Topics /
The most popular blog posts about security & privacy on Hacker News. 263 posts.
A new version of Adblock Plus was released on July 17, 2018. Version 3.2 introduced a new filter option for rewriting requests. A day later AdBlock followed suit and released support for the new filter option. uBlock, being owned by AdBlock, also implemented the feature. Under certain conditions the $rewrite filter…
After nearly a year of work from a growing community of developers, designers, and translators, I'm excited that OnionShare 2 is finally ready. You can download it from onionshare.org. OnionShare is an open source tool for securely and anonymously sending and receiving files using Tor onion services. It
Everybody knows these modal dialogs when visiting a website for the first time that ask you to accept cookies and consent to being tracked by third-party advertising networks. It actually became a habit for me to always click through these things and reject any kind of tracking or use of my personal information except…
Civil Rights, Criminal Justice and Homeland Security
On macOS, an app can register to handle URL schemes. Web browsers such as Safari, Chrome, and Firefox register to handle the schemes for web pages, http or https . Non-browser apps may register to handle other URL schemes; for example, an email client may register to handle the well known mailto scheme. When a URL is…
Google is planning changes in Chrome impacting ad blocker extensions and people are wondering whether those changes are motivated by self-interest or whether there are plausible, benign explanations.
Telegram, the encrypted messaging app loved by terrorists, has been in the news lately. Terrorists have long used existing commercial and…
Back in July last year, Scott Helme and I shipped a little pet project that tracked the world's largest websites not implementing HTTPS by default [https://www.troyhunt.com/why-no-https-heres-the-worlds-largest-websites-not-redirecting-insecure-requests/] . We called it Why No HTTPS? [https://whynohttps.
The Department of Justice wants access to encrypted consumer devices but promises not to infiltrate business products or affect critical infrastructure. Yet that’s not possible, because there is no longer any difference between those categories of devices. Consumer devices are critical infrastructure. They affect…
Googlebot is based on Google Chrome version 41 (2015), and therefore it has no XSS Auditor, which later versions of Chrome use to protect the user from XSS attacks…
The following document is an attempt to consolidate down a number of threads spanning separate discussions from around the 'net I have been having on the subject of operating system development models and OpenBSD. I will break up this document into several sections each of which will handle separate pillars of my…
I discovered a Facebook bug which allows me to identify whether a visitor is logged in to a specific Facebook account. It can check hundreds of identities per second.
Here's an interesting user-hostile pattern which could easily be avoided if programmers and business-people thought like regular humans. I have a Pioneer / Onkyo sound system. It's pretty nice and comes with a (not too crappy) Android app to let me remote control it. One day, the app updated itself. The changelog was…
Updated August 4, 2019: Added link to “A.C.L.U. Says F.B.I. Funded ‘Army’ To Terrorize Young War Dissidents” The unsealing of an application for a search warrant by the federal governme…
NANOG is now quite an institution in the Internet, particularly in the North American Internet community. It was an offshoot of the Regional Techs meetings, which were part of the NSFNET framework of the late 80s and early 90s. NANOG has thrived since then and is certainly one of the major network operational forums…
The very first feature I added to Have I Been Pwned after I launched it back in December 2013 was the public API [https://www.troyhunt.com/have-i-been-pwned-you-can-now-ask-api/]. My thinking at the time was that it would make the data more easily
Sometimes the discussion around extended validation certificates (EV) feels a little like flogging a dead horse. In fact, it was only September that I proposed EV certificates are already dead [https://www.troyhunt.com/extended-validation-certificates-are-dead/] for all sorts of good reasons that have only been…
Ambitious software engineer
One of the more curious behaviors of Apple’s new iPhone 11 Pro is that it intermittently seeks the user’s location information even when all applications and system services on the phone are individually set to never request this data. Apple says this is by design, but that response seems at odds with the company’s…
Federal prosecutors this week charged a Seattle woman with stealing data from more than 100 million credit applications made with Capital One Financial Corp . Incredibly, much of this breach played out publicly over several months on social media and other open online platforms. What follows is a closer look at the…
In this post, you'll find out more on the legal aspect of web scraping and crawling, and what possible consequences you might face.
Incessantly annoying and fraudulent robocalls. Corrupt wireless company employees taking hundreds of thousands of dollars in bribes to unlock and hijack mobile phone service. Wireless providers selling real-time customer location data, despite repeated promises to the contrary. A noticeable uptick in SIM-swapping…
This content is now available in the Pluralsight course "Secure Account Management Fundamentals" [http://www.pluralsight.com/courses/secure-account-management-fundamentals] Recently I’ve had a couple of opportunities to think again about how a secure password reset function should operate, firstly whilst building this…
Back in 1998, Tim May warned us of the “Four Horsemen of the Infocalypse”: “terrorists, pedophiles, drug dealers, and money launderers.” I tended to cast it slightly differently. This is me from 2005: Beware the Four Horsemen of the Information Apocalypse: terrorists, drug dealers, kidnappers, and child pornographers…
Indian information technology (IT) outsourcing and consulting giant Wipro Ltd. [ NYSE:WIT ] is investigating reports that its own IT systems have been hacked and are being used to launch attacks against some of the company’s customers, multiple sources tell KrebsOnSecurity. Wipro has refused to respond to questions…
