151
Reddit's website uses DRM for fingerprinting
But hey, at least Reddit gets less ad fraud!
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,762 posts.
152
153
Postmortem: TanStack NPM supply-chain compromise
On 2026-05-11, an attacker chained a pull_request_target Pwn Request, GitHub Actions cache poisoning across the fork↔base trust boundary, and OIDC token extraction from runner memory to publish 84 malicious versions across 42 @tanstack/* packages on npm. Full postmortem.
154
Jailbreaking RabbitOS
Critics unanimously agree that it sucks , and some have accused the company of deliberate deception . Rabbit Inc. reportedly accepts returns, but customers are so eager to get rid of their R1s that even new-in-box units are selling for well below RRP ($200) on secondary markets.
155
156
I pwned half of America's fast food chains simultaneously
How I pwned half of America’s fast food chains, simultaneously. Also checkout Eva’s blogpost of this event. With an upbeat pling my console alerted me that my script had finished running, to be precise it was searching for exposed Firebase credentials on any of the hundreds of recent AI startups. This was achieved…
157
Smartphones with Qualcomm chip secretly send personal data to Qualcomm
Nitrokey security research reveals that smartphones with Qualcomm chips secretly send device data to Qualcomm without user consent. NitroPhone is not affected.
158
I use zip bombs to protect my server
The majority of the traffic on the web is from bots. For the most part, these bots are used to discover new content. These are RSS Feed readers, search engines crawling your content, or nowadays AI bo
159
Zero-day in Sign in with Apple
What if I say, your Email ID is all I need to takeover your account on your favorite website or an app. Sounds scary, right? This is what a…
160
Cloudflare defeats patent troll Sable at trial
Last Thursday, on a clear, sunny morning in Waco, Texas, a jury returned a verdict after less than two hours of deliberation. The jury found that Cloudflare did not infringe the patent asserted against Cloudflare by patent trolls Sable IP and Sable Networks.
161
162
Why we won’t be supporting Sign in with Apple
The official blog of the AnyList team.
163
Timeline of the xz open source attack
Over a period of over two years, an attacker using the name “Jia Tan” worked as a diligent, effective contributor to the xz compression library, eventually being granted commit access and maintainership. Using that access, they installed a very subtle, carefully hidden backdoor into liblzma, a part of xz that also…
164
Firefox Now Available with Enhanced Tracking Protection by Default
It’s been several weeks since I was promoted to Senior Vice President of Firefox, responsible for overall Firefox product and web platform development. A
165
Tips for linking shell companies to their secret owners
At a recent panel at the 2024 NICAR conference, Karrie Kehoe, deputy head of data and research at ICIJ, offered a series of tips for investigating the true owners of shell companies.
166
Claude reveals ECDSA curve origins
The decades-old mystery of the origins of one of the most popular cryptographic standards has been explained.
167
NYT journalist hacked with Pegasus after reporting on previous hacking attempts
Our forensic analysis of two iPhones belonging to Hubbard found evidence of Pegasus infections in July 2020 and June 2021. Notably, these infections occurred after Hubbard reported in January 2020 that we found that he was targeted in 2018 by the Saudi Arabia-linked Pegasus operator that we call KINGDOM.
168
AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint
Recently I ran into a strange problem with my Bluetooth headphones. They support multipoint Bluetooth audio, so they can be connected to my ...
169
That Secret Service SIM farm story is bogus
It's just normal crime
170
171
Trevor Perrin requests removal of NSA from IETF Crypto Review
Search IETF mail list archives
172
WhatsApp's Signal Protocol integration is now complete
At Open Whisper Systems, our goal is to make private communication simple. A year ago, we announced a partnership with WhatsApp and committed to integrating the Signal Protocol into their product, moving towards full end-to-end encryption for all of their users by default. Over the past year, we...
173
NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender
Ahmed Mansoor was targeted by NSO Group, an Israel-based “cyber war” company that sells Pegasus, a government-exclusive “lawful intercept” spyware product.
174
Federal judge: Border searches of cell phones require a warrant
With United States v. Smith (S.D.N.Y. May 11, 2023), a district court judge in New York made history by being the first court to rule that a warrant is required for a cell phone search at the border, “absent exigent circumstances” (although other district courts have wanted to do so).EFF is...
175
Hijack of Amazon’s domain service used to reroute web traffic for two hours
Between 11am until 1pm UTC today, DNS traffic — the phone book of the internet, routing you to your favourite websites — was hijacked by an…
176
177
178
The inception bar: a new phishing method
A new phishing technique that displays a fake URL bar in Chrome for mobile. A key innovation is the "scroll jail" that traps the user in a fake browser.
179
Bypassing Google's big anti-adblock update
Hello, I'm Derin!
180
