Topics /
The most popular blog posts about security & privacy on Hacker News. 717 posts.
Let’s Encrypt is committed to a post-quantum-safe Web PKI. The path we’re planning to take is Merkle Tree Certificates (“MTCs”), a new approach that adds post-quantum authentication to the web without sacrificing the speed and reliability that have made TLS universal. This post is about these plans and why we believe…
The actual queries I run when I'm hunting fraud in transaction data. Velocity, impossible distances, suspicious amounts, merchant clusters, off-hours buys, and window functions.
I decided to get evaluated for ADHD. Curiousity struck, and I had the bright idea to capture the page source and any outbound requests.
Monero does not use a simple fixed hash like Bitcoin. Its proof of work, RandomX, turns mining into running random CPU-friendly programs over a large memory dataset, which is why it behaves so differently from ASIC-first systems.
Turning "cat readme.txt" into arbitrary code execution in iTerm2.
A lot of “capture-the-flag” style ML puzzles give you a black box neural net, and your job is to figure out what it does. When we were thinking of creating o...
This post is intended to dispell the mistaken belief that IPv4 is more secure than IPv6 because it includes a NAT which must be configured to allow inbound traffic.
Last week, the government announced that Canada has signed the United Nations Convention against Cybercrime, with Ministers Anita Anand, Gary Anandasangaree and Sean Fraser touting the treaty’s child protection provisions and human rights safeguards, which were described as “among the strongest found in an…
How I found that anyone could register on FIFA's public Agent Platform, gain access to the Football Data Platform's Streaming Management panel, and get RTMP ingest URLs and stream keys for every live FIFA World Cup 2026 camera feed. I then spent hours calling FIFA, MediaKind, HBS, CISA, and the FBI trying to get…
USA and their friends in the surveillance alliance Fourteen Eyes have demonstrated that they have the capacity, the desire and the experience to monitor who they want, when they want, anywhere in the world.
consumer-grade hardware can run an LLM that hacks the planet. we can stop it, but we don't have much time.
We need to have a hard look at the surveillance industry. It is a key enabler of vast and untold violations of human rights and civil liberties, and it continues to be used by aspiring autocrats to threaten our very democracy. As long as it exists, the surveillance industry, and the data it generates, will be an…
While exploring the file system on a jailbroken iPhone 6s, I stumbled upon an interesting folder:
Recently, multiple organisations have disclosed how clusters of so-called “rogue” AI agents attempted to break into websites and online services, sometimes successfully. Agents from OpenAI’s enviro…
How bots used our sign-up and forgot password pages to bomb real people's inboxes, and what we did to stop it. A practical guide to subscription bombing for founders and developers who think CAPTCHA is an "I'll do it later" task.
There is no need to update symmetric key sizes as part of the post-quantum transition, due to the details of how Grover's algorithm scales. Most authorities agree.
Atlassian AI ‘Rovo’ is susceptible to zero-click data exfiltration via indirect prompt injection, bypassing organization-level web search controls.
A continuously updating analysis of bot vs. human traffic, AI training, fetching, search indexing, browsing, robots.txt compliance, and AI chat referrals across 5,000+ websites.
The perils of logging in
The Glassworm supply chain attack is back. Researchers uncovered malware hidden in invisible Unicode characters across 150+ GitHub repositories, plus npm packages and VS Code extensions.
The vulnerability has been fixed as of July 7, 2026, but the exploit was simple, and hidden email addresses may still be in third-party logs.
Today, I loaded the 1,000th data breach into Have I Been Pwned. Reflecting on that milestone number, I pondered how to mark the occasion in writing, and what immediately came to mind was a very simple question: why is it still needed? Especially considering the emergence of privacy regulations
Why I stopped trying to give LLM agents a better memory and instead built Lemmalog, a Datalog engine that maintains an agent's knowledge as analysis state, with provenance, retractions and incremental evaluation, plus what happened when I benchmarked it on LongMemEval and LoCoMo.
I was happy for years in Apple’s walled garden; with AI, however, their protections feel like limitations.
The bipartisan legislation creates a federal cause of action against government officials who coerce or attempt to coerce broadcasters, interactive computer services, or AI providers into taking actions against lawful, First-Amendment-protected speech, and establishes a transparency system for government…
The online advertising industry has built a massive surveillance machine, and the government can co-opt it to spy on us.
First, a PSA: Do NOT use Omarchy if you care about security of your machine even a little bit. You can't polish a turd Omarchy 4.0 shipped with a collec...
Oura users' data is not end-to-end encrypted and can be handed to the government. Will the wearable tech maker say how often it turns over data?
Nyxgeek here. It's 2026 and I've got two more Azure Entra ID sign-in log bypasses to share with you. Don't get too excited…these bypasses were recently fixed, but I think it's important that people know.
