2101
Double Blind Passwords a.k.a. Horcruxing
Before we get into Horcruxing, here's a quick prologue on online security hygiene. You can skip to the Horcruxing section if it seems redundant. 1. Longer…
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,767 posts.
2102
Oh, the Places Your Apple ID Will Go
Here is a short and curious Twitter thread from app developers and security researchers Tommy Mysk and Talal Haj Bakry: Apple’s analytics data include an ID called “dsId”. We were able to verify that “dsId” is the “Directory Services Identifier”, an ID that uniquely identifies an iCloud account. Meaning, Apple’s…
2103
Aaron Swartz, Vindicated
Almost without exception, people who invest in businesses do so without personally inspecting the business, overlooking its processes, seeing its bank statements, meeting its managers and going on the road with its sales-force.
2104
Understanding L1 Terminal Fault aka Foreshadow: What You Need to Know
L1 Terminal Fault/Foreshadow explained in ~three minutesFor a more detailed technical view of L1 Terminal Fault, please see this deeper dive with Jon Masters.How we got here: a brief history of modern microprocessor cachesModern computer microprocessors are complex machines, filled with many optimizations designed to…
2105
When security goes right
A few weeks ago, I heard that my slow and unreliable ISP was raising their prices, and I decided to look around for a better ISP. I found one in the form of Novus , which has fibre runs to towers around the Vancouver area. I signed up; they came to the building and placed the necessary patch cable in the basement…
2106
Trick users and bypass warnings – Modern SVG Clickjacking attacks
A novel and powerful twist on an old classic.
2107
Weaponizing and Gamifying AI for WiFi Hacking: Presenting Pwnagotchi 1.0.0
This is the story of a summer project that started out of boredom and that evolved into something incredibly fun and unique. It is also the story of how that p…
2108
The Hugging Face incident and the road ahead
OpenAI shares findings from the Hugging Face security incident and the steps we’re taking to strengthen AI model security, monitoring, and alignment.
2109
JWT should not be your default for sessions
When designing web applications, (especially the traditional HTML kind), you will at one point have to figure out how to log a user in and keep them logged in between requests.
2110
Anatomy of a Rental Phishing Scam
I was recently the (unsuccessful) target of a very well-crafted phishing scam. As part of a housing search a few weeks ago, I was trawling craigslist and zillow for rental opportunities in the SF bay area. I reached out to a beautiful looking rental place to inquire about a tour. Despite my experience as a security…
2111
Remote code execution in cdnjs of Cloudflare
Preface (日本語版も公開されています。) Cloudflare, which runs cdnjs, is running a “Vulnerability Disclosure Program” on HackerOne, which allows hackers to perform vulnerability assessments. This article describes vulnerabilities reported through this program and published with the permission of the Cloudflare security team. So this…
2112
The retaliation: Pranking my roommate with targeted Facebook ads (2014)
This is the chronicle of the most epic retaliation and how I pranked my roommate with targeted Facebook Ads to the point of complete paranoia and delusion.
2113
Juniper: Recording Some Twitter Conversations
Update : Ralf wrote up some notes from his work. These now include an update themselves with information from Willem Pinckaers that suggests that the presumed Dual-EC output is exposed to the world in Juniper devices.
2114
An Overview of Cryptography
Free, evolving crypto tutorial since 1999!
2115
2116
The bait-and-switch hidden in today’s cookie announcement
T oday is going to be the day that you read a lot about the UK’s intention to kill cookie pop-ups as part of its post-Brexit Data Reform Bill. By now you should have somehow realised that there’s a bit more to it than that, and that your work is not set to get any easier.
2117
Top downloaded skill in ClawHub contains malware
The same capabilities that make OpenClaw a groundbreaking tool also make it an urgent security risk. This blog contains confirmed examples of agent skills being used as malware vectors, and advice on how to protect yourself if you're experimenting with them.
2118
Google Play rejected Tor Browser update with security fixes
Tor Browser 10.0.7 is now available from the Tor Browser download page and also from our distribution directory.
2119
Disposable Root Servers
Unlimited, free and dedicated Kali Linux Root Shells - readily set up for hackers. Traffic via VPNs. Accessible directly or via TOR. NO LOGZ.
2120
How to Hack APIs in 2021
Detectify Crowdsource is not your average bug bounty platform. It’s an invite-only community of the best ethical hackers who are passionate about securing modern technologies ...
2121
2122
2123
How likely is losing a Google account?
Let's say you use a Google account as the root of your online identity: Gmail, Fi, "Sign in with Google", Google's password manager, etc. How much should you be worried that you'll suddenly find yourself unable to get into everything? Should you do something else instead? To get a sense of how common lockouts are and…
2124
Anonymous Source Shared Leaked Google Search API Documents
Update: We are diving deep into the Google API leak and what it means for marketers in our next episode of SparkToro Office Hours on June 27. Join Michael
2125
Chrome: Heap buffer overflow in WebP
The Stable and Extended stable channels has been updated to 116.0.5845.187 for Mac and Linux and 116.0.5845.187/.188 for Windows, which will...
2126
Stop forcing arbitrary password rules
Arbitrary password rules are a vain attempt to increase security by forcing unnecessary complexity
2127
I made 50k calls to explore the telephone network
Post describing my research wardialing Finnish freephones.
2128
Arti – An implementation of Tor in Rust
Arti 0.1.0 is released, and available for download.
2129
Apple has a bug in its disk I/O throttling code that affects raw disk copies
Matt Jacobson, recovering software engineer.
2130
ISPs Removing Their Customers' Email Encryption
Recently, Verizon was caught tampering with its customer's web requests to inject a tracking super-cookie. Another network-tampering threat to user safety has come to light from other providers: email encryption downgrade attacks. In recent months, researchers have reported ISPs in the US and...