1351
TeamViewer stores user passwords in registry, encrypted with hard-coded key
Oh man where to even begin with this one. This was a crazy ride and I learned a ton along the way.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,766 posts.
1352
1353
1354
Attacking UNIX Systems via CUPS
Hello friends, this is the first of two, possibly three (if and when I have time to finish the Windows research) writeups. We will start with targeting GNU/Lin…
1355
How I advertise malicious software on Google Ads
A caller phones Radio Erywan. “Is it true that in Moscow, on Red Square, they give out cars?” “True. Not in Moscow, however, but in St. Petersburg. Not on Red Square, but on Revolution Square. Not cars, but bikes. And they don’t give them out, but steal them”. Edit: Through the apparent magic of Hacker News, my Google…
1356
Moving from reCAPTCHA to hCaptcha
We recently migrated the CAPTCHA provider we use from Google's reCAPTCHA to a service provided by the independent hCaptcha. Here's a walk through of the rationale in more detail.
1357
1358
It's Way Too Easy to Get a .gov Domain Name
Many readers probably believe they can trust links and emails coming from U.S. federal government domain names, or else assume there are at least more stringent verification requirements involved in obtaining a .gov domain versus a commercial one ending in .com or .org. But a recent experience suggests this trust may…
1359
Jwz: Google's pseudonym support "obvious bullshit"
In a shamefully credulous statement, they say: Proponents of pseudonymity scored a major victory today, when Google executive Vic Gundotra revealed at the Web 2.0 Summit that social networking service Google+ will begin supporting pseudonyms and other types of identity. According to Mashable, Google+ will be "adding…
1360
Geedge and MESA leak: Analyzing the great firewall’s largest document leak
The Great Firewall of China (GFW) experienced the largest leak of internal documents in its history on Thursday September 11, 2025. Over 500 GB of source code, work logs, and internal communication records were leaked, revealing details of the GFW's research, development, and operations.
1361
Yahoo's Fight for its Users Earns the Company Special Recognition by EFF
Each year, EFF’s Who Has Your Back campaign assesses the policies and practices of major Internet companies as a way to encourage and incentivize those companies to take a stand for their users in the face of government demands for data. Normally, when a company demonstrates it has a policy or...
1362
1363
1364
US Sought Permission to Change Historical Record of a Public Court Proceeding
A few weeks ago we fought a battle for transparency in our flagship NSA spying case, Jewel v. NSA. But, ironically, we weren't able to tell you anything about it until now. On June 6, the court held a long hearing in Jewel in a crowded, open courtroom, widely covered by the press. We were even on...
1365
Apple Passwords’ generated strong password format
This post briefly summarizes part of a talk I gave in 2018. All information in this post has been accessible on YouTube since then. There is no new information or news in this post. On Mastodon recently, jsveningsson@mastodon.social asked me: Having an annoying argument on Threads about Apple generated passwords…
1366
I was seven words away from being spear-phished
Three weeks ago I received a very flattering email from the University of Cambridge, asking me to judge the Adam Smith Prize for Economics:
1367
Microsoft Put Off Fixing Zero Day for 2 Years
A security flaw in the way Microsoft Windows guards users against malicious files was actively exploited in malware attacks for two years before last week, when Microsoft finally issued a software update to correct the problem.
1368
The FBI Should Stop Attacking Encryption
Federal law enforcement has been asking for a backdoor to read Americans’ encrypted communications for years now. FBI Director Christopher Wray did it again last week in testimony to the Senate Judiciary Committee. As usual, the FBI’s complaints involved end-to-end encryption employed by popular...
1369
WFH – Watched from Home: Office 365 and workplace surveillance creep (2022)
Imagine your performance at work was assessed directly from the amount of e-mails sent, the amount of time consumed editing a document, or the time spent in meetings or even moving your mouse. This may sound ludicrous but your boss might be doing exactly that.
1370
LinkedIn is scanning browser extensions
When companies get caught doing this sort of thing, the response is almost always the same: "we're using this technology to combat fraud," or "ensure positive user experience," or "save computing resources," or some other hog wash. The simple truth, there's no reason to be collecting data that can be used to identify…
1371
Simulating the PIN cracking scene in Terminator 2
In the beginning of Terminator 2: Judgement Day, John Connor uses a laptop to crack the PIN of a stolen debit card.
1372
Timeline of the OpenAI accidental attack against Hugging Face
OpenAI gave a last-minute presentation at the Black Hat security on Wednesday about “the Hugging Face Incident” (previously on this blog). The video was published yesterday. It’s short and information …
1373
1374
1375
RotaJakiro: A long live secret backdoor with 0 VT detection
Overview On March 25, 2021, 360 NETLAB's BotMon system flagged a suspiciousELF file (MD5=64f6cfe44ba08b0babdd3904233c4857) with 0 VT detection, the sample communicates with 4 domains on TCP 443 (HTTPS), but the traffic is not of TLS/SSL. A close look at the sample revealed it to be a backdoor targeting
1376
VPN leaks users’ IPs via WebRTC
VPN leaks users’ IPs via WebRTC: I’ve tested hundred VPN and Proxy providers and 19 of them leaks users’ IPs via WebRTC (16%)
1377
SCOTUS rules you may sue government agents for damages when they violate rights
Arlington, Va.—In a unanimous opinion issued today by the U.S. Supreme Court, and authored by Associate Justice Clarence Thomas, the Court ruled in Tanzin v. […]
1378
Claude Code Found a Linux Vulnerability Hidden for 23 Years
Claude Code has gotten extremely good at finding security vulnerabilities, and this is only the beginning.
1379
The Belgian government has removed ‘backdoor requirement’ from new law
The Belgian government has removed 'backdoor requirement' from new law after international protest.
1380
Privacy is the most important concept of our time
Privacy is more than the right of an individual to be left alone. It concerns the very fabric of society.