5101
Arduino FIDO2 Authenticator
Introducing URU Card: an open-source, wallet-sized FIDO2 BLE authenticator based on ESP32, ATECC508A, OLED screen, and MPR121 touch keyboard. Join the project and start building your own secure authenticator.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,768 posts.
5102
5103
On Linux's Random Number Generation
Cutting-edge cyber security research from NCC Group. Find public reports, technical advisories, analyses, & other novel insights from our global experts.
5104
Post from "weev" (AT&T/ipad data hacker) on his arrest and treatment
A while ago, someone came to me and gave me some data involving AT&T iPad customers to publicize, the full story of which I’m sure you’re all familiar with from my previous excellent blog posts. I was subsequently raided by the FBI and arrested , though I have been under gag orders and haven’t been able to discuss the…
5105
MacOS Caches Data from Encrypted Hard Drives
apple's 'quicklook' cache, may leak encrypted data
5106
What It Takes to Defend a Cybersecurity Company from Today's Adversaries
This report highlights a rarely-discussed but crucially important attack surface: security vendors themselves.
5107
Compromising Garmin Sport Watches: A Deep Dive into GarminOS and Its MonkeyC VM
13 vulnerabilities in GarminOS and the MonkeyC VM, 9 with CVEs, that let Connect IQ apps escape the VM and bypass permissions on 100+ Garmin watches.
5108
Copy-Pasting URLs from Google Search Can Leak Previous Searches
Note: This information has been disclosed to Google appropriately, they have chosen to not fix this behavior.
5109
5110
I accidentally built a spying app
A personal story about creating new products and their unintended consequences
5111
Firefox Personal Data Promise
Tech companies are using the word “privacy” a lot these days. What do they mean when they say it? To one company, privacy means keeping your informatio
5112
Ignore 98% of dependency alerts: introducing Semgrep Supply Chain
An extensible developer-friendly application security platform that scans source code to surface true and actionable security issues with AI-assisted SAST, SCA, and Secrets Detection solutions.
5113
Playpen: The Story of the FBI’s Unprecedented and Illegal Hacking Operation
In December 2014, the FBI received a tip from a foreign law enforcement agency that a Tor Hidden Service site called “Playpen” was hosting child pornography. That tip would ultimately lead to the largest known hacking operation in U.S. law enforcement history. The Playpen investigation—driven by...
5114
Disqus Demonstrates How to Do Breach Disclosure Right
We all jumped on "the Equifax dumpster fire bandwagon" recently and pointed to all the things that went fundamentally wrong with their disclosure process. But it's equally important that we acknowledge exemplary handling of data breaches when they occur because that's behaviour that should be encouraged. Last week,
5115
5116
Little Snitch feature nobody knows about
Little Snitch by Objective Development is the first app that I install on a new Mac. In fact I just bought a new Mac, an M4 MacBook Pro with nano-texture display, and I installed Little Snitch via thumb drive even before connecting the Mac to the internet. While setting up my new Mac, which came with macOS 15.2…
5117
A Technical Perspective on the Apple iPhone Case
The legal dispute between Apple and the FBI might prove pivotal in the long-running battle to protect users' privacy and right to use uncompromised encryption. The case has captured the public imagination. Of course, EFF supports Apple's efforts to protect its users. The case is complicated...
5118
It's School time: Adventures in hacking an old Kindle
Jailbreaking an old Kindle and turning it into a school dashboard using Cloudflare Workers, Puppeteer, and image processing.
5119
Infomaniak transitions to a foundation model to protect user data privacy
Infomaniak transfers the majority of its voting rights to a Swiss public-benefit foundation. Your cloud remains sovereign, independent, and true to its values. Forever.
5120
Isaac Asimov on Security Theatre.
A great find: In his 1956 short story, “Let’s Get Together,” Isaac Asimov describes security measures proposed to counter a terrorist threat: “Consider further that this news will leak out as more and more people become involved in our countermeasures and more and more people begin to guess what we’re doing. Then…
5121
5122
CSS Based Attack fontface
In this post, I would like to share about new CSS based attack with unicode-range descriptor of @font-face rule . Using this technique, an...
5123
Docker 1.3 is out
Docker is a founding member of the Blueprint Alliance, a 12-company reference architecture for securing AI agents, built around four governance questions.
5124
Weaponizing Middleboxes for TCP Reflected Amplification
Censors pose a threat to the entire Internet.
5125
Interoperability without sacrificing privacy: Matrix and the DMA
Matrix, the open protocol for secure decentralised communications
5126
Using YouTube to steal your files
A writeup of my $4133.70 Google Drive vulnerability chain.
5127
Put an io_uring on it – Exploiting the Linux Kernel (2022)
Put an io_uring on it - Exploiting the Linux Kernel - chompie at the bits
5128
Reverse Engineering a Docker Image
This started with a consulting snafu: Government organisation A got government organisation B to develop a web application. Government organisation B subcontracted part of the work to somebody. Hosting and maintenance of the project was later contracted out to a private-sector company C. Company C discovered that the…
5129
WeChat Surveillance Explained
This document provides a summary of the Citizen Lab's WeChat surveillance research findings, as well as questions and answers from the resesearch team.
5130
TeleMessage Customers Include DC Police, Andreessen Horowitz, JP Morgan,Hundreds
💡Update May 26, 2025: I've published the source code for TeleMessage Explorer: a new open source research tool I've been digging through the 410 GB of Java heap dumps from TeleMessage's archive server, provided by DDoSecrets. Here's a description of the dataset, some of my initial