121
macOS now scans for malware whenever it gets a chance
How macOS now has anti-malware scanners checking your Mac automatically many times each day for the most frequent malware.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 292 posts.
122
Why are McDonald’s Self Service Kiosks so hackable?
McDonalds in Australia do a decent cup of coffee. It’s not great but it’s consistently decent so I often start my day with a cup. Due to my travels around Australia in a decked out van I have seen how many McDonalds operate and just how many of
123
Why offer an Onion Address rather than just encourage browsing-over-Tor?
There are a bunch of reasons to launch an onion site, and a bunch of benefits, all of which have provided value to platforms such as Facebook, the BBC or NYT Onions. The first benefits are authenti…
124
125
126
Extracting WhatsApp Messages from an iOS Backup
Find where WhatsApp chats live in an iPhone backup, decrypt an encrypted iOS backup with Python, and read your messages from ChatStorage.sqlite.
127
Random number generator enhancements for Linux 5.17 and 5.18
The random number generator has undergone a few important changes for Linux 5.17 and 5.18, in an attempt to modernize both the code and the cryptography used. The smaller part of these will be released with 5.17 on Sunday, while the larger part will be merged into 5.18 on Monday, which should receive its first release…
128
129
I'm a security engineer and I still almost got scammed
I was in the park with my son and his best friend. I saw 2 missed calls from a number I didn’t recognise. I Googled it - it was my bank. I told the other adults that I should call back in case it was important.
130
131
Is “acceptably non-dystopian” self-sovereign identity even possible?
In the recent paper about "soulbound" tokens, Vitalik Buterin et al. write that they aim to build technology that is "acceptably non-dystopian". Do any of today's self-sovereign identity projects fit that bill?
132
Should you use Let's Encrypt for internal hostnames?
Julien Savoie has written a brilliant post explaining how you can enable https on your intranet. This is useful for several reasons. It means your employees aren't constantly fighting browser warnings when trying to submit stuff internally. All your http traffic is encrypted. You don't need to install a self-generated…
133
What NPM should do to stop a new colors attack
Over the weekend, a developer named Marak Squires intentionally sabotaged his popular NPM package colors and his less popular package faker . As I write this, NPM claims 18,971 direct dependents for colors and 2,751 for faker . Open Source Insights counts at least 42,000 more indirect dependents for colors . Many…
134
Hardening macOS
Quick and easy guide for securing macOS systems, for both laymen and security enthusiasts. Last updated for Golden Gate.
135
Analyzing iOS 16 Lockdown Mode: Browser Features and Performance
Another year, another Apple iOS/iPadOS/MacOS release, right? But shortly before the iOS 16 betas dropped, Apple made an interesting announcement.
136
SMS Multifactor Authentication in Antarctica
Issues pertaining to SMS (for multifactor auth) in Antarctica.
137
An Open Letter to Pixsy CEO Kain Jones, Who Keeps Sending Me Legal Threats
Once is happenstance. Twice is coincidence. Three times is enemy action.
138
139
New two-factor authenticator: Commodore 64
Multi-factor authentication is ripe for disruption. SMS 2FA is inherently defective. Phone authenticators get stolen. Security tokens get lo...
140
Hijacking infrared to make a dumb device smart
I own a very old ‘flat’ screen television from 2009. One of the reason this TV is still kicking around is because I have a strange sentimental affection for it. Another is that I have written automation for it that works really well and it would be a pain to migrate away from it.
141
Scapy: Low level packet hacking toolkit for Python
Code level discussion of web scraping, gray hat automation, growth hacking and bounty hunting
142
143
Plausibly deniable encryption (2020)
It is safe to assume that in any useful cryptosystem C k there exists at least one person with access to the key k . An adversary with sufficient leverage can bypass the computational cost of a conventional attack by exerting their influence on this person.
144
145
CORS is not meant to secure an API endpoint
CORS does not secure your API: why browser-side API keys are unsafe, and how to protect Drupal JSON:API endpoints with proper authentication.
146
Reverse engineering Xiaomi air purifier NFC stickers
For a very thorough write-up on how this all works , please visit : https://unethical.info/2024/01/24/hacking-my-air-purifier/
147
Why CVE-2022-3602 was not detected by fuzz testing
So recently a very hyped memory corruption security vulnerability was discovered in the OpenSSL punycode parser. Some folks including Hanno ...
148
149
What’s going on with security at PayPal?
PayPal's one-time login codes are a security disaster. Your account is at severe risk; remove your data or close your account immediately.
150