Topics /
The most popular blog posts about security & privacy on Hacker News. 4,335 posts.
One frustrating aspect of email phishing is the frequency with which scammers fall back on tried-and-true methods that really have no business working these days. Like attaching a phishing email to a traditional, clean email message, or leveraging link redirects on LinkedIn , or abusing an encoding method that makes…
Overview Today has been eventful, to say that least. My colleague and I patched several services, re-issued keys for them and started the ...
VE Commercial Vehicles’ My Eicher platform had a critical vulnerability that let you take over anyone’s account and gain control over their vehicle fleets.
The big tech news this week is that the FBI is trying to force Apple to unlock a suspect's iPhone. One of the interesting points around this story is that the iPhone in question is an older one, an iPhone 5c. Newer phones have what Apple calls the Secure Enclave, which some say protects against requests of this…
I have signed the StopWatching.Us letter today. I am not a US citizen, so even if the letter succeeds, I don’t think my privacy will improve substantially. But at least I did something.
UPDATE: Jay Radcliffe, the researcher discussed in this post, has emailed me, a ...
(Note: This article was written at the end of 2012 and is out of date. I will update it at some point, but until then, please keep that in perspective.)
The short version: I'm loading over 1 billion breached accounts into HIBP. These are from 2 different "combo lists", collections of email addresses and passwords from all sorts of different locations. I've verified their accuracy (including my own record in one of them) and many hundreds of millions
Back in the day there was talk about "jamming echelon" by adding keywords to email that the echelon system was supposedly looking for. We ca...
This form of Spectre can be used to attack a broad range of software -- operating systems, device drivers, web APIs, database systems, and almost anything else that receives untrusted input and may run on the same computer as untrusted code. Because large programs can contain literally millions of conditional branches…
On July 22, 2025, the European police agency Europol said a long-running investigation led by the French Police resulted in the arrest of a 38-year-old administrator of XSS, a Russian-language cybercrime forum with more than 50,000 members. The action has triggered an ongoing frenzy of speculation and panic among XSS…
On the Rust Lint Workshop, I started coding on a “secret” project (Actually I hinted at the possibility during our 100 clippy lints celebration). Now that I’ve built a prototype, it’s time to spill the beans: I wrote a new lint. One might even say a new type of lint. One of the interesting things about this lint is…
Culture is increasingly mediated through algorithms. These algorithms have splintered the organization of culture, a result of states and tech companies vying for influence over mass audiences. One byproduct of this splintering is a shift from imperfect but broad cultural narratives to a proliferation of niche groups…
At WWDC 2025, Apple announced macOS 26 Tahoe. One of the new features in macOS Tahoe is a new disk image format: ASIF. Designed for use with virtual machines (its documentation lives under the Virtualization framework), ASIF takes a lot of inspiration from existing virtual disk formats. Practically, that means it’s…
Why are developers so hesitant to bring anti-cheat solutions to Linux?
I was checking the status of a FedEx order when Brave warned me that “this site has been blocked from accessing your motion sensors”. I’m struggling to understand why a website would need that access. Do I get a different experience if I drop my device? Tip my monitor over? Spin the mouse around?
libexpat is a fast streaming XML parser. Alongside libxml2, Expat is one of the most widely used software libre XML parsers written in C, specifically C99. It is cross-platform and licensed under the MIT license .
Almost one year ago now, I declared extended validation certificates dead [https://www.troyhunt.com/extended-validation-certificates-are-dead/]. The entity name had just been removed from Safari on iOS, it was about to be removed from Safari on Mojave and there were indications that Chrome would remove it
Based on a new proposal by the Belgian Minister of the Interior, EU governments could endorse the much-criticised child sexual abuse regulation (CSAR or chat control) as early as June after all. This is what internal information leaked to Pirate Party MEP and shadow rapporteur Patrick Breyer reveals
Plus general overview
This article has now been extensively corrected and modified.
Alright, I’ve got another conspiracy theory misconception to dispel. :) After reading through the Chrome Terms of Service, some people are worried that Google is trying to assert rights on ev…
Defending Mastodon from Donald Trump's social media
Violation of privacy by proxy is still violation of privacy.
Ginseng: keeping secrets in registers when you distrust the operating system Yun & Zhong et al., NDSS’19 Suppose you did go to the extreme length of establishing an unconditional root of …
