1981
How github was hacked
So I commited in rails/rails repo I simply added a <input value=USER_ID name=public_key[user_id]> field to Public key update form, where U...
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,767 posts.
1982
Show HN: I'm building a browser for reverse engineers
In the expanding world of AI my heart still lies in AST transforms, browser fingerprinting, and anti-bot circumvention. But my workflow felt... primitive.
1983
1984
Second factor SMS: Worse than its reputation
One-time passwords are often sent via SMS. Security researchers from the CCC recently had live access to over 200 million such SMS messages from more than 200 affected companies.
1985
Xkcd Password Generator
The button below will generate a random phrase consisting of four common words. According to yesterday’s xkcd strip, such phrases are hard to guess (even by brute force), …
1986
We will not ‘walk out’ of UK, nor comply with any request to bypass encryption
Tutanota: We will not 'walk out' of UK like Signal. Nor will we comply with any request to bypass our encryption.
1987
How does Apple privately find offline devices?
At Monday’s WWDC conference, Apple announced a cool new feature called “Find My”. Unlike Apple’s “Find my iPhone”, which uses cellular communication and the lost…
1988
Countering threats from North Korea
On February 10, Threat Analysis Group discovered two distinct North Korean government-backed attacker groups exploiting a remote code execution vulnerability in Chrome, …
1989
Google's Street View computer vision can beat reCAPTCHA with 99% accuracy
Posted by Vinay Shet, Product Manager, reCAPTCHA Have you ever wondered how Google Maps knows the exact location of your neighborhood cof...
1990
The FBI proves again it can’t be trusted with Section 702
The FBI doesn’t believe that either our rights or the limitations that Congress has placed upon them matter when it comes to the vast amount of information about us collected under FISA Section 702. The latest exhibit in this is in yet another newly declassified opinion of the Foreign Intelligence Surveillance Court…
1991
TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy
Hi friends and welcome to the last post for this year! Whenever someone asks me how to get started with reverse engineering, I always give the same advice: buy…
1992
First-party isolation in Firefox: what breaks if you enable it?
Firefox’s FPI system keeps websites from tracking your movements across websites. This gives excellent privacy protections but at a cost of web compatibility.
1993
Zero-Day Exploitation of Atlassian Confluence
UPDATE: On June 3, 2022, Atlassian updated its security advisory with new information regarding a fix for Confluence Server and Data Center to address CVE-2022-26134. Users are encouraged to update immediately to […]
1994
Exploiting the Wi-Fi Stack on Apple Devices
Posted by Gal Beniamini, Project ZeroIn this blog post we’ll complete our goal of achieving...
1995
LogoFAIL: Secure Boot bypass with manipulated boot logos
LogoFAIL by BINARLY: Discover how vulnerable image parsing impacts device manufacturers in the UEFI firmware ecosystem. Learn about critical LogoFAIL…
1996
Denial of service and source code exposure in React Server Components
The library for web and native user interfaces
1997
Worst CAPTCHA Ever
By definition, CAPTCHA should be easy to read by humans but hard to read by machines. Apparently, they don’t agree with that at D&B:
1998
UCLA computer grad constructs “crown jewel of cryptography”
Aayush Jain’s dissertation, “Indistinguishability Obfuscation from Well-Studied Assumptions,” established the feasibility of mathematically rigorous software obfuscation from well-studied hardness conjectures. The central goal of software obfuscation is to transform source code to make it unintelligible without…
1999
Terraforming 1Password
We are excited to finally have all our development, test, staging, and production environments managed with Terraform.
2000
2001
How to unc0ver a 0-day in 4 hours or less
By Brandon Azad, Project ZeroAt 3 PM PDT on May 23, 2020, the unc0ver jailbreak was released for ...
2002
Facebook doesn't like privacy countermeasures
German tech-news site Heise changed their "Like" buttons to be locally-hosted images that only transform into real Facebook "Like" buttons once you click them -- meaning that if you don't click anything, Facebook can't track you, and that actually "liking" the page requires two clicks. (Also presumably meaning that…
2003
2004
Getting Started with Security Keys
How to stay safe online and prevent phishing with FIDO2, WebAuthn and security keys. A look into YubiKeys, TOTP authenticator apps, passwordless and more.
2005
HealthCare.gov Sends Personal Data to Dozens of Tracking Websites
The Associated Press reports that healthcare.gov–the flagship site of the Affordable Care Act, where millions of Americans have signed up to receive health care–is quietly sending personal health information to a number of third party websites. The information being sent includes one's zip code,...
2006
2007
2008
AdNauseam Banned from the Google Web Store
For 3 years AdNauseam has been used by tens of thousands of Chrome, Firefox and Opera users, who oppose the unethical surveillance advertising model. Now Google banned it from its Web Store on very dubious charges. Furthermore Google locked AdNauseam users out of their ad data. Today it's your privacy tool, tomorrow…
2009
iCloud Drive silently deletes your content
The first time it happened, I was writing a paper. The paragraphs I had just typed vanished into thin air, faster than Time Machine or Backblaze could save them. Gone. The next occurrence was during app development; Xcode suddenly flagged numerous errors in previously error-free code. My recent changes to several…
2010
This year’s insane timeline of hacks
An archive of this year’s insane timeline of hacks few people are talking about