661
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 718 posts.
662
Securing Services with Rootless Containers
Some tips to improve security in applications deployed as containers.
663
Entering and Breaking the Avast Antivirus Sandbox Part 2
SAFA details the full exploitation of CVE-2025-13032, turning a double-fetch vulnerability in Avast's kernel driver into a local privilege escalation to SYSTEM on Windows 11.
664
How the Government Deceived Congress in the Debate over Surveillance Powers (2013)
ANDREA MITCHELL: “Why do you need every telephone number? Why is it such a broad vacuum cleaner approach?” JAMES CLAPPER: “Well, you have to start someplace.”—NBC Meet the Press, this past Sunday Concerned about the surveillance of millions of ordinary Americans, last year Senator Ron Wyden asked...
665
Italy Blocks Reproductive Health Websites Women on Web and Women Help Women
This report documents the blocking of Women on Web (WoW) and Women Help Women (WHW) domains in Italy based on OONI data.
666
The Anti-Palantir Manifesto
Nym CEO Harry Halpin responds to Palantir manifesto with one that defends human freedom and privacy against techno-fascism.
667
Superhuman AI Exfiltrates Emails
Superhuman AI was able to exfiltrate sensitive emails from user accounts - without the user even being aware. This vulnerability was rapidly remediated by the Superhuman team.
668
My Reddit AMA on the Law of Web Scraping
On Friday, I did a Reddit AMA with the r/WebScrapingInsider subreddit about the law of web scraping. You can see the entire discussion here. I posted an introduction to the AMA, which I am sharing here: __ Hi everyone, and...
669
My adventure in designing API keys
Hello everyone, It has been quite a long time since my last blog, the last couple of months had been very busy and packed with a lot of work so I barely had much time to write blogs. Time runs so fast that the last time when I wrote a blog I was still a DevOps Engineer and now I am a Product Developer lol.
670
What does GitHub's security team even do?
Right now, there are thousands of repositories on GitHub distributing malware. Any of you can find these repositories, and you don’t need any special knowledge to do so. All you have to do is use the standard search function on the GitHub website. These repositories have been around for
671
Six Harmless Bugs Lead to Remote Code Execution
It was May 2024, and our internal security team was evaluating the LogPoint SIEM/SOAR platform to replace our existing platform, potentially. As part of a habit I’ve built over the years —and honestly, part of our 3rd party due diligence— I gave myself 24 hours to do what I always do with any technology we’re […]
672
We found cryptography bugs in the elliptic library using Wycheproof
Trail of Bits discovered and disclosed two vulnerabilities in the widely used elliptic JavaScript library that could allow signature forgery or prevent valid signature verification, with one vulnerability still unfixed after the 90-day disclosure window.
673
Sandboxes won't save you from OpenClaw
AI agent misbehavior isn't a sandbox problem—it's a permissions problem.
674
My university uses prompt injection to catch cheaters
Web developer and cybersecurity researcher
675
A 32-year-old bug walks into a Telnet server
A long, long time ago, in a land free of binary exploit mitigations, when Unix still roamed the Earth, there lived a pre-authentication Telnetd vulnerability. In fact, this vulnerability was born so long ago (way back in 1994) that it may even be older than you. To put the
676
AI Meets Cryptography 1: What AI Found in Cloudflare's Circl
We pointed our AI audit pipeline at Cloudflare's CIRCL experimental cryptography library and confirmed seven real bugs, from a critical float64 precision loss in threshold RSA to a complete access-control break in attribute-based encryption. All seven are now fixed upstream. This is the first post in a series on bugs…
677
Kernel anti-cheat is an overreach
Modern PC games make you install a ring-0 anti-cheat driver you can't audit.
678
Using Hinge as a Command and Control Server
A proof of concept demonstrating how to use the Hinge dating app as a C2.
679
680
I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded
How four layers of authentication in a production anti-cheat driver still hand you a complete BYOVD toolkit
681
(Post-Quantum) Cryptographic Right Answers
In the tradition started by Colin Percival and Thomas Ptacek, a set of “Cryptographic Right Answers” updated for the accelerated post-quantum transition timeline.
682
683
An algorithmic failure beneath the secret ballot
The secret ballot is one of the load-bearing walls of democracy. In Georgia, as in most states, this allows you to know whether your neighbor voted, but never who they voted for. Yet, in multiple states including Georgia, that guarantee is actively at risk.
684
We reproduced Anthropic's Mythos findings with public models
Anthropic framed Mythos and Project Glasswing as proof that frontier AI vulnerability research now needs gated access. We tested the public, patched cases with GPT-5.4 and Claude Opus 4.6 and found that the key building blocks are already accessible outside Glasswing, while reliable operationalization remains the real…
685
Authorize, don't authenticate
Hold on to your data by keeping it in your own database
686
Reverse-Engineering Claude Web's MicroVM: Uncovering Anthropic's Hidden Antspace
Full stack developer, open sourceror, serial entrepreneur.
687
macOS code injection for fun and no profit (2024)
Fun little vacation project for fun and zero profit.
688
Prove you are a robot: CAPTCHAs for agents
How we built a reverse-CAPTCHA for agents, and what we learned.
689
The NX bit is not just about security
While I’m taking a short break from low-level programming, here’s a story by a friend of mine, Sonya, about debugging a seemingly impossible bug in ARM code. This bug hunting saga started several months ago. While developing a bare-metal hypervisor on ARM64 for postmarketOS, I hit a strange bug: if I enabled the…
690
Handling secrets (somewhat) securely in shells
Sometimes, you need to deal with secrets in an interactive shell. Say, for example, you want to do things with the API of a GitLab instance for which you require authentication: