1201
Hacking a Smart Home Device (2024)
How I reverse engineered an ESP32-based smart home device to gain remote control access and integrate it with Home Assistant.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,333 posts.
1202
Everyone knows your location, Part 2: try it yourself and share the results
Learn how to record and analyse your mobile device traffic, take an app from the list of "shady" apps and share the results.
1203
Problems with the TSA
Coverage: Hacker News , Slashdot , BoingBoing , RT America News , Tumblr , RightThisMinute , RTM update , PapersPlease 2014 & 2015
1204
1205
Hackers stole access tokens from Okta's support unit
Okta , a company that provides identity tools like multi-factor authentication and single sign-on to thousands of businesses, has suffered a security breach involving a compromise of its customer support unit, KrebsOnSecurity has learned. Okta says the incident affected a “very small number” of customers, however it…
1206
IPv6 is not insecure because it lacks a NAT
This post is intended to dispell the mistaken belief that IPv4 is more secure than IPv6 because it includes a NAT which must be configured to allow inbound traffic.
1207
EU: Users who refuse scanning to be prevented from sharing photos and links
The highly controversial indiscriminate child sexual abuse regulation (so-called chat control) could still be endorsed by EU governments after all, as France could give up its previous veto. This is reported by Euractiv and confirmed by internal documents. France considers the new "upload moderation
1208
NSA and IETF, part 3: Dodging the issues at hand
Normal practice in deploying post-quantum cryptography is to deploy ECC+PQ. IETF's TLS working group is standardizing ECC+PQ. But IETF management is also non-consensually ramming a particular NSA-driven document through the IETF process, a "non-hybrid" document that adds just PQ as another TLS option.
1209
1210
A Surveillance Treaty in Disguise: Canada Signs UN Cybercrime Convention
Last week, the government announced that Canada has signed the United Nations Convention against Cybercrime, with Ministers Anita Anand, Gary Anandasangaree and Sean Fraser touting the treaty’s child protection provisions and human rights safeguards, which were described as “among the strongest found in an…
1211
Samsung disabling Windows Update?
Last updated 6/26/2015 - 4:49 PM EST. -- Windows Update will be abbreviated as "WU" in text from myself. First of all, I had this incl...
1212
Cracking an old ZIP file to help open source the ANC's "Vula" secret crypto code
It's not often that you find yourself staring at code that few people have ever seen, code that was an important part in bringing down the a...
1213
I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID
How I found that anyone could register on FIFA's public Agent Platform, gain access to the Football Data Platform's Streaming Management panel, and get RTMP ingest URLs and stream keys for every live FIFA World Cup 2026 camera feed. I then spent hours calling FIFA, MediaKind, HBS, CISA, and the FBI trying to get…
1214
Uninstall Nano Defender
Straight talk on Canadian online privacy, open-source software, PIPEDA, browser extension security, and practical tools to protect your personal data.
1215
A very valuable vulnerability
The vulnerability — which has since been fixed, or else I would not be writing about it publicly — was in Stripe's bitcoin payment functionality . Some background for readers not familiar with this: Stripe provides payment processing services, originally for credit cards but now also supporting ACH, Apple Pay, Alipay…
1216
IRS Will Soon Require Selfies for Online Access
If you created an online account to manage your tax records with the U.S. Internal Revenue Service (IRS), those login credentials will cease to work later this year. The agency says that by the summer of 2022, the only way to log in to irs.gov will be through ID.me , an online identity verification service that…
1217
The joys of owning an ‘OG’ email account
When you own a short email address at a popular email provider, you are bound to get gobs of spam, and more than a few alerts about random people trying to seize control over the account. If your account name is short and desirable enough, this kind of activity can make the account less reliable for day-to-day…
1218
I caught Google Gemini using my data and then covering it up
I asked Google Gemini a pretty basic developer question. The answer was unremarkable, apart from it mentioning in conclusion that it knows I previously used ...
1219
Mediocre Engineer's Guide to HTTPS
As a mediocre engineer, I took Internet and HTTPS communication for granted and never dove any deeper. Today we’re improving as engineers and learning a rough overview of how internet communication works, specifically focusing on HTTP and TLS.
1220
IP blocking the UK is not enough to comply with the Online Safety Act
A follow up to The Ofcom Files. Some notes on Ofcom’s strategy to date. As many of you know, I represent the U.S. website 4chan, pro bono, in its U.S. federal lawsuit against the UK…
1221
“Invalid Username or Password”: a useless security measure (2014)
Login attempts fail because computer users can't remember their email or didn't input the right password. Most websites on the Internet won't tell you which one is actually incorrect.
1222
Modern Alternatives to PGP
Did your last Yubikey just break? Perhaps you forgot an offline backup password. Maybe you’re just tired of living like a spy and never using smartphones. Whatever it is, you’re here, and you’re finally ready to give up on PGP. That’s great! We’re here to help! No one was sending you encrypted emails anyway, so that’s…
1223
The optimal amount of fraud is non-zero
Counterintuitively, businesses, customers, and society prefer having fraud to what they'd need to do to not have it.
1224
Google's Abandoned Android Authenticator App
The news has just broken that Google's Authenticator App can have its codes stolen by malware. I doubt Google will ever release a fix for this issue - their 2FA app hasn't been updated since September 2017. Update! 3 months after I published this post, Google updated their app For two-and-a-half years, Google hasn't…
1225
What If We Put Warnings on IoT Devices?
A couple of years ago, I was heavily involved in analysing and reporting on the massive VTech hack [https://www.troyhunt.com/when-children-are-breached-inside/], the one where millions of records were exposed including kids' names, genders, ages, photos and the relationship to parents' records which included their
1226
CSRF is really dead
A little while back I wrote a blog post about how "CSRF is dead". It focused on SameSite cookies, a powerful yet simple feature to protect your website against CSRF attacks. As powerful as it was, and as much as it will kill CSRF, you had to enable it on
1227
Why Deleting Sensitive Information from GitHub Doesn't Save You
Security and Programming Blog
1228
Senate Testimony on Privacy Rights and Data Collection in a Digital Economy
Idle Words > Talks > Privacy Rights and Data Collection in a Digital Economy (Senate hearing)
1229
We have a year to fix security everywhere
consumer-grade hardware can run an LLM that hacks the planet. we can stop it, but we don't have much time.
1230