1921
The React2Shell Story
The story of CVE-2025-55182 (React2Shell)
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,333 posts.
1922
Still Why No HTTPS?
Back in July last year, Scott Helme and I shipped a little pet project that tracked the world's largest websites not implementing HTTPS by default [https://www.troyhunt.com/why-no-https-heres-the-worlds-largest-websites-not-redirecting-insecure-requests/] . We called it Why No HTTPS? [https://whynohttps.
1923
1924
Please turn on two-factor authentication
You should read Mat Honan’s heartbreaking tale of a hack attack and the ensuing discussion on Techmeme. Much of the story is about Amazon or Apple’s security practices, but I would stil…
1925
How to Crash Systemd in One Command
After running this command, PID 1 is hung in the pause system call. You can no longer start and stop daemons. inetd-style services no longer accept connections. You cannot cleanly reboot the system. The system feels generally unstable (e.g. ssh and su hang for 30 seconds since systemd is now integrated with the login…
1926
I can no longer recommend MailChimp
MailChimp doesn’t seem to think double opt-in is a good idea for mailing lists anymore.
1927
The Myth of Consumer-Grade Security
The Department of Justice wants access to encrypted consumer devices but promises not to infiltrate business products or affect critical infrastructure. Yet that’s not possible, because there is no longer any difference between those categories of devices. Consumer devices are critical infrastructure. They affect…
1928
macOS's Little-Known Command-Line Sandboxing Tool (2025)
AVAILABLE NOW OpenAI, Anthropic, and Chrome ship it. Apple deprecated it. Nobody documented it. Until now. → sandbox-exec: The Miss...
1929
The time I hacked my high school
When I was in high school, I started the Chess Club. I needed money to buy chess sets and chess cl...
1930
1931
XSS attacks on Googlebot allow search index manipulation
Googlebot is based on Google Chrome version 41 (2015), and therefore it has no XSS Auditor, which later versions of Chrome use to protect the user from XSS attacks…
1932
1933
Stupid certificate tricks
Sometimes I do things for no real reasons other than “because I can” and/or “it amuses me”. For example, embedding a snarky message into my HTTPS certificate.
1934
Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea
Disclaimer: Thoughts expressed here are my own, and not of my employers.
1935
Turn on MFA Before Crooks Do It for You
Hundreds of popular websites now offer some form of multi-factor authentication (MFA), which can help users safeguard access to accounts when their password is breached or stolen. But people who don’t take advantage of these added safeguards may find it far more difficult to regain access when their account gets…
1936
1937
Beware of sudo on OS X
There's a little kerfuffle going on over on HN about a newly discovered local root exploit on OS X 10.10.5 , so I thought this might be a g...
1938
Promiscuous cookies and their impending death via the SameSite policy
Cookies like to get around. They have no scruples about where they go save for some basic constraints relating to the origin from which they were set. I mean have a think about it: If a website sets a cookie then you click a link to another page on that
1939
Building a Curve25519 Hardware Accelerator
Note: this post uses a $\LaTeX$ plugin to render math symbols. It may require a desktop browser for the full experience…
1940
1941
The Basics of Web Application Security
Security is both very important and often under-emphasized. While many targeted techniques help, there are some basic clean code habits which every developer can and should be doing
1942
Exodus Bitcoin Wallet: $490k swindle
Edit: There’s a short follow-up to this post: Exodus Bitcoin Wallet: Follow up. tl;dr: A Bitcoin investor was recently scammed out of 9 Bitcoin (worth around $490K) in a fake “Exodus wallet” desktop application for Linux, published in the Canonical Snap Store. This isn’t the first time, and if nothing changes, it…
1943
1944
Why can't Apple decrypt your iPhone?
Last week I wrote about Apple’s new default encryption policy for iOS 8. Since that piece was intended for general audiences I mostly avoided technical detail. But since some folks (and appar…
1945
Tracking the WhatsApp habits of random smartphones
Scaling the WhatsApp online-status hack from a single contact to 5000 random phone numbers — what the data says about phone usage habits.
1946
Formal Verification: The Gap Between Perfect Code and Reality
Thanks to Vlad Brown and Drawings Team for Russian and Uzbek translations. In Fall 2017, I took MIT’s 6.826, Principles of Computer Systems, taught by Turing Award-winner Butler Lampson, Nickolai Z
1947
Whose code am I running in GitHub Actions?
I wanted to know what third-party code I was using in my GitHub Actions. I was able to use standard text processing tools and shell pipelines to get a quick tally.
1948
Multi-modal prompt injection image attacks against GPT-4V
GPT4-V is the new mode of GPT-4 that allows you to upload images as part of your conversations. It’s absolutely brilliant. It also provides a whole new set of vectors …
1949
More on the NSA Commandeering the Internet
If there’s any confirmation that the U.S. government has commandeered the Internet for worldwide surveillance, it is what happened with Lavabit earlier this month. Lavabit is—well, was—an e-mail service that offered more privacy than the typical large-Internet-corporation services that most of us use. It was a small…
1950
Tarsnap: No heartbleed here
There's a few reasons for this. First, the Tarsnap client-server protocol does not use TLS; instead, it uses a protocol which is about 100x simpler (in terms of the number of pages of documentation required to define it). This means there's less code and far fewer edge cases where bugs can lurk without being triggered…