1621
HTTP/2-exclusive threats caused by implementation flaws and RFC imperfections
In this research paper James Kettle introduces multiple new classes of HTTP/2-exclusive attacks, demonstrated on popular websites and servers.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,767 posts.
1622
SSH Agent Explained
The SSH agent acts behind the scenes to keep you safe. Here's how it works.
1623
1Password for Linux
The wait is over. [1Password for Linux is officially here](https://support.1password.com/getting-started-linux/).
1624
PoisonGPT: We hid a lobotomized LLM on Hugging Face to spread fake news
We will show in this article how one can surgically modify an open-source model, GPT-J-6B, and upload it to Hugging Face to make it spread misinformation while being undetected by standard benchmarks.
1625
Don't run 'strings' on untrusted files
Many shell users, and certainly most of the people working in computer forensics or other fields of information security, have a habit of ru...
1626
1627
How to prevent email spoofing, using an unholy combination of silly standards
How to use SPF, DKIM, and DMARC to improve your domain's email security and limit spoofing - but written for humans.
1628
WebAssembly and Back Again: Fine-Grained Sandboxing in Firefox 95
In Firefox 95, we're shipping a sandboxing technology called RLBox — developed with researchers at UC San Diego and the University of Texas
1629
How I bypassed 2-Factor-Authentication on Google, Facebook, Yahoo, LinkedIn
I remember fondly two years ago, when 2-Factor-Authentication (2FA) became popular and well used across major web applications (Google, Facebook, Yahoo and others). I found, my naive sixteen year old self unable to come to terms for why the genius idea had not been thought of before. At
1630
Thunderstrike – Apple EFI firmware vulnerability
31C3 presentation on the Thunderstrike firmware vulnerability in MacBooks
1631
Apple vs the Law
Apple & Google at the EU DMA compliance workshops, June 2025.
1632
Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised
A compromised npm maintainer account published 637 malicious versions across 317 packages including size-sensor, echarts-for-react, timeago.js, and hundreds…
1633
The IAB loves tracking users but hates users tracking them
The Interactive Advertising Bureau (IAB) is a standards development group for the advertising industry. Their members love tracking users. They want to know where you are, who you're with, what you're buying, and what you think. All so they can convince you to spend slightly more on toothpaste. Or change your…
1634
1635
Should you be concerned about LastPass uploading your passwords to its server?
The answer to this question is still "Yes!" Here I demonstrate yet another way for the server to access your data, the issues being structural.
1636
Hack your way through Stripe's Capture the Flag
Online payment processing for internet businesses. Stripe is a suite of payment APIs that powers commerce for businesses of all sizes.
1637
1638
1639
AAD misconfiguration led to Bing.com results manipulation, account takeover
How Wiz Research found a common misconfiguration in Azure Active Directory that compromised multiple Microsoft applications, including a Bing management portal
1640
Someone at BrowserStack is leaking users' email addresses
Like all good nerds, I generate a unique email address for every service I sign up to. This has several advantages - it allows me to see if a message is legitimately from a service, if a service is hacked the hackers can't go credential stuffing, and I instantly know who leaked my address. A few weeks ago I signed up…
1641
This POODLE bites: exploiting the SSL 3.0 fallback
Today we are publishing details of a vulnerability in the design of SSL version 3.0. This vulnerability allows the plaintext of secure conn...
1642
How the Devteam Conquered the iPhone
The summer of 2007 was an eventful one if you were into cell phones. It all started on June 29 when Apple announced the release of the iPhone. If you have never taken the time to watch the full keynote, I highly recommend it.
1643
New Mac ransomware spreading through piracy
We analyze a new Mac ransomware that appears to encrypt user files with a bit of a time delay. The ransomware encrypts files with little strategy.
1644
My NAS exposes itself over the internet without permission
The Terramaster NAS decided to expose itself to the public internet without asking. Let's see what we can do about it.
1645
Updates to GitHub Copilot interaction data usage policy
From April 24 onward, interaction data from Copilot Free, Pro, and Pro+ users will be used to train and improve our AI models unless they opt out.
1646
1647
I may be the only evil (bit) user on the internet (2015)
Almost every year a joke RFC is made on April 1st (these have caught on so well, that it’s now common to see more than one of these every year), or April Fool’s Day, and some of them are pretty great. Here are some of my favourites:
1648
1649
Dark Patterns at Scale: Findings from a Crawl of 11K Shopping Websites (2019)
Dark patterns are user interface design choices that benefit an online service by coercing, steering, or deceiving users into making unintended and potentially harmful decisions. We conducted a large-scale study, analyzing ~53K product pages from ~11K shopping websites to characterize and quantify the prevalence of…
1650
