Top all-time · #7340
Mathy Vanhoef
Personal blog · mathyvanhoef.comsecurityscience
Mathy Vanhoef's personal blog at mathyvanhoef.com covers security and science. Since 2011, 11 different Hacker News readers have linked it 16 times, most often “Exploiting 'INSERT INTO' SQL Injections Ninja Style”. The last post was in 2024, but the archive is still widely read.
Too few sampled comments (3) to say how often HN recommends it.?
Why HN links it
HN readers link Mathy Vanhoef's site for his posts on Wi-Fi security, such as WPA3 technical details, and on WhatsApp security flaws. Commenters cite these posts as sources in discussions of those topics.
Summarised by Claude from a sample of 3 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Professor at KU Leuven (Belgium) | Ex-PostDoc at NYU | Open to consultancy
Most-linked posts?
- Exploiting 'INSERT INTO' SQL Injections Ninja Style2 people · 2 mentions · first linked 2011-10-28
- WhatsApp Considered Insecure2 people · 2 mentions · first linked 2012-05-22
- WPA3: Technical Details and Discussion2 people · 2 mentions · first linked 2018-03-12
What Hacker News says?
Brian Acton and Jan Koum weren’t exceptions either. WhatsApp had some hilariously bad vulnerabilities. Like no authentication on their APIs and trusting the client. https://www.mathyvanhoef.com/2012/05/whatsapp-considered-ins... https://www.mathyvanhoef.com/2012/07/whatsapp-follow-up-unau...
Comment linking /2012/07/whatsapp-follow-up-unauthenticated.html
on “Rookie coding mistake prior to Gab hack came from site’s CTO”Submitted Exploiting 'INSERT INTO' SQL Injections Ninja Style as a story · 46 points
HN discussionWPA3 appears to solve these issues. https://www.mathyvanhoef.com/2018/03/wpa3-technical-details....
Comment linking /2018/03/wpa3-technical-details.html
on “Wi-Fi Alliance Introduces Wi-Fi Certified WPA3 Security”Submitted WPA3: Technical Details and Discussion as a story · 5 points
HN discussionWhatsApp in fact is using NSClassFromString to get access to the private class UITextEffectsWindow ;P. However, I don't think it doing anything to get access to CoreTelephony and pull the IMEI. Another piece of evidence for this is an article published on a website I found while searching for the API endpoints that WhatsApp is connecting to; this person pulled apart the Android client. http://www.mathyvanhoef.com/20…
Comment linking /2012/05/whatsapp-considered-insecure.html
on “WhatsApp is using your IMEI number as password”Submitted Providing source code when submitting papers: anonymous but protected access as a story · 3 points
HN discussionThis is very similar to our earlier work on the security of MAC address randomization: http://papers.mathyvanhoef.com/asiaccs2016.pdf They provide some more practical details if you want to implement our probe request fingerprint tracking mechanism. This is a passive tracking technique. Their method to track all devices requires actively sending packets for every single MAC address that is being tracked. The (imperf…
Comment linking /2013/11/unmasking-spoofed-mac-address.html
on “A Study of MAC Address Randomization in Mobile Devices and When It Fails”Submitted How MAC Address Randomization Works on Windows 10 (and can be defeated) as a story · 3 points
HN discussionSubmitted Jamming WiFi Using Cheap USB Dongles as a story · 3 points
HN discussionSubmitted Making the Cloudflare Warp VPN Leak DNS Requests as a story · 2 points
HN discussionSubmitted Understanding the heap and exploiting heap overflows (2013) as a story · 2 points
HN discussionSubmitted Exploiting 'INSERT INTO' SQL Injections Ninja Style as a story · 2 points
HN discussionSubmitted WhatsApp Considered Insecure as a story · 2 points
HN discussionSubmitted UCSB iCTF: Hacking Nuclear Plants and Pwning ASLR/NX as a story · 1 points
HN discussionSubmitted Foundations of Privacy as a story · 1 points
HN discussion
