61
Handling cookies is a minefield
Discrepancies in how browsers and libraries handle HTTP cookies, and the problems caused by such things.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 536 posts.
62
Let's Encrypt is 10 years old now
Vital personal and business information flows over the Internet more frequently than ever, and we don’t always know when it’s happening. It’s clear at this point that encrypting is something all of us should be doing. Then why don’t we use TLS (the successor to SSL) everywhere? Every browser in every device supports…
63
How to get the whole planet to send abuse complaints to your best friends
It all begins with one scary email late at night just before I had to go to sleep:
64
Warning: DNS encryption in Little Snitch 6.1 may occasionally fail
UPDATE: Spoke too soon… The problem discussed here turned out to be specific to Little Snitch 6.1 and not a general issue in macOS. It has already been fixed in Little Snitch 6.1.1. See the end of the article for details. DNS Encryption 101 When…
65
Xz/liblzma: Bash-stage Obfuscation Explained
Yesterday Andres Freund emailed oss-security@ informing the community of the discovery of a backdoor in xz/liblzma, which affected OpenSSH server (huge respect for noticing and investigating this). Andres' email is an amazing summary of the whole drama, so I'll skip that. While admittedly most juicy and interesting…
66
EU to greenlight Chat Control tomorrow
[Update: Vote has been postponed to Thursday, keep up the pressure!] The Belgian EU Council presidency seems set to have bulk Chat Control searches of our private communications greenlighted by EU governments on Wednesday 19 Thursday 20 June. This confirms concerns that the proponents of Chat Con
67
Xz: A microcosm of the interactions in open source projects
Originally a thread on Twitter about the xz/liblzma vulnerability, when I finished typing it, I realized I had a real world slice of Open Source interaction that deserved more attention.
68
They stole my voice with AI
UPDATE 9/23: The CEO of Elecrow responded. I've posted a follow-up blog post with my reaction to the response and some other thoughts on AI voice cloning. Listen to this clip: Your browser does not support the video tag. I don't know about you, but that sounds pretty familiar. I mean I would like you to subscribe to…
69
ShotSpotter: listening in on the neighborhood
Last week, someone leaked a spreadsheet of SoundThinking sensors to Wired . You are probably asking "What is SoundThinking," because the company rebranded last year. They used to be called ShotSpotter, and their outdoor acoustic gunfire detection system still goes by the ShotSpotter name.
70
Reverse Engineering iOS 18 Inactivity Reboot
Wireless and firmware hacking, PhD life, Technology
71
Fuzzing Ladybird with tools from Google Project Zero
While Ladybird does an okay job with well-formed web content, I thought it would be useful to throw some security research tools at it and see what kind of issues it might reveal.
72
I looked through attacks in my access logs
I've been self-hosting for over a decade. It's freeing because I own my data, and do not depend on any platform other than my cloud host, which I can easily switch off. Self-hosting gives much insight into what it takes to run a cloud service. Anyone
73
Chrome is entrenching third-party cookies that will mislead users
Related Website Sets is a user-hostile weakening of the Web's privacy model, plainly designed to benefit websites and advertisers, to the detriment of user privacy.
74
Fixing an Elgato HD60 S HDMI capture device with the help of Ghidra
This post has a little bit of everything. Hardware diagnostics, some suspiciously similar datasheets from two separate Taiwan chip manufacturers, and firmware reverse engineering. Read on if that sounds like fun!
75
How did Facebook intercept their competitor's encrypted mobile app traffic?
A technical investigation into information uncovered in a class action lawsuit that Facebook had intercepted encrypted traffic from user's devices running the Onavo Protect app in order to gain competitive insights.
76
Apple and Google deliver support for unwanted tracking alerts in iOS and Android
Apple and Google have teamed up to deliver support for unwanted Bluetooth tracking alerts in iOS and Android.
77
Cracking Meta's Messenger Certificate Pinning on macOS
Bypassing certificate pinning in Meta’s Messenger application on macOS.
78
OAuth from First Principles
I've wanted to write a blog post for everyone who learns things the same way that I do; by trying to break them. I'll start off with an awfully flawed implementation that authorizes a user with a 3...
79
Review of Mullvad VPN
X41 releases the audit report of Mullvad VPN
80
Why I use Firefox
I’m interested in HTML, CSS, and making the web less annoying
81
GitHub notification emails used to send malware
Malicious actors are abusing legitimate notification emails sent by GitHub to try and trick people into downloading malware.
82
Bytecode Breakdown: Unraveling Factorio's Lua Security Flaws
Dynamic languages are safe from memory corruptions bugs, right?
83
You can't leak users' data if you don't hold it
When I was still working at Faculty , we took on a new client that was not yet named Matter . We eventually transitioned from an agency-client relationship to a startup relationship, where I became the VP of Technology. This is what I’ve been doing for the past two-ish years.
84
A supply chain attack on PyTorch
Security tends to lag behind adoption, and AI/ML is no exception. Four months ago, Adnan Khan and I exploited a critical CI/CD vulnerability in PyTorch, one of the world’s leading ML platform…
85
I Followed the Official AWS Amplify Guide and Was Charged $1,100
An interesting thing happens when you follow the official Amplify guide.
86
Zero-Click Calendar invite vulnerability chain in macOS
Critical zero-click vulnerability chain in macOS (patched)
87
USPS text scammers duped his wife, so he hacked their operation
How someone I don't know hacked the scammers back
88
Hacking into an insurance company by exploiting their premium calculator
A vulnerable API on Toyota Tsusho Insurance Broker India’s premium calculator website exposed Microsoft corporate cloud credentials.
89
Using Ghidra and Python to reverse engineer Ecco the Dolphin
Re-routing the encryption
90
Over the edge: The use of design tactics to undermine browser choice
In order to be able to choose their own browser, people must be free to download it, easily set it to default and to continue using it - all without ...