61
Claude Code can debug low-level cryptography
Surprisingly (to me) Claude Code debugged my new ML-DSA implementation faster than I would have, finding the non-obvious low-level issue that was making Verify fail.
62
How the US defense secretary circumvents official DoD communications equipment
A weblog about Signals Intelligence, Communications Security and top level telecommunications equipment
63
Apple Exclaves
Enhancing kernel isolation, one step at a time.
64
Google shared my phone number
When people started calling my personal mobile number with questions about a voluntary organisation I'm involved with, I was confused: we weren't sharing that number. It turns out that Google had decided to take the number I used to verify my identity for Google Business some years prior and start putting it in Google…
65
Remote code execution via MIDI messages
Blog post about a reverse engineering project
66
4Chan Lawyer publishes Ofcom correspondence
Ofcom — driven by the letter of British law that they are bound to follow, but still Ofcom — are quietly making Britain look (a) very silly and (b) as if we haven’t yet shucked-off the Americ…
67
68
How I discovered a hidden microphone on a Chinese NanoKVM
NanoKVM is a hardware KVM switch developed by the Chinese company Sipeed. Released last year, it enables remote control of a computer or server using a virtu...
69
My Scammer Girlfriend: Baiting a Romance Fraudster
Romance fraud has been growing as an issue for years. It's not uncommon to see news stories with bewildered victims explaining just how deeply they'd been sucked in. After receiving a number of opener
70
Fully homomorphic encryption and the dawn of a private internet
This article is archived on mirror.xyz , and attracted discussion on Hacker News Generated by this notebooklm Gene Spafford "Using encryption on the…
71
72
Vanishing from Hyundai’s data network
Finding and disabling the cellular modem for BlueLink in the Kona EV
73
My Lethal Trifecta talk at the Bay Area AI Security Meetup
I gave a talk on Wednesday at the Bay Area AI Security Meetup about prompt injection, the lethal trifecta and the challenges of securing systems that use MCP. It wasn’t …
74
Scammed out of $130K via fake Google call, spoofed Google email and auth sync
On June 19th, my life changed with a phone call.
75
76
Burner Phone 101
Hosted by the Brooklyn Public Library, this Burner Phone 101 workshop introduced participants to phone-related risk modeling, privacy-protective smartphone practices, the full spectrum of burner phone options, and when to leave phones behind entirely.
77
DOGE as a National Cyberattack
In the span of just weeks, the US government has experienced what may be the most consequential security breach in its history—not through a sophisticated cyberattack or an act of foreign espionage, but through official orders by a billionaire with a poorly defined government role. And the implications for national…
78
79
The Web Is Broken – Botnet Part 2
I guess you have all heard about the growing problem of AI companies trying to aggressively collect whatever data they can get their hands on to train their models. This has caused an explosive surge in web crawlers relentlessly hitting servers big and small. But who runs these crawlers? Turns out — it could be you!
80
81
Ghrc.io appears to be malicious
A simple typo of ghcr.io to ghrc.io would normally be a small goof. You’d typically get a 404 or similar error, finally work out the issue, fix it, and move along. But in this case, that typo appears to be doing something very malicious, stealing GitHub credentials. What’s ghcr.io? First, a quick bit of background…
82
Uncomfortable Questions About Android Developer Verification
Google announced a program that is proving to be unpopular among Android app development experts. I have questions.
83
Web Browsers have stopped blocking pop-ups
If you were an Internet user for a few years on either side of the turn of the millennium, you will remember pop-up advertisements.
84
UK House of Lords attempting to ban use of VPNs by anyone under 16
This is deranged, each nation’s boomers and reactionaries attempting to outdo the others: “Action to prohibit the provision of VPN services to children in the United Kingdom” … th…
85
Apple vs the Law
Apple & Google at the EU DMA compliance workshops, June 2025.
86
Github scam investigation: Thousands of “mods” and “cracks” stealing data
While looking through the articles on a "social engineering" themed forum I discovered a relatively new scam scheme that shocked me. People create thousands of GitHub repositories with all sorts of things - from Roblox and Fortnite mods to "cracked" FL Studio and Photoshop. As soon as you download and
87
Feds Link Cyberheist to 2022 LastPass Hacks
In September 2023, KrebsOnSecurity published findings from security researchers who concluded that a series of six-figure cyberheists across dozens of victims resulted from thieves cracking master passwords stolen from the password manager service LastPass in 2022. In a court filing this week, U.S. federal agents…
88
Can you trust that permission pop-up on macOS?
A security research blog.
89
Homomorphic encryption in iOS 18
A mathematical miracle enables Apple's servers to process your photos while never knowing anything about them
90
Okta Bcrypt incident lessons for designing better APIs
Hello there! If you follow tech news, you might have heard about the Okta security incident that was reported on 1st of November. The TLDR of the incident was …