2161
Sabotaging Bitcoin
Source I find myself in the unusual position of defending Bitcoin from its critics, if only reluctantly. In 2024 Soroush Farokhnia & Amir...
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,333 posts.
2162
How I lost control of our bank accounts to a phone scammer
Yesterday, instead of having a productive afternoon at home, I had the privilege of sitting at the bank for a couple of hours, resolving a problem completely of my own doing: I fell for a phone scammer. My wife and I had to close our accounts—which were in excess of 25 years old—and set up new ones. I then spent hours…
2163
Titled Tuesday Cheating
Fantastic Cheaters and Where to Find Them
2164
An aggressive, stealthy web spider operating from Microsoft IP space
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
2165
Tracking users via CSS
I try to be a friendly citizen of the web. I try to keep my site in good shape. It should load quickly, track nothing beyond your basic server logs, not hassle you about cookies, GDPR or my newsletter. I do have a newsletter but it won't pop up in your face here. I try to stay firmly on the side of friendly and a good…
2166
Blackmail fail
In which the author receives surprising offers from kind strangers
2167
Some thoughts on Spectre and Meltdown
The story of these attacks starts in late 2004. I had submitted my doctoral thesis and had a few months before flying back to Oxford for my defense, so I turned to some light reading: Intel's latest "Optimization Manual", full of tips on how to write faster code. (Eking out every last nanosecond of performance has…
2168
2169
Hacking an ATM
At the Black Hat conference in 2010, an ATM designed and built by my employer was setup on stage, and a security researcher demonstrated an ...
2170
Vulnerability in Bumble dating app reveals any user's exact location
The vulnerability in this post is real. The story and characters are obviously not.
2171
SecureDrop
SecureDrop is an open-source whistleblower support system, originally written by Aaron Swartz and now run by the Freedom of the Press Foundation. The first instance of this system was named StrongBox and is being run by The New Yorker. To further add to the naming confusion, Aaron Swartz called the system DeadDrop…
2172
The Right to Lie and Google’s “Web Environment Integrity”
This is a fundamental principle of free and open source software. The World Wide Web abides by this principle, although we don’t often think of it that way. The Web is just an agreed-on set of programmatic interfaces: if you send me this, I’ll send you that. Your computer can construct the “this” by whatever means it…
2173
Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators
Why you should be opting for local tooling when working with sensitive data, even Non-Production ones.
2174
Is Microsoft Stealing People’s Bookmarks?
I received email from two people who told me that Microsoft Edge enabled synching without warning or consent, which means that Microsoft sucked up all of their bookmarks. Of course they can turn synching off, but it’s too late. Has this happened to anyone else, or was this user error of some sort? If this is real, can…
2175
The phones of Ukrainian president Zelensky
Interesting telephone equipment in the offices of Ukrainian president Zelensky
2176
An update on Truecrypt
Several people have been asking for an update on our public audit of the Truecrypt disk encryption software. I’m happy to say that the project is on track and proceeding apace. Here I wanted …
2177
Hell is overconfident developers writing encryption code
Overconfident developers that choose to write their own cryptography code have plagued the information security industry since before it was even an industry. This in and of itself isn’t inhe…
2178
Final Decision on Chromebook Case in Denmark
The Danish DPA issues an injunction in the Chromebook case
2179
2180
Laptop Ban a Reaction to X-Ray Equipment Stolen by ISIS
On March 21st, 2017, the U.S. Department of Homeland Security ordered airlines flying to the U.S. out of 10 airports, mostly in Muslim-majority countries in the Middle East, to refuse to transport …
2181
The Dual LLM pattern for building AI assistants that can resist prompt injection
I really want an AI assistant: a Large Language Model powered chatbot that can answer questions and perform actions for me based on access to my private data and tools. …
2182
Everything you ever wanted to know about building a secure password reset (2012)
This content is now available in the Pluralsight course "Secure Account Management Fundamentals" [http://www.pluralsight.com/courses/secure-account-management-fundamentals] Recently I’ve had a couple of opportunities to think again about how a secure password reset function should operate, firstly whilst building this…
2183
2184
2185
2,800 New Data Breaches with 80M Records Added
tl;dr - a collection of nearly 3k alleged data breaches has appeared with a bunch of data already proven legitimate from previous incidents, but also tens of millions of addresses that haven't been seen in HIBP before. Those 80M records are now searchable, read on for the full story:
2186
2187
Signing Git commits with your SSH key (2021)
You could always sign Git commits with a GPG key, but now your SSH key is just as powerful!
2188
Scaring People into Supporting Backdoors
Back in 1998, Tim May warned us of the “Four Horsemen of the Infocalypse”: “terrorists, pedophiles, drug dealers, and money launderers.” I tended to cast it slightly differently. This is me from 2005: Beware the Four Horsemen of the Information Apocalypse: terrorists, drug dealers, kidnappers, and child pornographers…
2189
The NSA Is Breaking Most Encryption on the Internet
The new Snowden revelations are explosive. Basically, the NSA is able to decrypt most of the Internet. They’re doing it primarily by cheating, not by mathematics. It’s joint reporting between the Guardian, the New York Times, and ProPublica. I have been working with Glenn Greenwald on the Snowden documents, and I have…
2190
Images over DNS
Some places say 255 bytes. They are wrong . Within a TXT record there are multiple character-strings (RFC 1035 section 3.3.14 ) and those are limited in length (because a single byte is used for their length), however there can be many of them.