121
NTP Pool Bad Actors: The Rising Sophistication of Network Scanning
Gone are the days when computers didn't need firewalls. We are now living in an internet security arms race and your personal information ...
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 279 posts.
122
123
How Dropbox hacks your mac
Update: also see Discovering how Dropbox hacks your mac If you have Dropbox installed, take a look at System Preferences > Security & Privacy > Accessibility tab (see …
124
125
126
Disclosing the Primary Email address for each Facebook user
Introduction This post is going to be discussing how I was able to get the primary/hidden email address for any Facebook user. This also happens to be my first accepted bug to the Facebook Bug Bounty Program. Background Back in September I got an email notification from Facebook stating
127
CSS mix-blend-mode is bad for your browsing history
Up until mid-2010, any rogue website could get a good sense of your browsing habits by specifying a distinctive :visited CSS pseudo-class ...
128
129
Why I don't like smartcards, HSMs, YubiKeys, etc.
This is a rant about smartcards with some digression into ranting about the integrated circuit industry.
130
Self-host analytics for better privacy and accuracy
Something that always annoyed me of the current state of technology is how easy and pervasive we let tracking become. Tens of connections to 3rd parties carrying Referer and Cookies just to load an article. (We give up our users to social media websites just to show a like button that looks worse anyway in a iframe…
131
132
Rolling Your Own Crypto
So you want to roll your own crypto. Well, be careful. Be very careful.
133
Software Freedom Doesn't Kill People, Security Through Obscurity Kills People
The time has come that I must speak out against the inappropriate rhetoric used by those who (ostensibly) advocate for FLOSS usage in automotive applications.
134
The limitations of Android N Encryption
Over the past few years we’ve heard more about smartphone encryption than, quite frankly, most of us expected to hear in a lifetime. We learned that proper encryption can slow down even sophi…
135
136
WoSign's secret purchase of StartCom: WoSign threatened legal actions
This website is for sale! percya.com is your first and best source for information about percya. Here you will also find topics relating to issues of general interest. We hope you find what you are looking for!
137
Careers in security, ethical hacking and advice on where to get started
Many people will disagree with this post, not so much because it's flat out wrong but because there are so many different approaches one can take. It's a very subjective realm but I'm going to put forward some suggestions, make some considered arguments and leave it at
138
139
Two-factor paper passwords
I guess it makes me boring but I try to get people to use stronger passwords. People love to use the same password over and over again, o...
140
8M GitHub profiles were leaked from GeekedIn's MongoDB
Let me make it crystal clear in the opening paragraph: this incident is not about any sort of security vulnerability on GitHub's behalf, rather it relates to a trove of data from their site which was inappropriately scraped and then inadvertently exposed due to a vulnerability in another service.
141
The Democratization of Censorship
John Gilmore , an American entrepreneur and civil libertarian, once famously quipped that “the Internet interprets censorship as damage and routes around it.” This notion undoubtedly rings true for those who see national governments as the principal threats to free speech.
142
143
Windows 10 in-place upgrades are a severe security risk
This is a big issue and it has been there for a long time. Just a month ago I finally got verification that the Microsoft Product Groups n...
144
145
Data is a Toxic Asset
Thefts of personal information aren’t unusual. Every week, thieves break into networks and steal data about people, often tens of millions at a time. Most of the time it’s information that’s needed to commit fraud, as happened in 2015 to Experian and the IRS. Sometimes it’s stolen for purposes of embarrassment or…
146
Apple EFI firmware passwords and the SCBO myth
My original goal when I started poking around Apple’s EFI implementation was to find a way to reset a MacBook’s firmware password. My preliminary research found references to a “magical” SCBO file that could be loaded onto a USB flash drive and booted to remove the password. The normal process workflow is to first…
147
Did the Clinton Email Server Have an Internet-Based Printer?
The Associated Press today points to a remarkable footnote in a recent State Department inspector general report on the Hillary Clinton email scandal: The mail was managed from the vanity domain “ clintonemail.com .” But here’s a potentially more explosive finding: A review of the historic domain registration records…
148
Pwncloud – Bad crypto in the Owncloud encryption module
This blog is written by Hanno Böck. Unless noted otherwise, its content is licensed as CC0 .
149
150
Practical Reverse Engineering Part 5 – Digging Through the Firmware
Fifth post in the series, covering how to obtain GPL source code, disassemble MIPS binaries with tools like IDA, and search the firmware for a default WiFi p...