2281
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,334 posts.
2282
Why I don't like smartcards, HSMs, YubiKeys, etc.
This is a rant about smartcards with some digression into ranting about the integrated circuit industry.
2283
LLMs could control their host machines by exploiting inference engines
| Read on LessWrong | Comment on HN | Large language models often take actions running on one computer (via an agentic harness such as Claude Code or Codex), however the LLMs’ responses to prompts are computed on a different computer with GPU access.
2284
LLMs and coding agents are a security nightmare
Things are about to get wild
2285
On the new Dutch intelligence and security law
13th of June UPDATE: The Dutch government has failed to hire and house the promised new 10 oversight staff. Yet, the new law will be enacted July 1st, passing oversight to people that don’t exist. I surely enjoyed living under the rule of law, but it appears it was a passing thing. “The Netherlands hosts some of the…
2286
2287
Compromising Angular via expired NPM publisher email domains
A Hacker's Blog of Unintended Use and Insomnia.
2288
Backdoors and other vulnerabilities in HiSilicon based hardware video encoders
Serious vulnerabilities (including a backdoor) in IPTV/H.264/H.265 video encoders based on HiSilicon hi3520d hardware.
2289
The perils of the “real” client IP
This post ended up being incredibly long comprehensive. I’m afraid that many people won’t read enough to get everything that’s important, so here are the key points:
2290
2291
Trust is good, control is better: Reproducible builds at F-Droid
Free Software is a great thing, because it allows users to check that apps are doing what they pretend to do. But almost nobody compiles apps themselves.
2292
2293
Usbliter8: an A12/A13 SecureROM Exploit
This page is taking an unexpected detour...
2294
2295
Chrome to force .dev domains to HTTPS via preloaded HSTS
Google bought the .dev gTLD and Chrome 63 started force-redirecting every .dev domain to HTTPS via preloaded HSTS, breaking local dev setups. Here's why, and …
2296
Memory safety is necessary, not sufficient
TL;DR: I think that a focus on memory safe languages (MSLs) versus non memory-safe languages is a bit of a red herring. The actual distinction is slightly…
2297
2298
I used AWS cognito for a startup. I wouldn't do it again
I let AWS Cognito gaslight me for three weeks so you don't have to. Here's the unfiltered autopsy.
2299
2300
2301
Self-host analytics for better privacy and accuracy
Something that always annoyed me of the current state of technology is how easy and pervasive we let tracking become. Tens of connections to 3rd parties carrying Referer and Cookies just to load an article. (We give up our users to social media websites just to show a like button that looks worse anyway in a iframe…
2302
Zerocoin: making Bitcoin anonymous
Wow, what the heck is going on with Bitcoin? When I started this post, the value of a single bitcoin had surged upwards of $250. It’s corrected a bit since then (down $100 or so), but it̵…
2303
2304
2305
2306
Don't verify email addresses by sending spam to them
Much have been said about futility of trying to validate email addresses. Generally accepted advice is that you should just send verification link and don’t care about trying to validate it beforehand.
2307
2308
Spectre exploits in the "wild"
Personal blog of Julien (jvoisin) Voisin
2309
Crooks Bypassed Google's Email Verification to Create Workspace Accounts, Acces
Google says it recently fixed an authentication weakness that allowed crooks to circumvent the email verification required to create a Google Workspace account, and leverage that to impersonate a domain holder at third-party services that allow logins through Google’s “Sign in with Google” feature.
2310
How I created two images with the same MD5 hash
I posted the following images the other day which although looking totally different have exactly the same MD5 hash ( e06723d4961a0a3f950e...