61
1-Click GitHub Token Stealing via a VSCode Bug
My blog, mostly about programming
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 356 posts.
62
OpenAI, the US government and Persona built an identity surveillance machine
53MB of source code leaked from a government endpoint. 269 verification checks. biometric face databases. SAR filings to FinCEN. and the same company that verifies your ChatGPT account.
63
Turn Dependabot off
I recommend turning Dependabot off and replacing it with a pair of scheduled GitHub Actions, one running govulncheck, and the other running CI against the latest version of your dependencies.
64
My security camera shipped a GitHub admin token in its login page
i dissected some firmware for a Hanwha Wisenet XNP-9300RW and found that it had github admin tokens in it, also miltech is weird
65
License plate reader searches should require a warrant
So while I work with police departments regularly, I think it is critically important that technology be used reasonably. While this may be off-putting to some of my clients, I worked with the Inst…
66
There isn't an easy exploit for this PHP vulnerability
Mass hysteria, or something.
67
Tl;dv: Over 180k meetings left wide open
How a missing Firestore security rule on tl;dv exposed 181,874 meetings from 84,312 users across 35,003 domains, including live calls I could join uninvited, and how six months of disclosure got me nothing but seen receipts.
68
Chrome again exempts Google from user site data settings
Six years ago I published a blog post Chrome exempts Google sites from user site data settings that received quite a bit of attention: Michael Tsai , Hacker News The Register , The Verge , and Gizmodo , among others. The blog post was about a Google Chrome bug that mysteriously exempted Google-owned sites from the…
69
My smart sleep mask broadcasts users' brainwaves to an open MQTT broker
I recently got a smart sleep mask from Kickstarter. I was not expecting to end up with the ability to read strangers' brainwaves and send them electric impul...
70
Mullvad exit IPs are surprisingly identifying
Update 5/29: Mullvad has begun rolling out a mitigation feature on their servers that scrambles exit IP positions, thereby fixing this issue. IPs are still deterministically selected based on the pubkey. Mullvad is one of the few VPN providers that offers multiple exit IPs for its servers. If two people connect to the…
71
Major European payment processor can't send email to Google Workspace users
Viva.com, one of Europe's largest payment processors, sends verification emails without a Message-ID header — a requirement of RFC 5322 since 2008. Google Workspace rejects them outright. Their support team's response to my detailed bug report: your account has a verified email, so there's no problem.
72
Unlocking any car from X brand in most of the world
I've always had a soft spot for this particular car brand. Our family has owned a few of them over the years, and they've served us incredibly well. In 2023, I bought a new four wheel drive/SUV from them, and it was the first time I had
73
Incident CVE-2026-LGTM
A series of unfortunate agents.
74
OpenAI’s accidental attack against Hugging Face is science fiction that happened
This story is wild. The short version: OpenAI were running a cybersecurity test against an unreleased model, with the model’s guardrail features turned off. Rather than solve the test, the …
75
Banned book library in a wi-fi smart light bulb
OverviewA long while back I had an idea to hack a WiFi smart light bulb to do something more useful to me. Actually, I had a few different ideas of things to do with them. One of these ideas was to mo…
76
Cybersecurity looks like proof of work now
AISI’s tests of Mythos suggest a new security economy: to harden a system you must spend more tokens finding exploits than attackers do.
77
Proton spam and the AI consent problem
The one where I get very annoyed with my email provider.
78
I refuse to accept a censored Internet. Join Me at FOSDEM 27
As one of the managers of the Digital Dissident Devroom , I invite you to be part of a conversation we cannot afford to ignore.
79
A cryptography engineer's perspective on quantum computing timelines
The risk that cryptographically-relevant quantum computers materialize within the next few years is now high enough to be dispositive, unfortunately.
80
Somebody used spoofed ADSB signals to raster the meme of JD Vance
This, if it is still visible: Via: Next up, age verification for ADSB?
81
What your Bluetooth devices reveal
Building Bluehood, a Bluetooth scanner that reveals what information we leak just by having Bluetooth enabled on our devices.
82
Omarchy: Any User Process Can Escalate to Root
A security issue in Omarchy’s default Docker configuration meant that essentially every program running in the user’s desktop session could escalate to root without a password, sudo, or a privilege prompt. If you use Omarchy, the most important takeaway is simple: update to 4.0.1. I reported this issue privately…
83
Apple is about to make Hide My Email useless
Yesterday, June 15, 2026, a small and unimportant announcement appeared in Apple developer news: New domain for Sign in with Apple and iCloud+ Hide My Email. Long story short: now both Sign in with Apple and Hide My Email aliases are going to be issued on the @private.icloud.com subdomain. This makes it much easier to…
84
85
86
Did Claude increase bugs in rsync?
In order to avoid accuastions of this "just being Claude defending Claude," "AI slop," "probably all hallucinations," etc., I've decided it's probably worth explaining a few key points about how this report was created:
87
Two-tier encryption in the UK
Alice and Bill have identical Apple devices. Only one gets Apple’s strongest iCloud protection.
88
OpenAI bots knew about the RubyGems caching vulnerability
Today Reuters and the Wall Street Journal both reported about rogue AI agents at OpenAI attacking RubyGems.org. https://www.rubyhack.ai/ has an amazing writeup, and you should read it. I just wanted to make a quick post about it because it’s wild. TL;DR: It seems like OpenAI Bots knew about the RubyGems caching…
89
You can't trust macOS Privacy and Security settings
How to gain access to the contents of privacy-protected folders even though Privacy & Security settings say that access is denied.
90
Claude Code reads AGENTS.md only when telemetry is on [fixed]
Claude Code 2.1.277 added AGENTS.md support, but the loader sits behind a remote feature flag. With telemetry or nonessential traffic turned off, a local AGENTS.md is skipped without a warning. This is what I measured and the one-line CLAUDE.md I use instead.