31
The 'papers, please' era of the internet will decimate your privacy
Americans, be warned: Age verification is identity verification.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 717 posts.
32
Passkeys are a trap
Intended audience: non-technical citizens of the web
33
Today, we hacked what we'd set out to hack: the iPhone
Today, we hacked what we'd set out to hack: the iPhone.
34
GLM 5.2 beats Claude in our benchmarks
Among models given nothing but a prompt, the best open-weight option beat Claude Opus 4.8.
35
Postmortem: TanStack NPM supply-chain compromise
On 2026-05-11, an attacker chained a pull_request_target Pwn Request, GitHub Actions cache poisoning across the fork↔base trust boundary, and OIDC token extraction from runner memory to publish 84 malicious versions across 42 @tanstack/* packages on npm. Full postmortem.
36
Claude reveals ECDSA curve origins
The decades-old mystery of the origins of one of the most popular cryptographic standards has been explained.
37
AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint
Recently I ran into a strange problem with my Bluetooth headphones. They support multipoint Bluetooth audio, so they can be connected to my ...
38
39
Age verification is just a precursor to automated attribution of speech
Lots of US states, European countries, and Australia have introduced "age verification" regulations. They present it as the classic "save the children" talking ...
40
Backdoor in Claude Code for VS Code extension on the Cursor Marketplace
Phorion has detected a backdoor in the official Claude Code for VS Code extension bundle on the Cursor Marketplace that drops a persistent SSH backdoor across macOS, Linux, and Windows. This write-up …
41
Android may soon restrict on-device ADB
Changes proposed for ADB could kill an entire ecosystem of open-source power-user apps, mobile developer setups, and rootless privacy tools based on Shizuku.
42
Bill C-22, the Lawful Access Act: Dangerous backdoor surveillance risks remain
The decades-long battle over lawful access entered a new phase yesterday with the introduction of Bill C-22, the Lawful Access Act. This bill follows the attempt last spring to bury lawful access provisions in Bill C-2, a border measures bill that was the new government’s first piece of substantive legislation. The…
43
I found 10k GitHub repositories distributing Trojan malware
This is the story of how I found 10,000 repositories on GitHub that distribute Trojan malware. They are all from different contributors, have different names, and are not forks of other repositories. But they share a common pattern, which is what allowed me to write a script to find
44
ChatGPT won't let you type until Cloudflare reads your React state
Edit April 2, 2026: I've been getting inbound interest from researchers wanting to run their own queries. The MCP integration I use for my own research lets you analyze live mobile telemetry continuously collected from real devices in the wild, directly from Claude. To access it reach out at
45
I'm reluctant to verify my identity or age for any online services
Identity verification and age verification is an increasinly common policy conversation at the moment, in numerous countries.
46
25 years of mass surveillance is enough
This essay was written with Cindy Cohn, and originally appeared in Lawfare. One of the many legacies of the terrorist attacks of Sept. 11 is the government-wide shift from targeted surveillance—such as individual wiretaps or pen register/trap and trace orders—to mass surveillance techniques—such as tapping into the…
47
Virginia bans sale of precise geolocation data
On April 13, 2026, Virginia Governor Abigail Spanberger signed into law S.B. 338 , which amends the Virginia Consumer Data Protection Act (“VCDPA”) to prohibit the sale of geolocation data. Notably, the VCDPA defines “sale” more narrowly than other state comprehensive privacy laws, as “the exchange of personal data…
48
Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds
One of eMudhra's certificate authority private keys is the number 4. Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just, 4... Another one is 56, and another is 115. I know, because I recovered all of them from their
49
Jailbreaking my car's navigation system just so I can change the time
I shouldn't have to be doing any of this, but at least it's fun.
50
What we call "age verification" is actually mass surveillance
The literature on harms to kids from online platforms is complex and nuanced, rife with people citing small, ambiguous studies as iron-clad evidence that kids are being destroyed by the internet:
51
There were BGP anomalies during the Venezuela blackout
The Low Orbit Security Radar is a weekly security newsletter from an offensive practitioner's perspective. One idea, curated news, and links worth your time. News: There Were BGP Anomalies During The Venezuela Blackout When watching the situation in Venezuela unfold, the phrase "It was dark, the lights of Caracas
52
Amazon's Ring and Google's Nest reveal the severity of U.S. surveillance state
Just a decade after a global backlash was triggered by Snowden reporting on mass domestic surveillance, the state-corporate dragnet is stronger and more invasive than ever.
53
We found a stable Firefox identifier linking all your private Tor identities
We discovered a privacy vulnerability in Firefox Private Browsing and Tor Browser that allows websites to fingerprint and track users across origins using IndexedDB database ordering, even after closing all private windows.
54
Notepad++ hijacked by state-sponsored actors
Following the security disclosure published in the v8.8.9 announcement https://notepad-plus-plus.org/news/v889-released/ the investigation has continued in collaboration with external experts and with the full involvement of my (now former) shared hosting provider.
55
I found a vulnerability. they found a lawyer
What happens when you responsibly disclose a critical vulnerability exposing personal data - including that of minors - and the organization responds with legal threats instead of a thank you?
56
Chat Control 1.0 and 2.0 Explained
What is the difference between Chat Control 1.0 and Chat Control 2.0? A clear overview of both EU laws, their timelines, and where things stand today.
57
Noise infusion banned from statistical products published by Census Bureau
Sadly, taking away valuable disclosure avoidance tools doesn't make fundamental trade-offs go away.
58
Mobile carriers can get your GPS location
In iOS 26.3, Apple introduced a new privacy feature which limits “precise location” data made available to cellular networks via cell towers. The feature is only available to devices with Apple’s in-house modem introduced in 2025. The announcement1 says https://support.apple.com/en-us/126101 ↩
59
60
Claude Cowork exfiltrates files
Claude Cowork is vulnerable to file exfiltration attacks via indirect prompt injection as a result of known-but-unresolved isolation flaws in Claude's code execution environment.