91
Why don’t we do email verification in reverse?
Just about everybody who has ever used a service on the web has experienced the following account creation follow:
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 292 posts.
92
How to Store an SSH Key on a Yubikey
Xe Iaso's personal website.
93
Your online identity is owned by your email provider (2019)
Your email provider owns your online identity by controlling your email address. You can’t port your email address to another provider as with phone numbers.
94
I hacked SONOS and YouTube the same day
Or how to play YouTube videos on you SONOS, easy and for free.
95
Gmail accepts forged YouTube emails
This morning I woke up to an official-looking email from YouTube in my inbox, addressed to an address that isn't mine.
96
Six charged in mass takedown of DDoS-for-hire sites
The U.S. Department of Justice (DOJ) today seized four-dozen domains that sold “booter” or “stresser” services — businesses that make it easy and cheap for even non-technical users to launch powerful Distributed Denial of Service (DDoS) attacks designed knock targets offline. The DOJ also charged six U.S. men with…
97
Hacking on a plane: Leaking data of millions and taking over any account
Hacking on a plane, by Midjourney AI
98
Systemd service sandboxing and security hardening (2020)
The systemd-analyze security command gives your systemd service units an automated security rating. This is a good starting point for security hardening.
99
Review of /e/ – Android-based alternative for mobile phones
A review of the /e/ OS Android-alternative operating system for mobile devices, as used on the Teracube 2e smartphone.
100
Windows OS, Services and Apps: Network Connection Target Hosts (2021)
This post lists the internet communication targets of the Microsoft Windows operating system, including its various services and UWP apps. This post is a part of my application network connection monitoring series, a group of articles that explain how to analyze the network traffic of any Windows or macOS app.
101
An ad plugin was stealing revenue for a year and I didn't even notice
Anyone can build their own amusement park here, or find one that's just right for them. A city of parks by Levan Kvirkvelia.
102
103
Password Requirements: Myths and Madness
Password requirements are weird. It seems impossible to set a new password in many websites. Why?
104
A pentester gets root - step by step example
DevOops is a retired machine on HackTheBox. This write-up is a walk through the methodology that leads to root shell.
105
Norton 360 Now Comes with a Cryptominer
Norton 360 , one of the most popular antivirus products on the market today, has installed a cryptocurrency mining program on its customers’ computers. Norton’s parent firm says the cloud-based service that activates the program and allows customers to profit from the scheme — in which the company keeps 15 percent of…
106
Chromium based browsers leak user local IP via WebRTC foundation attribute
This script uses a pregenerated foundation lookup table to find local IP address for ICE candidates that render local mDNS hostnames seen as xx-xxx-xxx-xx.local .
107
Wiretapping Google smart speakers
I was recently rewarded a total of $107,500 by Google for responsibly disclosing security issues in the Google Home smart speaker that allowed an attacker within wireless proximity to install a "backdoor" account on the device, enabling them to send commands to it remotely over the Internet, access its microphone…
108
Attacking an Ethereum L2 with Unbridled Optimism
On 2/2/2022, I reported a critical security issue to Optimism—an "L2 scaling solution" for Ethereum—that would allow an attacker to replicate money on any chain using their "OVM 2.0" fork of go-ethereum (which they call l2geth).
109
Hijacking Email with Cloudflare Email Routing
On Tuesday, December 7th 2021 I discovered a critical vulnerability in Cloudflare’s Email Routing service. This vulnerabilty enabled anyone to modify the routing configuration of any domain using the service. A bad actor could have overwritten the destination address to their own email address in order to read any…
110
How to hide your IP address
A field guide to VPNs, proxies, and traffic relaying
111
Browser in the Browser (BITB) Attack
Providing security research and red team techniques
112
Who keeps an eye on clipboard access?
If there is any feature that “universally” describes the usage of computers, it is the copy/paste pattern. We are used to it, practically all the common graphical user interfaces have support for it, and it magically works.
113
Senators Urge FTC to Probe ID.me over Selfie Data
Some of more tech-savvy Democrats in the U.S. Senate are asking the Federal Trade Commission (FTC) to investigate identity-proofing company ID.me for “deceptive statements” the company and its founder allegedly made over how they handle facial recognition data collected on behalf of the Internal Revenue Service …
114
AWS IAM Roles, a tale of unnecessary complexity
This is going to be a highly opinionated blog post. I think AWS is great and use it daily, but their implementation of IAM is unnecessarily complicated.
115
How can you be fooled by the U+202E trick? (2013)
Ethical Hacking, Malware Analysis, Disinfection Techniques, Information Security, Pentesting Techniques and all related with Computer Security.
116
Authorization in a Microservices World
Authorization? How hard can it be? I am pretty sure that others have already solved it. We are not the first ones doing microservices. It should be easy to integrate what's already out there.
117
Bitcoin's fungibility graveyard
Where the pipe-dream of Bitcoin’s real-world fungibility goes to die.
118
There is no “software supply chain”
In actual supply chains, money is changing hands. A server manufacturer is paying for PCB fabrication, who is paying their suppliers for raw materials and equipment, and so on until the whole thing eventually loops back on itself when a mining company needs to buy a server.
119
What we can deduce from a leaked PDF
Matthew Butterick
120
Banks are not repaying victims of Zelle scams
When U.S. consumers have their online bank accounts hijacked and plundered by hackers, U.S. financial institutions are legally obligated to reverse any unauthorized transactions as long as the victim reports the fraud in a timely manner. But new data released this week suggests that for some of the nation’s largest…