2251
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,334 posts.
2252
Spectre/Meltdown Pits Transparency Against Liability
There is a lot of righteous anger directed toward Intel over CPU bugs that were revealed by Spectre/Meltdown. I agree that things could have been handled better, particularly with regards to transparency and the sharing of information among the relevant user communities that could have worked together to deploy…
2253
Dropbox disables ASLR on Windows
Dropbox has become a daily part of my life. I rely on it to synchronise data between my growing set of devices. But how much of an impact does it have on the security of my system? I decided to fin…
2254
2255
Tiffin Tom: Fish, chips and a side of identity theft
Apart from leaking everything, there's been "no breech". Avoid Tiffin Tom.
2256
2257
Disclosing the Primary Email address for each Facebook user
Introduction This post is going to be discussing how I was able to get the primary/hidden email address for any Facebook user. This also happens to be my first accepted bug to the Facebook Bug Bounty Program. Background Back in September I got an email notification from Facebook stating
2258
Maximizing password manager attack surface
Kaspersky Password Manager uses a unique approach to maximize the attack surface. A quick introduction.
2259
TouchEn nxKey: A keylogging anti-keylogger solution
TouchEn nxKey is supposed to combat keyloggers. Instead, this application made writing a keylogger extremely simple, allowed attacking banking websites and more.
2260
CSS mix-blend-mode is bad for your browsing history
Up until mid-2010, any rogue website could get a good sense of your browsing habits by specifying a distinctive :visited CSS pseudo-class ...
2261
2262
Introduction to reverse-engineering vintage synth firmware
A gentle introduction to reverse-engineering vintage synthesiser ROMs using the Ghidra disassembler.
2263
OpenSSL memory use in Node.js
Last Thursday I went to the Joyent office for Node Office Hours — I wanted to talk to Isaac about running a private NPM registry .
2264
I'm unsure of the security of simultaneous multithreading on modern x86 CPUs
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
2265
Your WiFi Can See You
And it's so much worse than you think
2266
Pwned or Bot
It's fascinating to see how creative people can get with breached data. Of course there's all the nasty stuff (phishing, identity theft, spam), but there are also some amazingly positive uses for data illegally taken from someone else's system. When I first built Have I Been Pwned
2267
Secure Boot and the 2018 MacBook Pro
the vent for my mind
2268
Pledge() and unveil() in SerenityOS (2020)
This post describes the implementation and use of pledge() and unveil() in SerenityOS.
2269
2270
Let's Encrypt's old root certificate is expiring
On 30th September 2021, the root certificate that Let's Encrypt are currently using, the IdentTrust DST Root CA X3 certificate, will expire. You may or may not need to do anything about this Root CA expiring, but I'm betting a few things will probably break on that day
2271
Maersk, Me and NotPetya
Maersk is the world’s largest integrated shipping and container logistics company.
2272
The most popular curl download – by a malware
During October 2015 the curl web site sent out 1127 gigabytes of data. This was the first time we crossed the terabyte limit within a single month. Looking at the stats a little closer, I noticed that in July 2015 a particular single package started to get very popular. The exact URL was…
2273
Everything I Know About the XZ Backdoor
Please note: This is being updated in real-time. The intent is to make sense of lots of simultaneous discoveries
2274
A Go implementation of Poly1305 that makes sense
Cryptography code could be understandable if only we commented it. This Poly1305 implementation is an attempt to prove it. It should be readable with just an idea of what MACs are for, a beginner level of Go, and high school math.
2275
A thought on JavaScript "proof of work" anti-scraper systems
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
2276
VS Code – What's the deal with the telemetry?
VS Code collects telemetry data to help understand Microsoft how to improve the product. Is it above board? Can I turn it off completely?
2277
2278
2279
2280
MSI's (in)Secure Boot
Before we start, maybe I will quickly explain what Secure Boot is. It is a security feature, which allows our computer to decline booting operating systems that have not been signed by a key that the firmware trusts.