Hacker Blogs
Work in progress: 181,232 of 181,233 sites checked so far, more every week · updated 2 Nov 2026Missing a blog? Tell us

Top all-time · #10325

M

Masato Kinugawa

Personal blog · mksben.l0.cmsecurity

Masato Kinugawa writes MKSB(en), a personal blog at mksben.l0.cm about security. Since 2015, 7 different Hacker News readers have linked it 7 times, most often “CSS Based Attack fontface”. The last post was in 2021, but the archive is still widely read.

Visit the blog
7mentions?
7HN people?
2015–2021first – last linked?
Links on Hacker News per year · peak 2 in 2015

Too few sampled comments (2) to say how often HN recommends it.?

Why HN links it

HN readers link Masato Kinugawa's web security write-ups, covering XSS defenses and CSS-based data theft. Commenters cite them for technical background and to note the limits of the attacks described.

Summarised by Claude from a sample of 2 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.

Masato Kinugawa's Security Blog / @kinugawamasato

Most-linked posts?

  1. CSS Based Attack fontface
    4 people · 4 mentions · first linked 2015-10-24

What Hacker News says?

  1. tshadwell · 2016-03-30
    Some notes: 1) Never blacklist. Seriously, unless you are in the business of writing and securing browser parsers, you are never going to catch everything. There are many vectors not listed on OWASP's XSS Filter Evasion Cheat Sheet. See https://www.w3.org/TR/html5/scripting-1.html#restrictions-fo... for an idea of what you're up against. Because of the incredible number of ways you can cause security vulnerabilities…

    Comment linking /2015/10/css-based-attack-abusing-unicode-range.html

    on “The Basics of Web Application Security”
  2. Wingy · 2020-10-19

    Submitted Discord Desktop App RCE as a story · 311 points

    HN discussion
  3. Buge · 2018-02-17
    These only allow attacks where the desired data exists in the html of the page that the browser downloads (or can be forced there). You can also do font-based attacks that will steal data that is entered dynamically. http://mksben.l0.cm/2015/10/css-based-attack-abusing-unicode...

    Comment linking /2015/10/css-based-attack-abusing-unicode-range.html

    on “Stealing Data with CSS: Attack and Defense”
  4. renlinx · 2015-11-02

    Submitted CSS Based Attack fontface as a story · 176 points

    HN discussion
  5. pentestercrab · 2021-11-29

    Submitted Data Exfiltration via CSS and SVG Font as a story · 57 points

    HN discussion
  6. based2 · 2020-05-21

    Submitted CVE-2020-11022/CVE-2020-11023: jQuery 3.5.0 Security Fix details as a story · 1 points

    HN discussion
  7. as1ndu · 2015-10-24

    Submitted Font-face CSS Security bug detected as a story · 1 points

    HN discussion

Search all of HN for mksben.l0.cm