Topics /
The most popular blog posts about security & privacy on Hacker News. 679 posts.
On December 30th, while most of us were preparing for a New Year’s Eve celebration, the US Treasury was prepping a notice to lawmakers to notify them that their systems, which (obviously) contain highly sensitive, confidential data, had been compromised.
On August 21, 2025, an influx of traffic directed toward clients hosted in AWS us-east-1 caused severe congestion on links between Cloudflare and us-east-1. In this post, we explain what the failure was, why it occurred, and what we’re doing to make sure this doesn’t happen again.
1 Prologue A while ago, I took a flight from Canada back to Hong Kong - about 12 hours in total with Air Canada. Interestingly, the plane actually had WiFi: However, the WiFi had restrictions. For Aeroplan members who hadn’t paid, it only offered Free Texting, meaning you could only use messaging apps like WhatsApp…
A journey in packet filtering
Shutting down a communications platform or forcing its reorganization based on concerns of foreign propaganda and anti-national manipulation is an eminently anti-democratic tactic, one that the US has previously condemned globally.
A sustained, coordinated social media harassment and doxxing campaign – which we codenamed JUICYJAM – targeting the pro-democracy movement in Thailand has run uninterrupted, and unchallenged, since at least August 2020. Through our analysis of public social media posts we determined that the campaign was not only…
Flock's 'licence plate readers' read much more than license plates. A judge says what they record must be released.
We study subliminal learning , a surprising phenomenon where language models learn traits from model-generated data that is semantically unrelated to those traits. For example, a "student" model learns to prefer owls when trained on sequences of numbers generated by a "teacher" model that prefers owls. This same…
Big Brother Watch and other human rights, civil liberties, digital rights, and racial justice organisations have written to the Prime Minister urging him to abandon plans for a mandatory digital ID. The letter comes just days before an expected statement from Keir Starmer announcing the rollout of a mandatory digital…
I learn about cryptographic vulnerabilities all the time, and they generally fill me with some combination of jealousy (“oh, why didn’t I think of that”) or else they impress me w…
In which I attempt to be pragmatic. Are you allowed to run whatever computer program you want on the hardware you own? This is a question where freedom, practicality, and reality all collide into a mess. Google has recently announced that Android users will only be able to install apps which have been digitally signed…
I recently spun up a .onion mirror of this website.
Behind the scenes blog of pretix, your friendly ticketing system from next door.
New research: Eight popular, commercial VPN apps operate deceptively and put more than 700 million users at risk of authoritarian surveillance.
We Put Agentic AI Browsers to the Test - They Clicked, They Paid, They Failed
Source I find myself in the unusual position of defending Bitcoin from its critics, if only reluctantly. In 2024 Soroush Farokhnia & Amir...
GitHub Archive logs every public commit, even the ones developers try to delete. Force pushes often cover up mistakes like leaked credentials by rewriting Git history. GitHub keeps these dangling commits, from what we can tell, forever. In the archive, they show up as “zero-commit” PushEvents.
The first global index tracking real-time prices for buying fake account verifications on 500+ online platforms in every country has been launched by a team at the University of Cambridge.
Overconfident developers that choose to write their own cryptography code have plagued the information security industry since before it was even an industry. This in and of itself isn’t inhe…
Some places say 255 bytes. They are wrong . Within a TXT record there are multiple character-strings (RFC 1035 section 3.3.14 ) and those are limited in length (because a single byte is used for their length), however there can be many of them.
The U.S. government today imposed economic sanctions on Funnull Technology Inc. , a Philippines-based company that provides computer infrastructure for hundreds of thousands of websites involved in virtual currency investment scams known as “ pig butchering .” In January 2025, KrebsOnSecurity detailed how Funnull was…
This blog post describes how electronic passports work, the threats within their threat model, and how they protect against those threats using cryptography. It also discusses the implications of using electronic passports for novel applications, such as zero-knowledge identity proofs.
Introducing oniux: Kernel-level Tor isolation for any Linux app. This torsocks alternative uses namespaces to isolate Linux applications over the Tor network and eliminate data leaks.
Using advanced AI to fix critical software vulnerabilities
SSL requirements are quickly becoming obnoxious.
Matrix, the open protocol for secure decentralised communications
As Cory Doctorow once said "Any time that someone puts a lock on something that belongs to you but won't give you the key, that lock's not there for you." But here's the thing with the LCP DRM scheme; they do give you the key! As I've written about previously, LCP mostly relies on the user entering their password (the…
Update: January 15, 2026 Six-day and IP address certificates are now generally available. See 6-day and IP Address Certificates are Generally Available for details. This year we will continue to pursue our commitment to improving the security of the Web PKI by introducing the option to get certificates with six-day…
In this post I discuss request smuggling, the recent vulnerability in ASP.NET Core with a severity score of 9.9, and how attackers could exploit it
