1
Claude Code is steganographically marking requests
I inspected Claude Code for privacy reasons and found hidden system prompt markers based on API base URL and timezone.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 356 posts.
2
The newest Instagram “exploit” is the goofiest I've seen
Yesterday, a slew of Instagram accounts, including some high profile ones like the Obama White House account, seemingly got hacked.
3
Google Chrome silently installs a 4 GB AI model on your device without consent
Google Chrome is downloading a 4 GB Gemini Nano model onto users' machines without consent, with no opt-in, no opt-out short of enterprise tooling, and an automatic re-download every time the user deletes it. The pattern is identical to the Anthropic Claude Desktop case I wrote about last month, but the scale is…
4
Aaron Swartz was prosecuted for scraping, while Meta does it without consequence
Also here's a cool unrelated photo of a chipmunk because I need some chill
5
EU Parliament greenlights Chat Control 1.0
Today, the European Parliament allowed the suspicionless mass scanning of private communications ("Chat Control 1.0") to pass, a measure it had rejected twice in March. Although a majority of voting Members of the European Parliament (MEPs) actually opposed the regulation (314 against, 276 in favor,
6
A backdoor in a LinkedIn job offer
A fake recruiter, a crypto repo, and a remote code execution payload hidden in a test file.
7
Why is this fingerprinting script creating bioweapons?
I've always had a fascination with reverse-engineering browser fingerprinting scripts. Most of my time has been spent looking at the usual suspects (popular fingerprinting libraries like FingerprintJS and more sophisticated scripts used by anti-bots like Cloudflare Turnstile, Akamai, and others).
8
Decoding the obfuscated bash script on a Uniqlo t-shirt
IP, technology & commercial law
9
10
AI agent bankrupted their operator while trying to scan DN42
An AI agent tried to join the DN42 hobbyist network to perform a network scan, and bankrupted its operator with a $6531.30 AWS bill, to the extent that they are begging for donations from the DN42 community.
11
The Claude Code Source Leak: fake tools, frustration regexes, undercover mode
Anthropic accidentally shipped a source map in their npm package, exposing the full Claude Code source. Here's what I found inside.
12
Apple's git still trusts the compromised eMudhra certificates
Eleven days after Apple was notified of the eMudhra CA compromise, the git, curl and python3 that Apple ships with macOS still trust the compromised certificates.
13
GrapheneOS – Break Free from Google and Apple
🇬🇧->🇵🇱 Przejdź do polskiej wersji tego wpisu / Go to polish version of this post
14
The 'papers, please' era of the internet will decimate your privacy
Americans, be warned: Age verification is identity verification.
15
Passkeys are a trap
Intended audience: non-technical citizens of the web
16
AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint
Recently I ran into a strange problem with my Bluetooth headphones. They support multipoint Bluetooth audio, so they can be connected to my ...
17
18
Age verification is just a precursor to automated attribution of speech
Lots of US states, European countries, and Australia have introduced "age verification" regulations. They present it as the classic "save the children" talking ...
19
Android may soon restrict on-device ADB
Changes proposed for ADB could kill an entire ecosystem of open-source power-user apps, mobile developer setups, and rootless privacy tools based on Shizuku.
20
Bill C-22, the Lawful Access Act: Dangerous backdoor surveillance risks remain
The decades-long battle over lawful access entered a new phase yesterday with the introduction of Bill C-22, the Lawful Access Act. This bill follows the attempt last spring to bury lawful access provisions in Bill C-2, a border measures bill that was the new government’s first piece of substantive legislation. The…
21
I found 10k GitHub repositories distributing Trojan malware
This is the story of how I found 10,000 repositories on GitHub that distribute Trojan malware. They are all from different contributors, have different names, and are not forks of other repositories. But they share a common pattern, which is what allowed me to write a script to find
22
ChatGPT won't let you type until Cloudflare reads your React state
Edit April 2, 2026: I've been getting inbound interest from researchers wanting to run their own queries. The MCP integration I use for my own research lets you analyze live mobile telemetry continuously collected from real devices in the wild, directly from Claude. To access it reach out at
23
I'm reluctant to verify my identity or age for any online services
Identity verification and age verification is an increasinly common policy conversation at the moment, in numerous countries.
24
25 years of mass surveillance is enough
This essay was written with Cindy Cohn, and originally appeared in Lawfare. One of the many legacies of the terrorist attacks of Sept. 11 is the government-wide shift from targeted surveillance—such as individual wiretaps or pen register/trap and trace orders—to mass surveillance techniques—such as tapping into the…
25
Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds
One of eMudhra's certificate authority private keys is the number 4. Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just, 4... Another one is 56, and another is 115. I know, because I recovered all of them from their
26
Jailbreaking my car's navigation system just so I can change the time
I shouldn't have to be doing any of this, but at least it's fun.
27
What we call "age verification" is actually mass surveillance
The literature on harms to kids from online platforms is complex and nuanced, rife with people citing small, ambiguous studies as iron-clad evidence that kids are being destroyed by the internet:
28
Amazon's Ring and Google's Nest reveal the severity of U.S. surveillance state
Just a decade after a global backlash was triggered by Snowden reporting on mass domestic surveillance, the state-corporate dragnet is stronger and more invasive than ever.
29
I found a vulnerability. they found a lawyer
What happens when you responsibly disclose a critical vulnerability exposing personal data - including that of minors - and the organization responds with legal threats instead of a thank you?
30
Noise infusion banned from statistical products published by Census Bureau
Sadly, taking away valuable disclosure avoidance tools doesn't make fundamental trade-offs go away.