781
Endlessh: An SSH Tarpit
This article was discussed on Hacker News ( later ), on reddit ( also ), featured in BSD Now 294 . Also check out this Endlessh analysis .
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,762 posts.
782
Should I use JWTs for authentication tokens?
Let’s talk about what we’re talking about. JWT stands for JSON Web Tokens, a reasonably well defined standard for authenticated tokens. Specifically they have a header with format information, a payload, and a signature or message authentication code. The core idea is that whoever has the corresponding verification…
783
784
Zoom’s Use of Facebook’s SDK in iOS Client
Learn more about how to use each Zoom product to connect with coworkers, customers, businesses, and more with insights and best practices.
785
TIL: You can access a user’s camera with just HTML
The HTML capture attribute is interesting because it allows you to activate a user's camera with just HTML. This article covers it in more depth.
786
Crazy Thin ‘Deep Insert’ ATM Skimmers
A number of financial institutions in and around New York City are dealing with a rash of super-thin “deep insert” skimming devices designed to fit inside the mouth of an ATM’s card acceptance slot. The card skimmers are paired with tiny pinhole cameras that are cleverly disguised as part of the cash machine. Here’s a…
787
An Ode to Apple’s Hide My Email
Apple's Hide My Email feature is one of the most under-rated privacy launches of the past year, and here's why.
788
EU Commission doesn't understand what's written in its own chat control bill
Ylva Johansson is the EU Commissioner in charge of the Chat Control Bill. In recent days she has taken part in several interviews in Swedish media and also spoken in front of EU parliament members.
789
Luca App: CCC calls for a moratorium
Dubious business model, defective software, irregularities in the awarding of contracts: The Chaos Computer Club (CCC) demands an immediate end to states' alimentation of Smudo's million-dollar tax...
790
Call of Duty gaming community points to ‘swatting’ in Wichita police shooting
A 28-year-old Kansas man was shot and killed by police officers on the evening of Dec. 28 after someone fraudulently reported a hostage situation ongoing at his home. The false report was the latest in a dangerous hoax known as “ swatting ,” wherein the perpetrator falsely reports a dangerous situation at an address…
791
Snyk security researcher deploys malicious NPM packages targeting cursor.com
A security researcher at Snyk published 5 malicious software packages to the NPM registry. These packages appear to target Cursor.com
792
Cracking My Windshield and Earning $10k on the Tesla Bug Bounty Program
One of the more interesting things I've had the opportunity to hack on is the Tesla Model 3. It has a built in web browser, free premium LTE, and over-the-air software updates. It's a network connected computer on wheels that drives really fast.
793
HTTPS on Stack Overflow: The End of a Long Road
Today, we deployed HTTPS by default on Stack Overflow. All traffic is now redirected to https:// and Google links will change over the next few weeks. The ac...
794
Pi-hole v6
We’ve integrated a new REST API and embedded web server directly into the pihole-FTL binary. This eliminates the need for lighttpd and PHP , reducing the installation footprint and boosting performance. The new API also offers server-side pagination for the query log, ensuring a faster and more responsive interface.
795
The Invisible JavaScript Backdoor
A few months ago we saw a post on the r/programminghorror subreddit: A developer describes the struggle of identifying a syntax error resulting from an invisible Unicode character hidden in JavaScript source code. This post inspired an idea: What if a backdoor literally cannot be seen and thus evades detection even…
796
797
900 Sites, 125M accounts, 1 Vulnerability
900 Sites, 125 million accounts, 1 vulnerability
798
How companies use fake sites, backdated articles to censor Google results (2017)
Anubis could not load its JavaScript. The server may be overloaded. Please reload the page to try again.
799
Zero-Width Characters: Invisibly fingerprinting text
In early 2016 I realized that it was possible to use zero-width characters, like zero-width non-joiner or other zero-width characters like the zero-width space to fingerprint text. Even with just a single type of zero-width character the presence or non-presence of the non-visible character is enough bits to…
800
801
BitLocker Lockscreen Bypass
BitLocker is a modern data protection feature that is deeply integrated in the Windows kernel. It is used by many corporations as a means of protecting company secrets in case of theft. Microsoft recommends that you have a Trusted Platform Module which can do some of the heavy cryptographic lifting for you.
802
Xerox scanners and photocopiers randomly alter numbers in scanned documents
Xerox scanners/photocopiers randomly alter numbers in scanned documents Please see the “condensed time line” section (the next one) for a time line of how the Xerox saga unfolded. It for example depicts that I did not push the thing to the public right away, but gave Xerox a lot of time before I did so. <iframe…
803
I hacked a dating app (and how not to treat a security researcher)
Update: This post received a large amount of attention on Hacker News — see the discussion thread.
804
805
806
What You Get After Running an SSH Honeypot for 30 Days
Discover what 11,599 SSH login attempts reveal after running a honeypot for 30 days. Learn key cybersecurity insights—read now to protect your systems!
807
Exploiting the IKKO Activebuds “AI powered” earbuds (2024)
So my journey with these earbuds started after I saw them on this Mrwhosetheboss video about pointless tech. This device seems to be also popular on TikTok. My suspicions were confirmed, this runs android. So of course i went ahead and bought them. 245 euros later... and they finally arrived!
808
Machine learning without centralized training data
Posted by Brendan McMahan and Daniel Ramage, Research ScientistsStandard machine learning approaches require centralizing the training data on one ...
809
Mullvad on Tailscale: Privately browse the web
Learn how Tailscale's partnership with Mullvad enables secure, private browsing with Mullvad’s VPN servers as exit nodes. Protect your internet traffic, maintain privacy, and enjoy fast, encrypted browsing worldwide. Discover how to configure Mullvad with Tailscale for ultimate security.
810
Web hacking techniques of 2021
Welcome to the Top 10 (new) Web Hacking Techniques of 2021, the latest iteration of our annual community-powered effort to identify the most significant web security research released in the last year