3331
Dumping Lego NXT firmware off of an existing brick (2025)
Catgirls can have little a RCE, as a treat
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,768 posts.
3332
A surprisingly simple way to foil car thieves
Skyrocketing vehicle theft rates in some U.S. cities have drawn attention to an inconvenient truth: the increasing amount of technology in our vehicles can make them increasingly vulnerable to hacking or theft.
3333
Evaluation of five password managers
With an interactive grid to help you pick one!
3334
EU Chat Control Bill Postponed
The EU Regulation to Prevent and Combat Child Sexual Abuse, first published in May 2022, has become the "most criticized law of all time". Here's how to stop it now!
3335
‘Jackpotting’ Attacks Hit U.S. ATMs
ATM “ jackpotting ” — a sophisticated crime in which thieves install malicious software and/or hardware at ATMs that forces the machines to spit out huge volumes of cash on demand — has long been a threat for banks in Europe and Asia, yet these attacks somehow have eluded U.S. ATM operators. But all that changed this…
3336
Reading the Silk Road configuration
Many of us believe it wasn't the FBI who discovered the hidden Silk Road server, but the NSA (or other intelligence organization). We believ...
3337
Bypassing GitHub Actions policies in the dumbest way possible
TL;DR : GitHub Actions provides a policy mechanism for limiting the kinds of actions and reusable workflows that can be used within a repository, organization, or entire enterprise. Unfortunately, this mechanism is trivial to bypass . GitHub has told me that they don’t consider this a security issue (I disagree), so…
3338
Notifying administrators about unhashed password storage
Google’s policy is to store your passwords with cryptographic hashes that mask those passwords to ensure their security. However, we recently notified a subset of our enterprise G Suite customers that some passwords were stored in our encrypted internal systems unhashed. This is a G Suite issue that affects business…
3339
3340
3341
Arbitrary code execution in QubesOS via copy-to-VM error reporting backchannel
We have published Qubes Security Bulletin (QSB) 118: Dom0 arbitrary code execution in qvm-copy-to-vm error reporting. The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of this announcement and authentication instru...
3342
3343
Discovering a security vulnerability in a major grocery delivery platform
We felt more like “Oh fuck, Databreach” Dieser Artikel ist auch auf deutsch erschienen. During the pandemic, grocery delivery services gained popularity. New players on the market offer delivery in under an hour. One of them is Gorillas, which not only delivers apples and granola bars in 10 minutes, but just as…
3344
Does Cloudflare’s 1.1.1.1 DNS Block Archive.is? (2019)
Short answer: no. Quite the opposite, actually — Archive.is is intentionally blocking 1.1.1.1 users. Here's why.
3345
Timeshare owner? The Mexican drug cartels want you
The FBI is warning timeshare owners to be wary of a prevalent telemarketing scam involving a violent Mexican drug cartel that tries to trick people into believing someone wants to buy their property. This is the story of a couple who recently lost more than $50,000 to an ongoing timeshare scam that spans at least two…
3346
Personal Statement of a CIA Analyst
A former CIA analyst describes her polygraph experiences with the CIA and as a contractor working for the National Reconnaissance Office (NRO), FBI, and Defense Intelligence Agency (DIA).
3347
VRchat bans mods, embraces EAC
In VRChat 2022.2.2, we’re introducing two major improvements to the security of VRChat — Easy Anti-Cheat and Secure Instances.
3348
Digital Sovereignty Becomes an Imperative as the US Reads Dutch Emails
The US House reading Dutch emails shows digital sovereignty is about who can access data, not just where it is stored.
3349
Going Through Snowden Documents, Part 1
We are building a comprehensive archive and analysis project examining published documents leaked by Edward Snowden. Our methodology involves systematically reviewing each available document with particular attention to small details and information that has received little or no public attention since the initial…
3350
Abuses show Assange case was never about law
It is astonishing how often one still hears well-informed, otherwise reasonable people say about Julian Assange: “But he ran away from Swedish rape charges by hiding in Ecuador’s embassy in London.” That short sentence includes at least three factual errors. In fact, to repeat it, as so many people do, you would
3351
The Iran Firewall: A preliminary report
The Internet is easily censored. The neo-liberal's got their arses kicked. The big players like Google/Apple/AWS are partly to blame. China runs the GFI.
3352
Santa Claus Confirms NSA Attack on Naughty or Nice Database
A press conference was organised this morning on behalf of Mr Santa Claus. At the conference, a spokes–elf confirmed that there had been repeated attempts to hack the “naughty or nice (NON)” database. The NON-database was thought to be used by Mr Claus to keep records of young inhabitants of planet earth, in order to…
3353
How to Launch a 65Gbps DDoS, and How to Stop One
Yesterday I posted a post mortem on an outage we had Saturday. The outage was caused when we applied an overly aggressive rate limit to traffic on our network while battling a determined DDoS attacker.
3354
Sleepwalking into censorship
The essential detail is that they will assume you want filters enabled across a wide range of content, and unless you un-tick the option, network filters will be enabled.
3355
A brief history of code signing at Mozilla
Shipping large software to end-user devices is a complicated process. Shipping large software securely to end-user devices is even more complicated. Signing the things that ship to end-user devices is
3356
Launching Our Crowdfunding Campaign
Today we kicked off our first crowdfunding campaign with the goal of raising enough funds to cover about one month of our operations - $200,000. That amount covers the operational and engineering staff, the hardware and the software, and general operating expenses needed to securely and reliably issue and manage many…
3357
Grindr and OKCupid Sell Your Data, but Twitter’s MoPub Is the Real Problem
On January 15, a Norweigian Consumer Council (NCC) investigative report exposed the ways that Grindr, OKCupid, and eight other apps are collecting and sharing extremely sensitive personal data. Grindr in particular was sharing users’ age and location tied to a device ID that would allow trackers to...
3358
Google bug bounty for security exploit that influences search results
Short version: For the $12 cost of a domain, I was able to rank in Google search results against Amazon, Walmart etc. for high value money terms in the US. The…
3359
3360
Intro to SDR and RF Signal Analysis
A beginner's introduction to Software Defined Radio (SDR) and RF signal analysis, covering theory, tools, and visual signal characteristics.