Topics /
The most popular blog posts about security & privacy on Hacker News. 300 posts.
This December, if there's one tech New Year's resolution I'd encourage you to have, it's switching to the only remaining ethical web browser, Firefox. According to recent posts on social media, Firefox's market share is slipping. We should not let that happen. There are two main reasons why switching is important…
This weekend I wanted to create a new App in Azure so I could help a local nonprofit automate one of their donor relations processes via email through Office 365. So I tried registering an app by visiting the App Registration Portal. I signed in to my personal Microsoft account, clicked 'New registration', then was…
If you remove the first word from the string "hello world" , what should the result be? This is the story of how we discovered that the answer could be your root password!
First, let’s consider three random tweets: They already have. They definitely should. They seemingly won’t… but why? We all know that Apple has nice built-in password management in macO…
Apple TV and iOS YouTube ads are not blocked by Pi-hole, so I researched this and discovered a flaw in Protobuf that allows me to restrict YouTube ads.
and grab the TSA nofly list along the way
My most popular article about Google - breakthrough in gms
In the summer of 2022, KrebsOnSecurity documented the plight of several readers who had their accounts at big-three consumer credit reporting bureau Experian hijacked after identity thieves simply re-registered the accounts using a different email address. Sixteen months later, Experian clearly has not addressed this…
Today's adventure: DIY whole hog data exfiltration
I just discovered that every copy of macOS ships with a hidden PDF of Satoshi Nakamoto's Bitcoin whitepaper. But why?
After buying a new Philips Sonicare toothbrush I was surprised to see that it reacts to the insertion of a brush head by blinking an LED. A quick online search reveals that the head communicates with the toothbrush handle to remind you when it’s time to buy a new one. From the Philips product page: seems to be REALLY…
苹果公司自诩为用户隐私的捍卫者，然而这并非事实。 在近十年的时间里，苹果允许应用程序具备跟踪用户位置的能力，而不提供关闭此功能或引起用户对此的关注的选项。 而且这是「只有苹果可以做到的」（Only Apple Can Do）！
Update on 2023/05/19: ASUS has publicly acknowledged the issue and provided an explanation and workaround of their own (rebooting, or a hard reset if the reboot doesn’t fix it). The original post is below:
TL;DR: we have discovered XMPP (Jabber) instant messaging protocol encrypted TLS connection wiretapping (Man-in-the-Middle attack) of jabber.ru (aka xmpp.ru) service’s servers on Hetzner and Linode hosting providers in Germany. The attacker has issued several new TLS certificates using Let’s Encrypt service which were…
tldr: Swing VPN is using its user base to DDOS sites using its users as a an attack botnet. Introduction It all started with a friend of mine complaining that his phone was doing a request to a specific app every few seconds. Initial assumption was that the phone was infected with a virus but a 2 minute investigation…
Reverse engineering an Android app for a Bluetooth connected car battery monitor with some startling discoveries ...
When logged into a web application, the session does not remain valid forever. Typically, the session expires after a fixed time after login, or after the user has been idle for some time. How long should these times be?
Firstyear's blog
The European Commission wants to turn digital communication apps, such as WhatsApp, iMessage, Instagram, TikTok and X, into mass surveillance tools so that digital communications of all EU citizens, including their live conversations, photos and videos, can be automatically scanned for criminal offences.[1] Even of…
A decade ago to the day, I published a tweet launching what would surely become yet another pet project that scratched an itch, was kinda useful to a few people but other than that, would shortly fade away into the same obscurity as all the other ones I'd launched
Well, it finally happened to me. I was blocked out of a website I use for work because of Cloudflare. And I have no idea if or when I'll be...
This blog post is going to be a cursory overview of the internals iMessage, as I’ve discovered during my work on pypush, an open source project that reimplements iMessage.
Explore top no verification casino sites in Australia offering instant crypto withdrawals, huge pokies libraries, and safe anonymous gambling.
This is a detective story about how a car was stolen - and how it uncovered an epidemic of high-tech car theft. It begins with a tweet. In April 2022, my friend Ian Tabor tweeted that vandals had been at his car, pulling apart the headlight and unplugging the cables.
We have a CPU mystery! We found a way to cause some processors to enter a glitch state where the normal rules don’t apply, but what does that mean…?
the one good use of copyright is prying things open
Have you ever tried to download videos from YouTube? I mean manually without relying on software like youtube-dl, yt-dlp or one of “these” websites. It’s much more complicated than you might think.
