841
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,333 posts.
842
How Facebook Avoids Ad Blockers
How Facebook hides the word 'Sponsored' from ad blockers using per-character spans and DOM obfuscation, pulled apart piece by piece.
843
Little League wants all your information
To sign kids up for our city’s Little League baseball …
844
845
UK House of Lords attempting to ban use of VPNs by anyone under 16
This is deranged, each nation’s boomers and reactionaries attempting to outdo the others: “Action to prohibit the provision of VPN services to children in the United Kingdom” … th…
846
San Diego Implemented City-Wide Streetlight Surveillance
Civil Rights, Criminal Justice and Homeland Security
847
DRM Is Toxic to Culture
In pursuit of market control now, deployers of DRM are robbing us of our culture in perpetuity by enclosing the future commons. It’s possible that you think that unauthorised use of copyright…
848
On Password Managers
It has come to my attention that people are Wrong On The Internet about password managers. This matters, because almost everybody should be using one. Herewith background, opinions, and a description of my own setup, which is reasonably secure.
849
Don't run 'strings' on untrusted files
Many shell users, and certainly most of the people working in computer forensics or other fields of information security, have a habit of ru...
850
How to prevent email spoofing, using an unholy combination of silly standards
How to use SPF, DKIM, and DMARC to improve your domain's email security and limit spoofing - but written for humans.
851
How I bypassed 2-Factor-Authentication on Google, Facebook, Yahoo, LinkedIn
I remember fondly two years ago, when 2-Factor-Authentication (2FA) became popular and well used across major web applications (Google, Facebook, Yahoo and others). I found, my naive sixteen year old self unable to come to terms for why the genius idea had not been thought of before. At
852
Thunderstrike – Apple EFI firmware vulnerability
31C3 presentation on the Thunderstrike firmware vulnerability in MacBooks
853
Apple vs the Law
Apple & Google at the EU DMA compliance workshops, June 2025.
854
The IAB loves tracking users but hates users tracking them
The Interactive Advertising Bureau (IAB) is a standards development group for the advertising industry. Their members love tracking users. They want to know where you are, who you're with, what you're buying, and what you think. All so they can convince you to spend slightly more on toothpaste. Or change your…
855
856
Should you be concerned about LastPass uploading your passwords to its server?
The answer to this question is still "Yes!" Here I demonstrate yet another way for the server to access your data, the issues being structural.
857
858
Someone at BrowserStack is leaking users' email addresses
Like all good nerds, I generate a unique email address for every service I sign up to. This has several advantages - it allows me to see if a message is legitimately from a service, if a service is hacked the hackers can't go credential stuffing, and I instantly know who leaked my address. A few weeks ago I signed up…
859
How the Devteam Conquered the iPhone
The summer of 2007 was an eventful one if you were into cell phones. It all started on June 29 when Apple announced the release of the iPhone. If you have never taken the time to watch the full keynote, I highly recommend it.
860
My NAS exposes itself over the internet without permission
The Terramaster NAS decided to expose itself to the public internet without asking. Let's see what we can do about it.
861
862
I may be the only evil (bit) user on the internet (2015)
Almost every year a joke RFC is made on April 1st (these have caught on so well, that it’s now common to see more than one of these every year), or April Fool’s Day, and some of them are pretty great. Here are some of my favourites:
863
864
Sealed U.S. Court Records Exposed in SolarWinds Breach
The ongoing breach affecting thousands of organizations that relied on backdoored products by network software firm SolarWinds may have jeopardized the privacy of countless sealed court documents on file with the U.S. federal court system, according to a memo released Wednesday by the Administrative Office (AO) of the…
865
866
How to win at CORS
The 'how' and 'why' of CORS, from start to finish.
867
Reverse engineering yet another eBook format
In the distant past I was super into removing DRM from books and magazines (check out my posts on that topic: Removing Edge Magazine DRM , Removing Zinio DRM ). This interest eventually faded away, mostly because I just stopped using websites that wouldn’t allow me to download and own the products I paid for (kudos to…
868
Ubiquiti developer charged with extortion, causing 2020 “breach”
Last year, I posted a series of articles about a purported “breach” at Ubiquiti. My sole source for that reporting was the person who has since been indicted by federal prosecutors for his alleged wrongdoing – which includes providing false information to the press.
869
What Happened to HackerOne?
The rise and fall of the largest bug bounty platform in the world
870
Why the Sony hack is unlikely to be the work of North Korea
Everyone seems to be eager to pin the blame for the Sony hack on North Korea. However, I think it’s unlikely. Here’s why:1. The broken English looks deliberately bad and doesn’t e…