61
Apple's git still trusts the compromised eMudhra certificates
Eleven days after Apple was notified of the eMudhra CA compromise, the git, curl and python3 that Apple ships with macOS still trust the compromised certificates.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,332 posts.
62
Block YouTube ads on AppleTV by decrypting and stripping ads from Profobuf
Apple TV and iOS YouTube ads are not blocked by Pi-hole, so I researched this and discovered a flaw in Protobuf that allows me to restrict YouTube ads.
63
Everyone knows all the apps on your phone
Until a few years ago, any app you installed on an Android device could see all other apps on your phone without your permission.
64
GrapheneOS – Break Free from Google and Apple
🇬🇧->🇵🇱 Przejdź do polskiej wersji tego wpisu / Go to polish version of this post
65
How to gain code execution on hundreds of millions of people and popular apps
how to gain code execution on millions of people and hundreds of popular apps
66
The 'papers, please' era of the internet will decimate your privacy
Americans, be warned: Age verification is identity verification.
67
Passkeys are a trap
Intended audience: non-technical citizens of the web
68
Stripe records user movements on its customers' websites
An investigation into how Stripe tracks your users and what you can do to prevent it
69
70
ChatControl: EU wants to scan all private messages, even in encrypted apps
The EU is pushing legislation that would scan all our private messages, even in encrypted apps.
71
Reddit's website uses DRM for fingerprinting
But hey, at least Reddit gets less ad fraud!
72
Jailbreaking RabbitOS
Critics unanimously agree that it sucks , and some have accused the company of deliberate deception . Rabbit Inc. reportedly accepts returns, but customers are so eager to get rid of their R1s that even new-in-box units are selling for well below RRP ($200) on secondary markets.
73
74
I pwned half of America's fast food chains simultaneously
How I pwned half of America’s fast food chains, simultaneously. Also checkout Eva’s blogpost of this event. With an upbeat pling my console alerted me that my script had finished running, to be precise it was searching for exposed Firebase credentials on any of the hundreds of recent AI startups. This was achieved…
75
I use zip bombs to protect my server
The majority of the traffic on the web is from bots. For the most part, these bots are used to discover new content. These are RSS Feed readers, search engines crawling your content, or nowadays AI bo
76
Zero-day in Sign in with Apple
What if I say, your Email ID is all I need to takeover your account on your favorite website or an app. Sounds scary, right? This is what a…
77
Timeline of the xz open source attack
Over a period of over two years, an attacker using the name “Jia Tan” worked as a diligent, effective contributor to the xz compression library, eventually being granted commit access and maintainership. Using that access, they installed a very subtle, carefully hidden backdoor into liblzma, a part of xz that also…
78
AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint
Recently I ran into a strange problem with my Bluetooth headphones. They support multipoint Bluetooth audio, so they can be connected to my ...
79
That Secret Service SIM farm story is bogus
It's just normal crime
80
81
Hijack of Amazon’s domain service used to reroute web traffic for two hours
Between 11am until 1pm UTC today, DNS traffic — the phone book of the internet, routing you to your favourite websites — was hijacked by an…
82
83
The inception bar: a new phishing method
A new phishing technique that displays a fake URL bar in Chrome for mobile. A key innovation is the "scroll jail" that traps the user in a fake browser.
84
Bypassing Google's big anti-adblock update
Hello, I'm Derin!
85
86
30k U.S. organizations newly hacked via holes in Microsoft Exchange Server
At least 30,000 organizations across the United States — including a significant number of small businesses, towns, cities and local governments — have over the past few days been hacked by an unusually aggressive Chinese cyber espionage unit that’s focused on stealing email from victim organizations, multiple sources…
87
How Dropbox Hacks Your Mac
Update: Dropbox hack blocked by Apple in Sierra Following my post revealing Dropbox’s Dirty Little Security Hack a few weeks ago, I thought I’d look deeper into how Dropbox was getti…
88
How to own an airline in 3 easy steps and grab the TSA nofly list along the way
and grab the TSA nofly list along the way
89
The dots do matter: how to scam a Gmail user
Gmail's "dots don't matter" feature lets scammers create an account on, say, Netflix, with your email address but different dots. Results in convincing phishing emails.
90
Age verification is just a precursor to automated attribution of speech
Lots of US states, European countries, and Australia have introduced "age verification" regulations. They present it as the classic "save the children" talking ...