601
A Recipe for Steganogravy
how to hide juicy data in plain sight
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 718 posts.
602
Tesla Wall Connector bootloader bypasses the firmware downgrade ratchet
Exploiting the Tesla Wall Connector from its charge port connector -
603
Parallel Reconstruction of Lawful TLS Wiretapping
Transport Layer Security (TLS) is the protocol involved in getting the lock icon to appear in your browser next to the URL. Under the hood it uses a bunch of really cool numbers for encryption. Some numbers are considered private and need securing; some are considered public and are fine for sharing. You can mix your…
604
Memory safety absolutists
When seeing the title of this post, I bet in some people's minds, the first thought was "Rust devs!". This connection is not unfounded. Rust devs tend to be passionate about memory safety. Some of it, I'm sure, may have been caused by a classic language wars attitude: my language is better than yours, and here is why…
605
Ad-tech is fascist tech
A core tenet of the enshittification hypothesis is that all the terrible stuff we're subjected to in our digital lives today is the result of foreseeable (and foreseen) policy choices, which created the enshittogenic policy environment in which the worst people's worst ideas make the most money:
606
Disable Your SSH access accidentally with scp
Here's an interesting bug I ran into recently: After transferring some files to my server via scp, I couldn't log in via SSH anymore - my key was rejected by sshd.
607
Cloudflare deploys protections against php2shell vulnerability
Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed data from reaching attackers.
608
609
610
The Quiet Numbers Station: Decoding Nineteen Years of GPS Cryptography
The Global Positioning System (GPS) relies on its primary L1 frequency to broadcast precise timing and orbital data, allowing receivers on Earth to calculate their exact location. Because the L1 C/A signal transmits at just fifty bits per second, every bit of this navigation data must earn its place. Yet, within this…
611
Copy Fail, Dirty Frag, and Fragnesia kernel vulnerabilities
News and information from Gentoo Linux
612
Felix "fx" Lindner has died
With heavy hearts, we announce that Felix “FX” Lindner —a cherished friend, and the founder and owner of Recurity Labs—passed away on 2026-03-01.
613
Welcome to the Strip Mining Era of OSS Security
In 2026, LLM-powered code scanners are uncovering security vulnerabilities in open source projects at 10x the historical rate. Here's what OSS maintainers and users need to do about it.
614
GPT 5.6 Cyber
Meet GPT-5.6-Cyber, OpenAI’s cybersecurity-specific model available through Daybreak Red for authorized vulnerability research, exploit validation, and security testing.
615
Using proxies to hide secrets from Claude Code
How to use HTTP proxies to prevent credential exposure in Claude Code sandboxes.
616
Factoring RSA 260
How Devin and a Cognition researcher built the world’s highest-performance GPU lattice siever, to make factoring numbers 10x cheaper than the previous…
617
GDID Windows – Cut the tracker that follows you even under VPN
The GDID helped catch a hacker despite his VPN. I set up a VM to see if it can be neutralized: what works, what doesn't, and the scripts to stop it from ...
618
Signs you're a dangerous terrorist: using Signal, moving zines
The unusually long sentences criminalize being an anti-fascist activist, reading the wrong zines, and using the wrong communication apps. They're incredibly dangerous.
619
Second Circuit allows government to search electronic devices at the border
NEW YORK—The U.S. Court of Appeals for the Second Circuit today held that border agents may search travelers’ electronic devices without suspicion. The Knight First Amendment Institute at Columbia University and the Reporters Committee for Freedom of the Press (RCFP) submitted an amicus brief in the case, arguing that…
620
US Government wants DNA and social media from visitors
Yesterday the Trump Administration announced a proposed change in policy for travellers to the U.S. It applies to the powers of data collection by the Customs and Border Police (CBP).
621
Who Is Planting Backdoors in Ledger Crypto Wallets?
The theft last week of an estimated $100 million in crypto using a hardware backdoor planted in Ledger wallets points to a sophisticated and systematic attack aimed at subverting crypto wallets sold by legitimate resellers in Asia and Europe
622
“Disregard That” Attacks
Why you shouldn't share your context window with others
623
Linux Internals: How /proc/self/mem writes to unwritable memory (2021)
Introduction An obscure quirk of the /proc/*/mem pseudofile is its “punch through” semantics. Writes performed through this file will succeed even if the destination virtual memory is marked unwritable. In fact, this behavior is intentional and actively used by projects such as the Julia JIT compiler and rr debugger…
624
Better Auth is joining Vercel
Better Auth is joining Vercel. We're joining to accelerate our work on open-source auth and securing agent workflows.
625
Soatok's Informal Guide to Threat Models
After a long day of exhausting conversations about Hybrid Post-Quantum Cryptography, random jackasses trying to play gotcha with endpoint attacks against end-to-end encrypted messaging apps, and me…
626
I switched to Brave
I've been using Brave for a couple months now after using Firefox for around 25 years. I think Brave will be a permanent change.
627
The Car That Watches You Back: The Advertising Infrastructure of Modern Cars
How the connected car became an advertising surface. From Stellantis startup pop-ups to GSTV pumps to Gulp Radio aisles, and the consent infrastructure the automobile never developed.
628
629
X-Clacks-Overhead
A small HTTP-header tribute to Sir Terry Pratchett
630
OpenAI models secretly generate instructions to ignore constraints
Research on aligning AI with human values and intent, and reports documenting model failures.