1
Why I’m done with Chrome
This blog is mainly reserved for cryptography, and I try to avoid filling it with random “someone is wrong on the Internet” posts. After all, that’s what Twitter is for! But from …
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 240 posts.
2
Intel Publishes Microcode Patches, No Benchmarking or Comparison Allowed
UPDATE: Intel has resolved their microcode licensing issue which I complained about in this blog post. The new license text is here .
3
4
LocationSmart Leaked Location Data for All Major U.S. Carriers in Real Time
On May 16th, I found a vulnerability in the LocationSmart website which allowed anyone, with no prior authentication or consent, to obtain the realtime location of any cellphone in the US to within…
5
Hijack of Amazon’s domain service used to reroute web traffic for two hours
Between 11am until 1pm UTC today, DNS traffic — the phone book of the internet, routing you to your favourite websites — was hijacked by an…
6
The dots do matter: how to scam a Gmail user
Gmail's "dots don't matter" feature lets scammers create an account on, say, Netflix, with your email address but different dots. Results in convincing phishing emails.
7
8
GDPR: Don't Panic
In another week the GDPR , or the General Data Protection Regulation will become enforceable and it appears that unlike any other law to date this particular one has the interesting side effect of causing mass hysteria in the otherwise rational tech sector.
9
"Pwned Passwords" V2 With Half a Billion Passwords
Last August, I launched a little feature within Have I Been Pwned [https://haveibeenpwned.com/] (HIBP) I called Pwned Passwords [https://www.troyhunt.com/introducing-306-million-freely-downloadable-pwned-passwords/]. This was a list of 320 million passwords from a range of different data breaches which organisations…
10
Google: Security Keys Neutralized Employee Phishing
Google has not had any of its 85,000+ employees successfully phished on their work-related accounts since early 2017, when it began requiring all employees to use physical Security Keys in place of passwords and one-time codes, the company told KrebsOnSecurity.
11
12
13
Sandboxed Mac apps can record screen any time without you knowing
I work with U.S. law firms as a non-testifying technical consulting expert on matters involving the Apple platform and iOS apps. Learn more about my litigation consulting.
14
We're Baking ‘Have I Been Pwned’ into Firefox and 1Password
Pretty much every day, I get a reminder from someone about how little people know about their exposure in data breaches. Often, it's after someone has searched Have I Been Pwned [https://haveibeenpwned.com/] (HIBP) and found themselves pwned somewhere or other. Frequently, it's some long-forgotten site
15
Am I logged in or not? GDPR case study on the example of Chrome browser change
It is surprisingly difficult to find realistic, interesting and creative privacy case studies. It is perhaps even more difficult in the case of major software. There are no proper motivations for making this kind of work public (employees often paid to do some kind of work in-house; their compensation
16
Publishers Haven't Realized How Big a Deal GDPR Is
Baekdal is your premium site for media reports and trend analysis. Subscribe from €7.55/month
17
18
19
I put all my personal data on eBay
And almost made lots of money
20
The Effectiveness of Publicly Shaming Bad Security
Here's how it normally plays out: It all begins when a company pops up online and makes some sort of ludicrous statement related to their security posture, often as part of a discussion on a public social media platform such as Twitter. Shortly thereafter, the masses descend on said
21
Zero-Width Characters: Invisibly fingerprinting text
In early 2016 I realized that it was possible to use zero-width characters, like zero-width non-joiner or other zero-width characters like the zero-width space to fingerprint text. Even with just a single type of zero-width character the presence or non-presence of the non-visible character is enough bits to…
22
Serious Intel CPU bugs (2016)
2015 was a pretty good year for Intel. Their quarterly earnings reports exceeded expectations every quarter. They continue to be the only game in town for the serious server market, which continues to grow exponentially; from the earnings reports of the two largest cloud vendors, we can see that AWS and Azure grew by…
23
24
Scammers are changing the contact details for banks on Google Maps
A new type of banking scam involving fake business listings is taking over Google [3 min read]
25
Windows 7 patch for Meltdown enabled arbitrary reads and writes in kernel memory
Did you think Meltdown was bad? Unprivileged applications being able to read kernel memory at speeds possibly as high as megabytes per seco...
26
Don't give away historic details about yourself
Social media sites are littered with seemingly innocuous little quizzes, games and surveys urging people to reminisce about specific topics, such as “What was your first job,” or “What was your first car?” The problem with participating in these informal surveys is that in doing so you may be inadvertently giving away…
27
28
Meltdown and Spectre Linux kernel status
By now, everyone knows that something “big” just got announced regarding computer security. Heck, when the Daily Mail does a report on it …
29
30