Topics /
The most popular blog posts about security & privacy on Hacker News. 8,768 posts.
You might have heard that C2PA is a technology that will miraculously save us from rampant AI forgeries, by having cameras cryptographically sign the images they capture. Hooray for cryptography !
Proposed algorithms that detect illegal images on devices can be easily fooled with imperceptible changes to images, Imperial research has found.
Three men in the United Kingdom have pleaded guilty to operating otp[.]agency , a once popular online service that helped attackers intercept the one-time passcodes (OTPs) that many websites require as a second authentication factor in addition to passwords.
Apple and Google released a joint specification that allows both iPhones and Android devices to do contact tracing on a global scale. Even though "privacy, transparency, and consent are of utmost importance", this is a game changing event that has grave consequences. We must stop Apple and Google in their tracks. Or…
An attacker installed Huntress onto their operating machine, giving us a detailed look at how they’re using AI to build workflows, searching for tools like Evilginx, and researching targets like software development companies.
On October 26, a YouTube user named crimewriter95 posted a full-length version of Pulp Fiction, rearranged in chronological order. A couple things struck me about this video. First, I’m surprised that a full-length, 2.5-hour very slight remix of a popular film can survive on YouTube for over six weeks without getting…
When I announced my Black Ops 3 integrity bypass, someone commented that my research was not impressive and I should try analyzing Denuvo instead. That kinda stuck with me, so I did what everyone would do and spent the last 5 months of my free time reverse engineering and bypassing the Denuvo DRM in Hogwarts Legacy. I…
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
I’m here to warn you about the dangers of front-end user tracking. Not because Google is tracking you, but because it doesn’t track you quite well enough.
Every Bitcoin address is based on a secret key, from which the public key (associated to a Bitcoin address) is calculated. Once you have the private key for an address, you have the control of that address and can use it to transfer funds.
If you publicly host large data files on AWS S3 & pay for transfer costs, you may be vulnerable to a “Denial of Wallet” amplification…
Insights from Googlers into our products, technology, and the Google culture
ESET's discovery of the first UEFI bootkit designed for Linux sendss an important message: UEFI bootkits are no longer confined to Windows systems alone.
Starting 2027, Google will block apps on Android devices whose developers have not registered with Google, paid, and given their ID. It’s fair to say that Google is becoming Apple: Your device, their rules.
Before we released the new Proton Mail, security experts conducted an independent audit of its open source code. You can read their report.
Get root on macOS 13.0.1 with CVE-2022-46689 (macOS equivalent of the Dirty Cow bug), using the testcase extracted from Apple’s XNU source.
Over the weekend, I did a lot of swiping right. I’ve never had a Tinder go this fast from match to agreeing on a date time this fast…
GitHub’s supply chain security features are now available for Go modules, which will help the Go community discover, report & prevent vulnerabilities.
An article on implementing OAuth user registration for a newsletter on a statically generated site using Cloudflare workers.
Fraudsters redirected email and web traffic destined for several cryptocurrency trading platforms over the past week. The attacks were facilitated by scams targeting employees at GoDaddy , the world’s largest domain name registrar, KrebsOnSecurity has learned.
After frontier AI systems came up empty, AISLE surfaced six CVEs in curl, one of the world's most audited codebases. Its maintainers patched all six.
The Qubes OS project has been around for nearly 8 years now, since its original announcement back in April 2010 (and the actual origin date can be traced back to November 11th, 2009, when an initial email introducing this project was sent within ITL internally). Over these years Qubes h...
Supacharging Supabase Auth with Sign in with Apple on iOS, Single-Sign-On support with SAML 2.0, and PKCE for server-side rendering and mobile auth.
Matrix, the open protocol for secure decentralised communications
TL;DR New update for Kamerka allows to map Industrial Control Systems of whole country. As in previous version, interactive map is created…
The story you are reading is a series of scoops nestled inside a far more urgent Internet-wide security advisory. The vulnerability at issue has been exploited for months already, and it’s time for a broader awareness of the threat. The short version is that everything you thought you knew about the security of the…
