4771
Against DNSSEC
10 years later and still unrebutted: DNSSEC is pageantry, it's not security, which is why so few security teams deploy it.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,768 posts.
4772
TLS certificates for internal services done right
No self-signing headaches, no TLS erros.
4773
4774
Finding Pwned Passwords with 1Password
1Password integrates with Pwned Passwords, a feature of Have I Been Pwned that allows you to check if your passwords have been leaked on the Internet.
4775
4776
So you want to roll your own crypto?
A coworker of mine asked: How are people supposed to learn (from mistakes) if they don't roll their own crypto? The short answer is do roll ...
4777
4778
Nextdoor's Heisensubscribe (and Other Dark Patterns)
Nextdoor's notification settings are hostile. This is not an isolated incident.
4779
Extended Validation Certificates Are Dead
That's it - I'm calling it - extended validation certificates are dead. Sure, you can still buy them (and there are companies out there that would just love to sell them to you!), but their usefulness has now descended from "barely there" to "as good as non-existent". This change
4780
No general method to detect fraud
The parts of a convincing deception
4781
Fake VS Code Extension on NPM Spreads Multi-Stage Malware
The Mend research team uncovered a fake VS-code extension—truffelvscode—typosquatting the popular truffle for VS-code extension. Read the post for more details.
4782
Two-factor paper passwords
I guess it makes me boring but I try to get people to use stronger passwords. People love to use the same password over and over again, o...
4783
Remotely unlocking an encrypted hard disk
what's a few systemd services in initramfs between friends?
4784
Counter-Strike Global Offsets: reliable remote code execution
One of the factors contributing to Counter-Strike Global Offensive’s (herein “CS:GO”) massive popularity is the ability for anyone to host their own community server. These community servers are free to download and install and allow for a high grade of customization. Server administrators can create and utilize…
4785
Give Me the Green Light Part 1: Hacking Traffic Control Systems
Adventures in Responsible Disclosure
4786
What's next for Tor and privacy online?
Ten years ago, Edward Snowden shared documents with the press that exposed the extent of the U.S. government’s mass surveillance program – and used Tor to protect himself while doing so. How has the perception of privacy changed since then, and what are the Tor Project’s challenges for the year to come?
4787
TP240PhoneHome Reflection/Amplification DDoS Attack Vector
A new reflection/amplification distributed denial of service (DDoS) vector with a record-breaking potential amplification ratio of 4,294,967,296:1 has been abused by attackers in the wild to launch multiple high-impact DDoS attacks.
4788
Secret scanning is now available for free on public repositories
Previously, only organizations with GitHub Advanced Security could enable secret scanning's user experience on their repositories. Now, any admin of a public repository on GitHub.com can detect leaked secrets in…
4789
Gmail E2E is as terrible as expected
Recently, Google introduced E2E encryption in Gmail. It went bad.
4790
Getting debug access on a Brother printer over Telnet
As it turns out, the Brother NC-8700w Command Console is more interesting than it first appears.
4791
California agency blocks release of police use of force, surveillance training
Under a California law that went into effect on January 1, 2020, all law enforcement training materials must be “conspicuously” published on the California Commission on Peace Officer Standards and Training (POST) website. However, if you visit POST’s Open Data hub and try to download the officer...
4792
RTFM 0day in iOS apps
DIN INFO IP Adresse ( IPv4 eller IPv6) 104.165.132.197 Port: 47376 Hostnavn: 104.165.132.197 X-Forward IP Adresse(r): Browser (UserAgent): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Forespørgsels Timestamp (Unix tid): 1793882617 Forespørgsels…
4793
Multiple Russian Threat Actors Targeting Microsoft Device Code Authentication
Starting in mid-January 2025, Volexity identified several social-engineering and spear-phishing campaigns by Russian threat actors aimed at compromising Microsoft 365 (M365) accounts. These attack campaigns were highly targeted and carried out in a variety of ways. The majority of these attacks originated via…
4794
Sealed Rust: A plan to bring Rust to safety critical software domains
Part 1 - The Pitch
4795
How I could delete any video on YouTube
About Vulnerability Research Grants and a little story how I could delete any video on YouTube.
4796
Chrome is warning users about insecure pages
First transition in Google's HTTPS-everywhere plans is done
4797
Appeals court denies judicial immunity to judge who personally searched home
FOR IMMEDIATE RELEASE: 10/30/2023 CONTACT: Phillip Suderman, psuderman@ij.org, (850) 376-4110 ARLINGTON, VA.—Today, the 4th U.S. Circuit Court of Appeals unanimously ruled in favor of Matthew Gibson […]
4798
4799
Evading Airport Security
The news is reporting about Evan Booth, who builds weaponry out of items you can buy after airport security. It’s clever stuff. It’s not new, though. People have been explaining how to evade airport security for years. Back in 2006, I—and others—explained how to print your own boarding pass and evade the photo-ID…
4800
Google Forcing Nest Cameras’ Visual Indicator Light To Be On
Google Forcing Nest Cameras Visual Indicator Light To Be On