Topics /
The most popular blog posts about security & privacy on Hacker News. 279 posts.
The highly controversial indiscriminate child sexual abuse regulation (so-called chat control) could still be endorsed by EU governments after all, as France could give up its previous veto. This is reported by Euractiv and confirmed by internal documents. France considers the new "upload moderation
It's not often that you find yourself staring at code that few people have ever seen, code that was an important part in bringing down the a...
As a mediocre engineer, I took Internet and HTTPS communication for granted and never dove any deeper. Today we’re improving as engineers and learning a rough overview of how internet communication works, specifically focusing on HTTP and TLS.
Personal blog of Julien (jvoisin) Voisin
Imagine you create an empty, private AWS S3 bucket in a region of your preference. What will your AWS bill be the next morning?
Between March 2023 and May 2023, we identified multiple security vulnerabilities within points.com, the backend provider for a significant portion of airline and hotel rewards programs. These vulnerabilities would have enabled an attacker to access sensitive customer account information, including names, billing…
AT&T Corp. disclosed today that a new data breach has exposed phone call and text message records for roughly 110 million people — nearly all of its customers. AT&T said it delayed disclosing the incident in response to “national security and public safety concerns,” noting that some of the records included data that…
Memory-Dump-UEFI is a UEFI application for dumping the contents of RAM.
🇫🇷 French: Traduction du dossier Chat Control 2.0, stopchatcontrol.fr🇸🇪 Swedish: Chat Control 2.0🇩🇰 Danish: chatcontrol.dk🇳🇱 Dutch: Chatcontrole Table of contents: The End of the Privacy of Digital Correspondence and the End of Anonymous Communication Take action to stop Chat
Creating fake signed commits
I’m thrilled to report that the OpenID Connect specifications have now been published as ISO/IEC standards. They are:
Not long ago, the ability to digitally track someone’s daily movements just by knowing their home address, employer, or place of worship was considered a dangerous power that should remain only within the purview of nation states. But a new lawsuit in a likely constitutional battle over a New Jersey privacy law shows…
Conventionally, email addresses published on webpages may be protected from email-harvesting spambots via various HTML, CSS & JS-based techniques. This alternative technique is SVG-based.
Federal authorities have arrested and indicted a 20-year-old U.S. Army soldier on suspicion of being Kiberphant0m , a cybercriminal who has been selling and leaking sensitive customer call records stolen earlier this year from AT&T and Verizon . As first reported by KrebsOnSecurity last month, the accused is a…
Hacking the T2S+ v2 to work on computers, tear it down for the first time online, and play with lock-in thermography as a bonus!
Was the ssh backdoor the only goal that "Jia Tan" was pursuing with their multi-year operation against xz?
A Canadian man who says he’s been falsely charged with orchestrating a complex e-commerce scam is seeking to clear his name. His case appears to involve “triangulation fraud,” which occurs when a consumer purchases something online — from a seller on Amazon or eBay , for example — but the seller doesn’t actually own…
Copyleft trolls, robosigning, and Pixsy.
I am making steady progress towards moving the Computers Are Bad enterprise cloud to its new home, here in New Mexico. One of the steps in this process is, of course, purchasing a new server... the current Big Iron is getting rather old (probably about a decade!) and here in town I'll have the rack space for more…
tldr: Apple thinks it is fine. I do not. On December 28 2023, bugreport 12604 was filed in the curl issue tracker. We get a lot issues filed most days so this fact alone was hardly anything out of the ordinary. We read the reports, investigate, ask follow-up questions to see what we can learn … Continue reading the…
Designing a dictionary of visually unambiguous characters for IDs.
A few years ago, my cat gave me my most memorable middle of the night software engineering incident. I was working at a startup, and we didn’t have a formal on-call rotation yet. That was a deliberate decision, since being on-call is painful, and the team was good about just collectively keeping an eye out for urgent…
Wikipedia’s definition of a digital signature is: A digital signature is a mathematical scheme for verifying the authenticity of digital messages or documents. A valid digital signature on a messag…
Apple Pay is great, but I think there is some misunderstanding out there about the details of how it works.
Some timezone observations on the recently discovered backdoor hidden in an xz tarball.
On the one hand they are easy to explain, they are just numbers that have no factors other than one and themselves, but on the other hand they contain endless complexity. They show up in numerous places, ranging from mathematical concepts and conjectures to interesting looking visualizations and cryptography…
Bluenoroff or APT38, more commonly referred to as Lazarus Group is a threat group which has been tied to the North Korean government since as early as 2009 primarily being financially motivated utilizing malware custom built for each target.
There's lots of innovation going on in security - we're inundated with a steady stream of new stuff and it all sounds like it works just great. Every couple of months I'm invited to a new computer security conference, or I'm asked to write a foreword for a new computer security book. And, thanks to the fact that it's…
The other day I rode on a Class 800 train in the UK. This is the “Intercity Express” train designed to replace the venerable HST (Intercity 125 with Mark 3 coaches, a train of which I have many memories and which I will dearly miss).
