121
I Had My Electronics Seized by U.S. Customs and Border Protection
After my trip in Hamburg, Germany, for the 33rd Chaos Communication Congress, I left Germany for t
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,332 posts.
122
What we call "age verification" is actually mass surveillance
The literature on harms to kids from online platforms is complex and nuanced, rife with people citing small, ambiguous studies as iron-clad evidence that kids are being destroyed by the internet:
123
GoDaddy injecting JavaScript into websites and how to stop it
I recently started having issues with the admin interface of a website I run and decided to check the browser console to see if any errors were being displayed there. There were and among them was an error stating that a JavaScript map file being loaded (and failing) that I did not recognise. This meant that the…
124
Security by obscurity is underrated
Some thoughts about cyber security, technology and life - https://utkusen.com/. Click to read Utku Sen’s Substack, a Substack publication with hundreds of subscribers.
125
European Parliament approves mass surveillance of private communication
Today, the European Parliament approved the ePrivacy Derogation, allowing providers of e-mail and messaging services to automatically search all personal messages of each citizen for presumed suspect content and report suspected cases to the police. The European Pirates Delegation in the Greens/EFA
126
Amazon's Ring and Google's Nest reveal the severity of U.S. surveillance state
Just a decade after a global backlash was triggered by Snowden reporting on mass domestic surveillance, the state-corporate dragnet is stronger and more invasive than ever.
127
The tiny chip that powers Montreal subway tickets
To use the Montreal subway (the Métro), you tap a paper ticket against the turnstile and it opens. The ticket works through a system called ...
128
I found a vulnerability. they found a lawyer
What happens when you responsibly disclose a critical vulnerability exposing personal data - including that of minors - and the organization responds with legal threats instead of a thank you?
129
Google has a secret browser hidden inside the settings
My most popular article about Google - breakthrough in gms
130
The “Cobra Effect” that is disabling paste on password fields
Back in the day when the British had a penchant for conquering the world, they ran into a little problem on the subcontinent; cobras. Turns out there were a hell of a lot of the buggers wandering around India and it also turned out that they were rather venomous which
131
How I hacked Github again
This is a story about 5 Low-Severity bugs I pulled together to create a simple but high severity exploit, giving me access to private reposi...
132
Hacking 700M Electronic Arts accounts
(Ethically). Here's how I did it.
133
Noise infusion banned from statistical products published by Census Bureau
Sadly, taking away valuable disclosure avoidance tools doesn't make fundamental trade-offs go away.
134
I almost got hacked by a 'job interview'
I was 30 seconds away from running malware, Here's how a sophisticated scam operation almost got me, and why every developer needs to read this.
135
Hacking millions of modems and investigating who hacked my modem
Two years ago, something very strange happened to me while working from my home network. I was exploiting a blind XXE vulnerability that required an external HTTP server to smuggle out files, so I spun up an AWS box and ran a simple Python webserver to receive the traffic from the vulnerable server.
136
Mobile carriers can get your GPS location
In iOS 26.3, Apple introduced a new privacy feature which limits “precise location” data made available to cellular networks via cell towers. The feature is only available to devices with Apple’s in-house modem introduced in 2025. The announcement1 says https://support.apple.com/en-us/126101 ↩
137
I no longer trust The Great Suspender
I know a number of folks use The Great Suspender to automatically suspend inactive browser tabs in Chrome. Apparently recent versions of this extension have been taken over by a shady anonymous entity and is now flagged by Microsoft as malware . Notably the most recent version of the extension (v7.1.8) has added…
138
139
Have I Been Pwned 2.0
This has been a very long time coming, but finally, after a marathon effort, the brand new Have I Been Pwned website is now live! Feb last year is when I made the first commit to the public repo for the rebranded service, and we soft-launched the new brand
140
Remote Code Execution on Most Dell Computers
What computer do you use? Who made it? Have you ever thought about what came with your computer? When we think of Remote Code Execution (RCE) vulnerabilities in mass, we might think of vulnerabilities in the operating system, but another attack vector to consider is "What third-party software came with
141
It's still easy for anyone to become you at Experian
In the summer of 2022, KrebsOnSecurity documented the plight of several readers who had their accounts at big-three consumer credit reporting bureau Experian hijacked after identity thieves simply re-registered the accounts using a different email address. Sixteen months later, Experian clearly has not addressed this…
142
143
Trackers
A couple of weeks ago I went to the local shopping centre looking for a thermometer. After entering one store upon leaving without buying anything a tracker was assigned to me. I didn’t think much of it at first, but he followed me dutifully around the shopping centre, took careful note of how I walked. Whenever I…
144
Npm Audit: broken by design?
Found 99 vulnerabilities (84 moderately irrelevant, 15 highly irrelevant)
145
Security Flaws in Adobe Acrobat Reader Allow Gaining Root on macOS Silently
Yuebin Sun(@yuebinsun2020) of Tencent Security Xuanwu Lab 0x0 SummaryToday, Adobe Acrobat Reader DC for macOS patched three critical vulnerabilities(CVE-2020-9615, CVE-2020-9614, CVE-2020-9613) I repo
146
iOS Privacy: Easily get a user's Apple ID password, just by asking
I work with U.S. law firms as a non-testifying technical consulting expert on matters involving the Apple platform and iOS apps. Learn more about my litigation consulting.
147
Extracting the SuperFish certificate
I extracted the certificate from the SuperFish adware and cracked the password (" komodia ") that encrypted it. I discuss how down below. T...
148
I'm a scam prevention expert and I got scammed
When discussing scams and social engineering attacks, it's easy for security experts to imply the victims of these attacks should have known better. And, as much as we may like to think we'd handle these situations so much better, that's just not true.
149
150
GDPR: Don't Panic
In another week the GDPR , or the General Data Protection Regulation will become enforceable and it appears that unlike any other law to date this particular one has the interesting side effect of causing mass hysteria in the otherwise rational tech sector.