1771
Firefox, you're supposed to be in my pocket, not the other way around
Personal blog of Julien (jvoisin) Voisin
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,767 posts.
1772
How we cracked millions of Ashley Madison passwords
Not long after the release of the Ashley Madison leaks, many groups and individuals attempted to crack the bcrypt hashes. Since t...
1773
Okta's NextJS-0auth troubles
When AI engineering fails: Dealing with hallucinations, misattribution, and broken code in an Okta/Auth0 pull request maintained by AI.
1774
The Python Package Index is now a GitHub secret scanning integrator
GitHub and the Python Package Index (PyPI) are collaborating to help protect you from leaked PyPI API tokens. From today, GitHub will scan every commit to a public repository for…
1775
Breaking open the Mt. Gox case, part 1
The official blog of WizSec, a group of bitcoin security specialists, and their investigation into MtGox.
1776
1777
Infosec company pwned by 4chan user
risk visualize deez nuts
1778
Don't trust me: I might be a spook
But the latest revelations scare me. It's one thing to find and exploit vulnerabilities in software; there's a lot of software out there which was written by developers with very little understanding of cryptography or software security, and it shows. If you care about security, we reasoned, stick to software written…
1779
AI generated security reports about curl
I have held back on writing anything about AI or how we (not) use AI for development in the curl factory. Now I can't hold back anymore. Let me show you the most significant effect of AI on curl as of today - with examples. Bug Bounty Having a bug bounty means that we offer … Continue reading The I in LLM stands for…
1780
Recovering secret keys from devices using video footage of their power LED
Exploiting a Video Camera's Rolling Shutter to Recover Secret Keys from Devices Using Video Footage of Their Power LED
1781
1782
1783
GoogleMeetRoulette: Joining random meetings
Finding Google Meet phone numbers and bruteforcing PINs to join random meetings
1784
Hacking the Apple Webcam (Again)
$100,500 Apple Bug Bounty for hacking the webcam via a Safari Universal Cross-Site Scripting (UXSS) bug. CVE-2021-30861, CVE-2021-30975
1785
Twitter's pivot to x.com is a gift to phishers
On April 9, Twitter/X began automatically modifying links that mention “twitter.com” to read “x.com” instead. But over the past 48 hours, dozens of new domain names have been registered that demonstrate how this change could be used to craft convincing phishing links — such as fedetwitter[.]com , which until very…
1786
1787
Wanted to download an ISO, ended up writing a kernel exploit
My TP-Link EAP770 v1 corrupts downloads over Wi-Fi and TP-Link EOL'd it before I unboxed it. The fix is two zeros in sysfs. TP-Link's shell won't let me write them, so I wrote a kernel exploit for my own fucking access point.
1788
If your code accepts URIs as input, filter out “file://”
There are many online sites that accept reading input from remote locations. For example a site might try to extract all the text from a webpage, or show you the HTTP-headers a given server sends back in response to a request.
1789
EFF’s concerns about the UN Cybercrime Convention
Update: This post has been updated to clarify the scope of the compelled assistance provisions and the broad nature of criminalization and electronic evidence gathering. The final version of the draft convention can still be used to expand the reach of repression under the pretext of combating...
1790
We Have 24 Hours to Save Online Privacy Rules
This is our last chance to save critical online privacy protections. Take part in the action! We are one vote away from a world where your ISP can track your every move online and sell that information to the highest bidder. Call your lawmakers now and tell them to protect federal online privacy...
1791
A decade-old Steam bug
Valve has shown to occasionally not act on community feedback and bug reports. A story about a decade old bug.
1792
1793
My Google Workspace account suspension
As the title suggests, I have finally become the victim of Google’s account suspension.
1794
Linode launches free DDoS protection
/PRNewswire-PRWeb/ -- Linode, the world's largest independent cloud provider, today announced advanced protection across its global network of 11 data centers...
1795
Mark Felt-Tipped: Uncovering top-secret information by counting pixels
KEMUDITOTO merupakan official Situs Togel 4D & Toto TOGEL ONLINE Terjamin Maxwin dengan akses cepat, pilihan permainan lengkap, layanan responsif, dan nyaman digunakan setiap hari.
1796
Barracuda urges replacing, not patching, its email security gateways
It’s not often that a zero-day vulnerability causes a network security vendor to urge customers to physically remove and decommission an entire line of affected hardware — as opposed to just applying software updates. But experts say that is exactly what transpired this week with Barracuda Networks , as the company…
1797
The Vercel breach: OAuth attack exposes risk in platform environment variables
An OAuth supply chain compromise at Vercel exposed how trusted third party apps and platform environment variables can bypass traditional defenses and amplify blast radius. This article examines the attack chain, underlying design tradeoffs, and what it reveals about modern PaaS and software supply chain risk.
1798
1799
1800