961
The Microsoft MFA system almost brought me to a nervous breakdown
Update 12/10/21, 10:15 UTC: I never imagined this post would reach the front page on Hacker News and gather so much support. Thank you all…
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,333 posts.
962
Archive.today is directing a DDoS attack against my blog
Around January 11, 2026, archive.today (aka archive.is, archive.md, etc) started using its users as proxies to conduct a distributed denial of service (DDOS) attack against Gyrovague, my personal b…
963
Gitlab Blocked Iranians’ Access
Ahmad Haghighi’s personal page.
964
Notes by djb on using Fil-C
I'm impressed with the level of compatibility of the new memory-safe C/C++ compiler Fil-C (filcc, fil++). Many libraries and applications that I've tried work under Fil-C without changes, and the exceptions haven't been hard to get working.
965
Facebook Disabled My Account After I Criticized Them
Facebook unfriended me. Why? So far as I can tell, it’s because I’ve been using Facebook to advocate for decentralization of social media. And apparently th ...
966
Please Stop Attacking MIT's Network
Today, at around 2:30 PM EST, Scripts went down. For most MIT students, this means a few class websites are inaccessible, a few friends' b...
967
Breaking Free from DRM: Hacking My Air Purifier
I searched the web for a deal on a decent air purifier and the Xiaomi 4 Pro seemed to meet all my requirements. The filter size, scheduler and air volume ticked all the boxes. I set it up and thought nothing of it until last week my room was lit with the ‘ 0% remaining ’ replace filter warning. I had set my unit up to…
968
Humiliating IIS servers for fun and jail time
cybersecurity, tech, and personal annoyance log
969
Why Android SSL was downgraded from AES256-SHA to RC4-MD5 in late 2010
blog about networking, cameras, old gear, and xmpp
970
Large-Scale Online Deanonymization with LLMs
We measure the capabilities of LLMs to deanonymize users online.
971
How Skype fixes security vulnerabilities
In a nutshell — they don't. This post describes my fruitless effort to convince Microsoft employees that their service is vulnerable, and the humiliation one has to go through should one's account be blocked by a hacker. This is a story of ignorance, pain, and despair.
972
973
1.5 TB of Dark Net Market scrapes
Mirrors of ~89 Tor-Bitcoin darknet markets & forums 2011–2015, and related material.
974
975
The Ashley Madison Database Was Leaked
Many news sites and blogs are reporting that the data stolen last month from 37 million users of AshleyMadison.com — a site that facilitates cheating and extramarital affairs — has finally been posted online for the world to see. In the past 48 hours, several huge dumps of data claiming to be the actual AshleyMadison…
976
977
SSH vs. OpenVPN for Tunneling
Update 28.01.16 I found some sites referring to this post. Below are the common complaints I saw, and my replies:
978
We didn't encrypt your password, we hashed it
You've possibly just found out you're in a data breach. The organisation involved may have contacted you and advised your password was exposed but fortunately, they encrypted it. But you should change it anyway. Huh? Isn't the whole point of encryption that it protects data when exposed
979
980
981
Backdooring Rust crates for fun and profit
Supply chains attacks are all the rage these days, whether to deliver RATs, cryptocurrencies miners, or credential stealers. In Rust, packages are called crates and are (most of the time) hosted on a central repository: https://crates.io for better discoverability. We are going to study 8 techniques to achieve Remote…
982
We installed a single turnstile to feel secure
After the acquisition by a much larger company, security became a top priority. Our company occupied three tall buildings, each at least 13 stories high. Key card readers were installed next to every
983
984
Elsevier threatens others for linking to Sci-Hub but does so itself
Sci-Hub is a copyright-violating site that provides infringing access to scholarly publications that are behind paywalls. Its ethics are problematic but it’s...
985
986
987
Cookie Bomb or Let's Break the Internet
TL;DR I can craft a page "polluting" CDNs, blogging platforms and other major networks with my cookies. Your browser will keep sendin...
988
989
How to lose a fortune with one bad click
Adam Griffin is still in disbelief over how quickly he was robbed of nearly $500,000 in cryptocurrencies. A scammer called using a real Google phone number to warn his Gmail account was being hacked, sent email security alerts directly from google.com, and ultimately seized control over the account by convincing him…
990
Mass cellphone surveillance experiment in Spain
Spanish Statistics Institute will track all cellphones for eight days (2 min, link in Spanish, via) A few facts first: Carriers geotrack all users by default, using cell tower triangulation. They also store logs of your calls and sms, but that is