Topics /
The most popular blog posts about security & privacy on Hacker News. 300 posts.
Almost every year a joke RFC is made on April 1st (these have caught on so well, that it’s now common to see more than one of these every year), or April Fool’s Day, and some of them are pretty great. Here are some of my favourites:
Reverse engineering the kernel-mode authenticity check, and how Microsoft knows about your hacked/custom hard-drive.
risk visualize deez nuts
Exploiting a Video Camera's Rolling Shutter to Recover Secret Keys from Devices Using Video Footage of Their Power LED
It’s not often that a zero-day vulnerability causes a network security vendor to urge customers to physically remove and decommission an entire line of affected hardware — as opposed to just applying software updates. But experts say that is exactly what transpired this week with Barracuda Networks , as the company…
How an open redirect in Harvest’s Outlook Calendar integration leaked the OAuth tokens of connected Microsoft accounts, with a step-by-step proof of concept.
A look at the messy reality of iOS vulnerabilities: which bugs get patched, which quietly linger, and the challenges of tracking real device risk over time.
Research published yesterday by several European media outlets has revealed that an international campaign in support of the EU's proposed child sexual abuse regulation has been largely orchestrated and financed by a network of organisations with links to the tech industry and security services. The
Firefox version 115.0 was released on July 4, but I'm not celebrating. I'm concerned about a new "feature" in the release notes .
In the last 30 days, I have been closely monitoring the Mac App Store and have made a disturbing discovery. In the midst of the OpenAI…
Have you ever been told that the company’s data on laptops is protected thanks to BitLocker? Well it turns out that this depends on BitLocker’s configuration…
The first time it happened, I was writing a paper. The paragraphs I had just typed vanished into thin air, faster than Time Machine or Backblaze could save them. Gone. The next occurrence was during app development; Xcode suddenly flagged numerous errors in previously error-free code. My recent changes to several…
(If you just want some recommendations for what to do, skip down to the Recommendations section below .)
This is a write-up of the wInd3x bootrom exploit affecting iPod Nanos from 3rd gen to 5th gen. A ready-made tool to use this exploit is available at github.com/freemyipod/wInd3x .
In association with the release of curl 8.4.0, we publish a security advisory and all the details for CVE-2023-38545. This problem is the worst security problem found in curl in a long time. We set it to severity HIGH. While the advisory contains all the necessary details. I figured I would use a few additional ……
The bug lies in closed-source Google-proprietary code so it’s a bit hard to inspect, but after some patch-diffing I concluded that the root cause was due to this horrible bit of API ‘design’: https://issuetracker.google.com/issues/180526528 .
This is the chronicle of the most epic retaliation and how I pranked my roommate with targeted Facebook Ads to the point of complete paranoia and delusion.
Let's say you use a Google account as the root of your online identity: Gmail, Fi, "Sign in with Google", Google's password manager, etc. How much should you be worried that you'll suddenly find yourself unable to get into everything? Should you do something else instead? To get a sense of how common lockouts are and…
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
I am using C for a professional project. I believe in memory safety. Yes, I'm a hypocrite, but please, let me explain.
I wrote a follow-up to this guide, which you should probably consider along with this article.
Banking websites in South Korea can only be used with IPinside installed. This application collects lots of data about the user, and it makes that data accessible to each and every website. The protection is inadequate.
How we know you "have' the invention
In an open letter, seven secure messaging apps—including Signal and WhatsApp—point out that the UK’s Online Safety Bill could destroy end-to-end encryption: As currently drafted, the Bill could break end-to-end encryption,opening the door to routine, general and indiscriminate surveillance of personal messages of…
I'm organizing a boycott of Apple's Feedback Assistant , starting immediately, and I encourage all Apple developers to join me. Here's how I propose that each of us can effectively participate in the boycott and let Apple know that we're boycotting Feedback Assistant:
The Privacy Whisperer, by Luiza Jarovsky
