1
When you browse Instagram and find Tony Abbott's passport number
Do not get arrested challenge 2020
2
Wacom tablets track every app you open
I have a Wacom drawing tablet. I use it to draw cover illustrations for my blog posts, such as this one.
3
Your Computer Isn't Yours
There have been several updates appended to this page as of 2020-11-16, please see below. Also available in: Türkçe Français Español Português Português…
4
We Hacked Apple for 3 Months
Between the period of July 6th to October 6th myself, Brett Buerhaus, Ben Sadeghipour, Samuel Erb, and Tanner Barnes worked together and hacked on the Apple bug bounty program.
5
Chrome exempts Google sites from user site data settings
In Google Chrome's "Cookies and site data" settings, accessible via the Preferences menu item or directly with chrome://settings/cookies in the address bar, you can enable the setting "Clear cookies and site data when you quit Chrome". However, I've discovered that Chrome exempts Google's own sites, such as Search and…
6
Why Is This Website Port Scanning Me?
Investigation of the practice of port scanning site visitors for fingerprinting and tracking.
7
Stripe records user movements on its customers' websites
An investigation into how Stripe tracks your users and what you can do to prevent it
8
Reddit's website uses DRM for fingerprinting
But hey, at least Reddit gets less ad fraud!
9
Zero-day in Sign in with Apple
What if I say, your Email ID is all I need to takeover your account on your favorite website or an app. Sounds scary, right? This is what a…
10
GitHub Source Code Leak
Straight talk on Canadian online privacy, open-source software, PIPEDA, browser extension security, and practical tools to protect your personal data.
11
How we recovered $300k of Bitcoin
Story time! Around twenty years ago, I was working as a reverse-engineer and cryptanalyst for AccessData while getting my Physics degree at BYU. It was the late 90s and early 2000s. The US governme…
12
Who’s behind the “reopen” domain surge?
The past few weeks have seen a large number of new domain registrations beginning with the word “reopen” and ending with U.S. city or state names. The largest number of them were created just hours after President Trump sent a series of all-caps tweets urging citizens to “liberate” themselves from new gun control…
13
Security by obscurity is underrated
Some thoughts about cyber security, technology and life - https://utkusen.com/. Click to read Utku Sen’s Substack, a Substack publication with hundreds of subscribers.
14
Security Flaws in Adobe Acrobat Reader Allow Gaining Root on macOS Silently
Yuebin Sun(@yuebinsun2020) of Tencent Security Xuanwu Lab 0x0 SummaryToday, Adobe Acrobat Reader DC for macOS patched three critical vulnerabilities(CVE-2020-9615, CVE-2020-9614, CVE-2020-9613) I repo
15
Don't use third party auth to sign in
If a website offers you to sign-in using Google (or any third-party service, say Facebook, Github, etc.), don’t use that feature.
16
Pay up or we’ll make Google ban your ads
A new email-based extortion scheme apparently is making the rounds, targeting Web site owners serving banner ads through Google’s AdSense program. In this scam, the fraudsters demand bitcoin in exchange for a promise not to flood the publisher’s ads with so much bot and junk traffic that Google’s automated anti-fraud…
17
Who’s behind Wednesday’s epic Twitter hack?
Twitter was thrown into chaos on Wednesday after accounts for some of the world’s most recognizable public figures, executives and celebrities starting tweeting out links to bitcoin scams. Twitter says the attack happened because someone tricked or coerced an employee into providing access to internal Twitter…
18
Another free CA as an alternative to Let's Encrypt
Let's Encrypt is an amazing organisation doing an amazing thing by providing certificates at scale, for free. The problem though was that they were the only such organisation for a long time, but I'm glad to say that the ecosystem is changing. It's always a good idea
19
When in doubt: hang up, look up, and call back
Many security-conscious people probably think they’d never fall for a phone-based phishing scam. But if your response to such a scam involves anything other than hanging up and calling back the entity that claims to be calling, you may be in for a rude awakening. Here’s how one security and tech-savvy reader got taken…
20
I'm Open Sourcing the Have I Been Pwned Code Base
Let me just cut straight to it: I'm going to open source the Have I Been Pwned code base. The decision has been a while coming and it took a failed M&A process to get here, but the code will be turned over to the public for the
21
Don't touch my clipboard
Looking for an em dash I was recently trying to find an em dash character to use in a piece of writing. Since I don’t have the shortcut memorized—for future reference, shift+option+minus on Mac—I did a quick search for it. I didn’t see one on the search results page to copy, so I clicked into the first result: “The…
22
23
The EARN IT act is an attack on end-to-end encryption
Yesterday a bipartisan group of U.S. Senators introduced a new bill called the EARN IT act. On its face, the bill seems like a bit of inside baseball having to do with legal liability for informati…
24
WebKit will delete all local storage after 7 days
Apple will delete your data if you don’t use an app for seven days. This effectively kills offline web apps.
25
CAPTCHAs don’t prove you’re human – they prove you’re American (2017)
When I was a small child, I took an IQ test. One of the first questions I stumbled on was "A piece of candy costs 25¢. Jonny has a dime. How many nickels does he need to buy the candy?" My 7-year old brain popped. WTAF is a nickel? Or a dime for that matter? We don't have those coins in my country! We don't spend in ¢…
26
US Secret Service: “Massive Fraud” Against State Unemployment Insurance Programs
A well-organized Nigerian crime ring is exploiting the COVID-19 crisis by committing large-scale fraud against multiple state unemployment insurance programs, with potential losses in the hundreds of millions of dollars, according to a new alert issued by the U.S. Secret Service .
27
Danish military intelligence uses XKEYSCORE to tap cables in co-op with the NSA
A weblog about Signals Intelligence, Communications Security and top level telecommunications equipment
28
Facebook's Hypocrisy on Apple's New iOS 14 Privacy Feature
In their latest attempt to disrupt the iOS anti-ad tracking feature, Facebook has stooped to a new low
29
I Hacked into Facebook's Legal Department Admin Panel
Alaa Abdulridha — Engineering Director at SerpApi & Cybersecurity Researcher. Expert in web application penetration testing, reverse engineering, bug bounty programs, and secure code development. Passionate about discovering vulnerabilities, building scalable systems, and teaching practical cybersecurity techniques.
30
Who is Facebook's mysterious “Lan Tim 2”?
Facebook has an interesting feature. It will let you see which companies have associated your off-Facebook activity with your Facebook account. If you visit: https://www.facebook.com/off_facebook_activity/ you'll see what companies are snitching on you to Facebook. Alice St⭕️llmeyer@StollmeyerEU#AirBnB shares your…