541
Privatizing our digital identities
Trying to make the case for permanent irrevocable digital identities, which unfortunately today, by de-facto, are email addresses.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 617 posts.
542
Re-Victimization from Police-Auctioned Cell Phones
Countless smartphones seized in arrests and searches by police forces across the United States are being auctioned online without first having the data on them erased, a practice that can lead to crime victims being re-victimized, a new study found. In response, the largest online marketplace for items seized in U.S…
543
Bounty to Recover NIST's Elliptic Curve Seeds
This is a fun challenge: The NIST elliptic curves that power much of modern cryptography were generated in the late ’90s by hashing seeds provided by the NSA. How were the seeds generated? Rumor has it that they are in turn hashes of English sentences, but the person who picked them, Dr. Jerry Solinas, passed away in…
544
Reverse Engineering the Apple Multipeer Connectivity Framework (2022)
Some time ago I was using Logic Pro to record some of my music and I needed a way to start and stop the recording from an iPhone, so I found about Logic Remote…
545
Python 3.12.0 from a supply chain security perspective
This critical role would not be possible without funding from the OpenSSF Alpha-Omega Project. Massive thank-you to Alpha-Omega for investing in the security of the Python ecosystem! Python ...
546
547
548
EU member states still cannot agree about end-to-end encryption
Recently, Wired reported on documents leaked in May from the Council of the European Union’s ongoing deliberations over the draft Child Sex Abuse Regulation. The proposal is controversial because, as presently written, it would require online service providers to proactively scan their services – including users’…
549
A novel PayPal scam
This morning I received an interesting scam email. It might not be a new scam, but it was the first time I’d seen it.
550
Ubuntu Pro Shenanigans
10/18/2026: Drive Specifications Matter (Complete) 10/09/2026: Gear Review: XTEINK X4 Pro 10/09/2026: Gear Review: OLYVUE V78 Dash Cam 10/01/2026: UNREDACTED Magazine Issue 013 09/21/2026: Updated OSINT Scripts 09/20/2026: New Socials 08/29/2026: Blog Archive 08/20/2026: Free PDF Self-Publishing Guide 08/19/2026: OS…
551
552
553
macOS 14 Sonoma firewall bug fixed
The firewall bug in macOS 14 Sonoma betas and release candidates that we blogged about last week has been fixed by Apple.
554
How my brother's iCloud account was stolen
My brother got his iPhone stolen at gunpoint. This is the story of how he lost control of his iCloud account first (along with years of priceless memories, including my nephew's first steps) and how this couldn't have happened without Apple's incompetent support.
555
Rust Cryptography Should Be Written in Rust
Rust should be improved to provide the necessary building blocks that are needed to write cryptography code that is free from timing side channels and similar hazards. These facilities should not be restricted to code within Rust -provided or -endorsed libraries; anybody should be able to use them to publish a crate…
556
557
Calling time on DNSSEC: The costs exceed the benefits
I’m calling time on DNSSEC. Last week, prompted by a change in my DNS hosting setup, I began removing it from the few personal zones I had signed. Then this Monday the .nz ccTLD experienced a multi-day availability incident triggered by the annual DNSSEC key rotation process. This incident broke several of my unsigned…
558
Reversing 'France Identité': The New French Digital ID
-------------- Update from 06/10/2023 : following my publication, I’ve been in contact with France Identité CISO and they could provide mo...
559
Messaging layer security: Secure and usable end-to-end encryption
The IETF has approved publication of Messaging Layer Security (MLS), a new standard for end-to-end security that will make it easy for apps to provide the highest level of security to their users. End-to-end encryption is an increasingly important security feature in Internet applications. It keeps users’ information…
560
What is the point of a public key fingerprint?
What is the point of a public key fingerprint? What does it do that the public key itself doesn't do. This post explains.
561
How secure is merely discarding (TRIMing) all of a SSD's blocks?
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
562
563
UK Online Safety Bill threatens encryption, secure communication, and reporting
Does the image above, depicting the rescue of a child who attempted to reach the U.K. by sea, present the act of immigration in “a positive light”? It’s an absurd question, of course. It’s journalism – an effort to convey in visual terms the stark truth that tens of thousands of migrants and asylum-seekers try to…
564
Google's response to Reptar CPU vulnerability
Just as Vulnerability Research is an important area of focus at Google, so is Vulnerability Response to critical and complex vulnerabilities. Vulnerability Response at Google not only helps secure Google’s products and users, but in certain cases, it affects millions of devices across the Internet. In this post, we'll…
565
PyPI Requires 2FA for New User Registrations
PyPI requires new users to enable 2FA before performing management actions.
566
What Transport for London can learn about us from our mobile data
Big Brother meets Big Data
567
A gentle introduction to static analyzers for C
One of the great thing about C are the many fairly mature tools in the ecosystem. The bad news however is that most educational materials don't teach them and thus many beginners (and sometimes even experienced) developers have absolutely no awareness that these tools even exists.
568
Smashing the state machine: the true potential of web race conditions
For too long, web race condition attacks have focused on a tiny handful of scenarios. Their true potential has been masked thanks to tricky workflows, missing tooling, and simple network jitter hiding
569
Enigma Crypto Transmission from KPH at 426 KHz and Shortwave
DA was a part of our KPH project from the beginning. She learned her trade at US Coast Guard master station NMC, adjacent to KPH. At NMC she earned the coveted gold lightning bolt radnoman’s insignia (there was no such thing as a radiowoman in the Coast Guard). She also acquired the salty vocabulary she needed to hold…
570
The quest for a family-friendly password manager
Personal blog of Julien (jvoisin) Voisin