1741
RCE Vulnerability in QBittorrent
[…] Security has unveiled a critical vulnerability that has lingered in the popular torrent client qBittorrent for over 14 […]
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,767 posts.
1742
So I reverse engineered two dating apps
In this post I show some of my findings during the reverse engineering of the apps Coffee Meets Bagel and The League. I have identified several critical vulnerabilities during the research, all of which have been reported to the affected vendors. Introduction In these unprecedented times, more and more people are…
1743
EFF launches Age Verification Hub
With ill-advised and dangerous age verification laws proliferating across the United States and around the world, creating surveillance and censorship regimes that will be used to harm both youth and adults, the Electronic Frontier Foundation has launched a new resource hub that will sort through the mess and help…
1744
1745
What happened after 2k people tried to hack my AI assistant
I built hackmyclaw.com , where anyone could email Fiu, my OpenClaw assistant, and try to make it leak the contents of a secrets.env file.
1746
1747
Proof-of-Work Defense for Onion Services
Today, we are officially introducing a proof-of-work (PoW) defense for onion services designed to prioritize verified network traffic as a deterrent against denial of service (DoS) attacks with the release of Tor 0.4.8.
1748
Baseless Calls to Expand Surveillance Fit Familiar, Cynical Pattern
Like clockwork, cynical calls to expand mass surveillance practices—by continuing the domestic telephone records collection and restricting access to strong encryption—came immediately following the Paris attacks. These calls came before the smoke had even cleared, much less before a serious...
1749
Moving Fast and Securing Things
For development teams, process can often be antithetical to speed. Ease of deployment and security tend to have an inverse relationship, with some resentment for the security team occasionally mixed in. You may have seen the following tweet: https://twitter.com/petecheslock/status/595617204273618944?lang=en We believe…
1750
An opinionated guide on how to reverse engineer software
This is an opinionated guide. After 12 years of reverse engineering professionally, I have developed strong beliefs on how to get good at RE.
1751
1752
1753
1754
Email obfuscation: What works in 2026?
Here are some of the best techniques for keeping email addresses hidden from spammers—along with the statistics on how likely they are to be broken.
1755
1Password Secrets Automation
Secure, orchestrate, and manage your company’s infrastructure secrets with 1Password Secrets Automation.
1756
The internet is held together with spit and baling wire
A visualization of the Internet made using network routing data. Image: Barrett Lyon, opte.org.
1757
1758
There are no secure smartphones
Modern smartphones have a CPU chip, and a baseband chip which handles radio network communications (GSM/UMTS/LTE/etc.) This chip is connected to the CPU via DMA. Thus, unless an IOMMU is used, the baseband has full access to main memory, and can compromise it arbitrarily.
1759
Interview with the Guy Who Tried to Frame Me for Heroin Possession
In April 2013, I received via U.S. mail more than a gram of pure heroin as part of a scheme to get me arrested for drug possession. But the plan failed and the Ukrainian mastermind behind it soon after was imprisoned for unrelated cybercrime offenses. That individual recently gave his first interview since finishing…
1760
The Secret API of Banks
Interacting with bank data often requires trusting 3rd parties with your credentials. What if there were a more secure way to explore transactions?
1761
How to properly manage SSH keys for server access
This article was on the hacker news frontpage. You can find the related discussion here. Every developer needs access to some servers for example to check the application logs. Usually, this is done using public-private key encryption where each developer generates their own public-private key pair. The public keys of…
1762
WorstFit: Unveiling Hidden Transformers in Windows ANSI
📌 This is a cross-post from DEVCORE. The research was first published at Black Hat Europe 2024. Personally, I would like to thank splitline, the co-author of this research & article, whose help
1763
The RCE that AMD won't fix
After reporting a RCE in AMD's auto-update software, they decided to not patch it due to it requiring a man-in-the-middle attack to perform.
1764
Breaking Git with a carriage return and cloning RCE
tl;dr: On Unix-like platforms, if you use git clone --recursive on an untrusted repo, it could achieve remote code execution. Update to a fixed version of Git and other software that embeds Git (including GitHub Desktop).
1765
Goodbye InnerHTML, Hello SetHTML: Stronger XSS Protection in Firefox 148
Cross-site scripting (XSS) remains one of the most prevalent vulnerabilities on the web. The new standardized Sanitizer API provides a straightforward way for web developers to sanitize untrusted HTML before inserting it into the DOM. Firefox 148 is the first browser to ship this standardized security enhancing API…
1766
1767
1768
How to Corrupt a SQLite Database File
An SQLite database is highly resistant to corruption. If an application crash, or an operating-system crash, or even a power failure occurs in the middle of a transaction, the partially written transaction should be automatically rolled back the next time the database file is accessed. The recovery process is fully…
1769
So, you’ve hit an age gate. What now?
EFF is against age gating and age verification mandates, and we hope we’ll win in getting existing ones overturned and new ones prevented. But mandates are already in effect, and every day many people are asked to verify their age across the web, despite prominent cases of sensitive data getting leaked in the process.
1770
Playing around with the Fuchsia operating system
A look at the new Fuchsia Operating System.