gene Spafford "Using encryption on the…
How to use and configure a Yubikey
My inbox and Twitter messages positively lit up today with people forwarding stories from Wired and other publications about a supposedly new trove of nearly 773 million unique email addresses and 21 million unique passwords that were posted to a hacking forum. A story in The Guardian breathlessly dubbed it “the…
Invisible but present, and far from the eyes of the public
On New Years’ Day, I woke up to 40 emails from Twilio, each with the subject line of, “Your Twilio account has been recharged.” In total…
wingolog: article: ffs ssl
This article is about how I found a vulnerability on Apple forgot password endpoint that allowed me to takeover an iCloud account. The vulnerability is completely patched by Apple security team and it no longer works. Apple Security Team rewarded me $18,000 USD as a part of their bounty program but I refused to…
The git bomb. Crafting compact repos that can't be cloned.
Announcing a $12,288 bounty (tripled to charity) for cracking the five seeds selected by the NSA in the '90s for the NIST elliptic curve standard.
It’s been a long time since my last blogpost, but I’m back with a post about how to use your Yubikey 4 for GPG and SSH keys.\n
Upgrade to faster and more secure SSH keys. I promise a smooth transition to the use of your new keys.
This is an interesting demonstration of the capabilities of afl ; I was actually pretty surprised that it worked! $ mkdir in_dir $ echo ' h...
