2011
Running one’s own root Certificate Authority in 2023
A tale how running your own x509 root CA – for internal services – changed in the last 20 years.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,333 posts.
2012
GitHub shouldn't allow username reuse
Update 2018-04-19 - GitHub has implemented some rules around retiring "namespaces".
2013
Securing a travel iPhone
These are dry notes I took in the process of setting up a burner iPhone SE as a secure travel device. They are roughly in setup order.
2014
Reverse-Engineering an IP Camera (2019)
A few days ago I had to replace the old IP camera I use to watch over my dogs and cats, and found out that IP cam technology changed a lot since I bought that old camera. IP cameras are now low-price and ubiquitous. I bought one of those generic models and installed it at my home, expecting to use the same software…
2015
What’s going on with security at PayPal?
PayPal's one-time login codes are a security disaster. Your account is at severe risk; remove your data or close your account immediately.
2016
More malicious extensions in Chrome Web Store
So far I discovered 18 malicious extensions with 55 million users in total. Most popular ones are: Autoskip for Youtube, Crystal Ad block and Brisk VPN. They have been active for two years, undetected by Google.
2017
2018
2019
Holy War on Sites That Demand Pinboard Passwords
Over two years ago I introduced an API authentication method so people could authorize outside third-party websites to add things to their Pinboard account without sharing their Pinboard password.
2020
2021
Why Aren't There More Terrorist Attacks?
As the details of the Times Square car bomb attempt emerge in the wake of Faisal Shahzad’s arrest Monday night, one thing has already been made clear: Terrorism is fairly easy. All you need is a gun or a bomb, and a crowded target. Guns are easy to buy. Bombs are easy to make. Crowded targets—not only in New York, but…
2022
Using lots of little tools to aggressively reject the bots
Or using lots of little tools to aggressively reject the bots
2023
2024
Apple in China: who holds the keys?
Last week Apple made an announcement describing changes to the iCloud service for users residing in mainland China. Beginning on February 28th, all users who have specified China as their country/r…
2025
Class Action Targets Experian over Account Security
A class action lawsuit has been filed against big-three consumer credit bureau Experian over reports that the company did little to prevent identity thieves from hijacking consumer accounts. The legal filing cites liberally from an investigation KrebsOnSecurity published in July, which found that identity thieves were…
2026
It seems that OpenAI is scraping [certificate transparency] logs
lol. I minted a new TLS cert and it seems that OpenAI is scraping CT logs for what I assume are things to scrape from, based on the near instant response from ...
2027
Charlie Stross on Girls Around Me
There is an app, currently on the Apple app store as a free download, called Girls Around Me .
2028
The No CAPTCHA problem
When I read about No CAPTCHA for the first time I was really excited. Did we finally find a better solution? Hashcash? Or what? Finally it...
2029
A little game to demonstrate timing attacks.
Lauren Ipsum is trying to get past Jane Hecate, a little old lady who holds the Book of Passwords. Jane is older and can't see well, so she has to spell out Lauren's guess letter by letter to check whether it's the right password. How can Lauren use this to her advantage? A story about computer science and other…
2030
2031
2032
Undocumented Facebook API to identify friends in photos
So last week I was casually browsing through Facebook feed and looking at some random photo posted by a friend. So hovering over the pictur...
2033
The Signal protocol for Node and browsers
Signal is a protocol for encrypted chat. Developed by Moxie Marlinspike and Trevor Perrin, the Signal protocol backs the excellent Signal Messenger , and has since been incorporated into WhatsApp, Facebook Messenger and Google Allo.
2034
Why Does My Remote Control Need to Know My Location?
Here's an interesting user-hostile pattern which could easily be avoided if programmers and business-people thought like regular humans. I have a Pioneer / Onkyo sound system. It's pretty nice and comes with a (not too crappy) Android app to let me remote control it. One day, the app updated itself. The changelog was…
2035
Running a private mail server for six years, easy peasy
Motivation The Right Reasons Tech Stack Implementation Mail rate and Spaminess Ongoing Maintenance Alternatives Conclusion
2036
FBI agent accidentally reveals own 8chan posts
Updated August 4, 2019: Added link to “A.C.L.U. Says F.B.I. Funded ‘Army’ To Terrorize Young War Dissidents” The unsealing of an application for a search warrant by the federal governme…
2037
Major sites running unauthenticated JavaScript on their payment pages
A few months ago, British Airways' customers had their credit card details stolen. How was this possible? The best guess goes something like this: BA had 3rd party JS on its payment page <script src="https://example.com/whatever.js"></script> The 3rd party's site was hacked, and the JS was changed. BA's customers ran…
2038
Government-Linked Certificate Authorities in OS X
I’ve been sitting on this information for some time, waiting to get more research done before I publish a post. But since word has come out about how Lenovo preloads what amounts to very bad spyware on their PCs, I thought I should also just go right ahead to spill the beans on the Mac.
2039
Does Your Domain Have a Registry Lock?
If you’re running a business online, few things can be as disruptive or destructive to your brand as someone stealing your company’s domain name and doing whatever they wish with it. Even so, most major Web site owners aren’t taking full advantage of the security tools available to protect their domains from being…
2040
Towards a More Open Secure Element Chip
“ Secure Element ” (SE) chips have traditionally taken a very closed-source, NDA-heavy approach. Thus, it piqued my interest when an early-stage SE chip startup, Cramium (still in stealth mode), approached me to advise on open source strategy. This blog post explains my reasoning for agreeing to advise Cramium, and…