2431
How did LastPass master passwords get compromised?
LastPass accounts are under attack. I look into how user’s master passwords might have leaked.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,768 posts.
2432
Let's Encrypt now supports ACME-CAA: closing the DV loophole
Today, Let's Encrypt announced that they are enabling an extension to DNS CAA records known as ACME-CAA ( RFC 8657 ). This came as a surprise to me, but a very pleasant one, since I wrote the ACME-CAA specification back in 2016 with Let's Encrypt in mind, and it was finally published as RFC 8657 back in 2019. To my…
2433
The unattributable “db8151dd” data breach
I was reticent to write this blog post because it leaves a lot of questions unanswered, questions that we should be able to answer. It's about a data breach with almost 90GB of personal information in it across tens of millions of records - including mine. Here's what I
2434
Psychic Signatures in Java
The long-running BBC sci-fi show Doctor Who has a recurring plot device where the Doctor manages to get out of trouble by showing an identity card which is actually completely blank. Of course, thi…
2435
Achieving an open-source implementation of Apple Code Signing and notarization
As I've previously blogged in Pure Rust Implementation of Apple Code Signing (2021-04-14) and Expanding Apple Ecosystem Access with Open Source, Multi Platform Code signing (2022-04-25), I've been hacking on an open source implementation of Apple code signing and notarization using the Rust programming language. This…
2436
Why does that QR Code go to justinsomnia.org?
Back in 2007 I stumbled upon something called a QR Code . It was a neat two-dimensional barcode that encodes textual information visually—with URLs being a promising application for the emerging smartphone market (thanks to the release of the iPhone that year). So I did what any self-respecting personal blogger would…
2437
2438
FISA "reform" bill would greatly expand the entities forced to surveil users
Yesterday the House Permanent Select Committee on Intelligence unanimously approved the FISA Reform and Reauthorization Act of 2023 (FRRA), which would reauthorize Section 702 of the Foreign Intelligence Surveillance Act (FISA 702). The full House is expected to vote on this bill next Tuesday. Like other competing…
2439
An XSS on Facebook via PNGs and Wonky Content Types
Bug Bounty & Application Security
2440
EU Council to Vote on Chat Scanning Proposal on Thursday
🇫🇷 French: Traduction du dossier Chat Control 2.0, stopchatcontrol.fr🇸🇪 Swedish: Chat Control 2.0🇩🇰 Danish: chatcontrol.dk🇳🇱 Dutch: Chatcontrole Table of contents: The End of the Privacy of Digital Correspondence and the End of Anonymous Communication Take action to stop Chat
2441
A Postmark backdoor that’s downloading emails
Secure the modern software stack with Koi. Gain visibility, context, and real-time protection over extensions, MCPs, and autonomous AI agent endpoints.
2442
Reversing Safeway's private APIs to automate coupon collection
Reverse-engineering Safeway's coupon APIs to automate adding digital offers to an account.
2443
2444
Missouri governor’s office responsible for teacher data leak
Missouri Governor Mike Parson made headlines last year when he vowed to criminally prosecute a journalist for reporting a security flaw in a state website that exposed personal information of more than 100,000 teachers. But Missouri prosecutors now say they will not pursue charges following revelations that the data…
2445
Forging signed commits on GitHub
Creating fake signed commits
2446
2447
Fraudulent Advertising on Facebook
This story starts with Sidney Crosby. A professional hockey player and Canadian icon. I can neither confirm nor deny that I welled up like…
2448
Attacking machine learning with adversarial examples
Adversarial examples are inputs to machine learning models that an attacker has intentionally designed to cause the model to make a mistake; they’re like optical illusions for machines. In this post we’ll show how adversarial examples work across different mediums, and will discuss why securing systems against them…
2449
2450
A penetration tester’s guide to sub-domain enumeration
Security research and technical deep dives from the Appsecco team — cloud attacks, Kubernetes security, vulnerability analysis, and AppSec engineering.
2451
Twitter's Secret “Guest Mode”
Twitter has an undocumented feature which lets you follow accounts without being logged in. Here's how I found it, and how you can use it. My crappy old TV has a crappy old web browser on it. One boring Sunday, I decided to see which websites worked and which didn't on a 6 year old browser. Anything using LetsEncrypt…
2452
How Popular Is “Sign in with Apple”?
Link to: https://benpackard.github.io/blog/2020-01-28-sign-in-with-apple/
2453
OpenAI "rogue" agent activities found on Wikimedia projects
Recently, multiple organisations have disclosed how clusters of so-called “rogue” AI agents attempted to break into websites and online services, sometimes successfully. Agents from OpenAI’s enviro…
2454
Subscription bombing and how to mitigate it
How bots used our sign-up and forgot password pages to bomb real people's inboxes, and what we did to stop it. A practical guide to subscription bombing for founders and developers who think CAPTCHA is an "I'll do it later" task.
2455
Freenom, the free domains website, is a scam
Self-taught developer. Go, Rust, Python and Javascript. - hackermondev
2456
The GNU Name System
This document provides the GNU Name System (GNS) technical specification. GNS is a decentralized and censorship-resistant domain name resolution protocol that provides a privacy-enhancing alternative to the Domain Name System (DNS) protocols. This document defines the normative wire format of resource records…
2457
Distrust of Symantec TLS Certificates
A Certification Authority (CA) is an organization that browser vendors (like Mozilla) trust to issue certificates to websites. Last year, Mozilla published and discussed a set of issues with one ...
2458
Google disables SSL search at BT’s request
Update – Since this was posted, Max Allan and Damion Yates have investigated further and found that BT are intercepting DNS queries and replying with doctored DNS results, which I didn’…
2459
Quantum Computers Are Not a Threat to 128-Bit Symmetric Keys
There is no need to update symmetric key sizes as part of the post-quantum transition, due to the details of how Grover's algorithm scales. Most authorities agree.
2460
Reverse engineering software licensing from early-2000s abandonware
This series concerns a software licensing system used in a proprietary software application from circa 2004. The software was available in an unregistered trial mode with limited functionality. A free licence could be obtained by registering online with the software vendor. The software became abandonware circa 2009…