Top all-time · #1790
Mike Love
Personal blog · grepular.comsecuritysystems
Mike Love's personal blog at grepular.com covers security and systems. Since 2011, 43 different Hacker News readers have linked it 236 times, most often “Automatically Encrypting all Incoming Email”. It is still writing: the last post was on 2026-11-01, and you can follow it by feed.
Mike Love's blog on Linux, security, and privacy — tutorials, analysis, and tools
Most-linked posts?
- Automatically Encrypting all Incoming Email8 people · 27 mentions · first linked 2011-05-02
- Neat trick for getting private info for Facebook, GMail, Twitter and Digg users5 people · 9 mentions · first linked 2011-01-25
- Protecting a Laptop from Simple and Sophisticated Attacks4 people · 11 mentions · first linked 2011-08-26
- Protecting Your GNU Linux System from Dropbox 3 people · 5 mentions · first linked 2012-05-30
- An NFC PGP SmartCard for Android2 people · 6 mentions · first linked 2015-04-21
- LastPass Vulnerability Exposes Account Details2 people · 5 mentions · first linked 2011-02-26
- Smart Cards and SSH Authentication2 people · 4 mentions · first linked 2012-02-02
- /email_privacy_tester/2 people · 4 mentions · first linked 2011-07-14
- Skiff: Various Privacy Failures2 people · 3 mentions · first linked 2023-08-27
- /2 people · 3 mentions · first linked 2026-01-14
What Hacker News says?
I do the unique address thing, but I also have another system for giving out temporary email addresses. If I want to hand an email address which I know should not receive email after say, this Saturday, I'll just give them "2016-09-03@tmp.grepular.com" - I don't have to do anything to set that up, it will accept mail as long as the date isn't after 3rd September 2016. I blogged it up a while ago here: https://grepul…
Comment linking /Automatically_Expiring_Email_Addresses
on “The Dropbox hack is real”Submitted Fun with gzip bombs and email clients as a story · 155 points
HN discussionApparently https://www.grepular.com/ is from UK. Wonder how feels if people start blaming him for colonialism. Govt proscribing access by law is something, but I cannot imagine a guy going out of the way to put ipblocks.
Comment linking /
on “Delete FROM users WHERE location = 'Iran';”Submitted Neat trick for getting private info for Facebook, GMail, Twitter and Digg users as a story · 141 points
HN discussionA web server can be configured to send a default ssl cert if the browser does not support SNI, but can still route the request to the correct virtual host based on the HTTP Host: header if the customer clicks through the warning. The following two https sites exist on the same IP: grepular.com emailprivacytester.com If your browser doesn't support SNI, then the cert for "grepular.com" will be returned by default. So…
Comment linking /
on “Universal SSL”Submitted Protecting a Laptop from Simple and Sophisticated Attacks as a story · 130 points
HN discussionMy passwords are all generated by mashing the keyboard, and are stored in a PGP encrypted file in my Dropbox. When I want to add a password to that file, I just edit it using Vim. Vim automatically handles decryption/encryption because I have the "vim.gnupg" plugin installed. When I want to know a password, I type "password foo", where foo is a substring of some identifier I've used, eg the domain name of the site.…
Comment linking /password.pl_txt
on “Fuck passwords”Submitted Evolution Mail Users Easily Trackable as a story · 114 points
HN discussionI created my own restic backend using Nginx, which allows two different users to authenticate against a repo. The host being backed up knows the credentials that allow it to append. A different host knows the pruning credentials and performs that task. I posted this in another comment, but I did this as follows (I'm the author) - https://www.grepular.com/Nginx_Restic_Backend
Comment linking /Nginx_Restic_Backend
on “Restic – Backups Done Right”Submitted The Sad State of HTML Email Input Fields and IDNs as a story · 106 points
HN discussionI recently set this up using Nginx as my restic backend server. Not as a proxy to a backend server, but the actual backend server. No other applications required: https://www.grepular.com/Nginx_Restic_Backend
Comment linking /Nginx_Restic_Backend
on “Restic – Backups Done Right”Submitted An NFC PGP SmartCard for Android as a story · 71 points
HN discussionThere are some things I like to follow on twitter, but I wanted them integrated in my RSS feed setup, so a few months ago I wrote a simple app which gates twitter to rss, and which can be deployed as a Google Cloud Function. If anyone is interested: https://www.grepular.com/Twitter_to_RSS_with_Google_Cloud_Fu...
Comment linking /Twitter_to_RSS_with_Google_Cloud_Function
on “RSS Is Better Than Twitter”Submitted Keybase Browser Extension Insecure as a story · 69 points
HN discussion> the real answer to this Alternatively, I like the concept of Tor onion services, where the "domains" are acquired in a permissionless fashion. Names are just randomly generated ed25519 strings so there's no squatting and your address never expires . If you want a vanity domain, you just commit compute time to brute force something human-readable. [1] The obvious drawback is that you have to be a Tor client, but if…
Comment linking /Transparent_Access_to_Tor_Hidden_Services
on “The Attempted Corporate Takeover of .Org”Submitted Lavabit Security Misconfiguration as a story · 67 points
HN discussionI did this in Nov 2021 - https://www.grepular.com/Self_Building_and_Executing_Dockerf... #!/usr/bin/env -S bash -c "podman run --rm -w /x -v "\$PWD:/x" \$(podman build -q - < \$0) \${@:1}"
Comment linking /Self_Building_and_Executing_Dockerfiles
on “Show HN: #!/usr/bin/env docker run”Submitted Skiff: Various Privacy Failures as a story · 60 points
HN discussionIf you hack into my email account, you still can't read any password reset emails that are sent to it: https://grepular.com/Automatically_Encrypting_all_Incoming_E...
Comment linking /Automatically_Encrypting_all_Incoming_Email
on “Yes, I was hacked. Hard.”Submitted FastMail.FM Security Vulnerabilities as a story · 53 points
HN discussionOnly yesterday, I wrote up how I use a smart card and reader with hardware pin pad for SSH authentication. Seems relevant: https://grepular.com/Smart_Cards_and_SSH_Authentication
Comment linking /Smart_Cards_and_SSH_Authentication
on “SSH tricks”Submitted Nginx Restic Back End as a story · 48 points
HN discussionI'll just chuck this old blog post of mine out there: https://grepular.com/Protecting_a_Laptop_from_Simple_and_Sop... Specifically, the "Securing the Web browser" section. [edit] Also worth mentioning is the stuff about smartcards on that blog post. You can steal my ~/.ssh/ and my ~/.gnupg/, but because I'm using a smartcard, it wont do you any good.
Comment linking /Protecting_a_Laptop_from_Simple_and_Sophisticated_Attacks
on “Firefox exploit found in the wild”Submitted Automatically Encrypting all Incoming Email as a story · 48 points
HN discussionHave you heared of PKA? https://grepular.com/Publishing_PGP_Keys_in_the_DNS If you want to encrypt a message to my key, just run the following command: gpg --auto-key-locate pka -ea -r mike([-dot-])cardwell([-at-])grepular([-dot-])com It will automatically look up my PGP key in the DNS, fetch it, and encrypt to it. My DNS is secured using DNSSEC so if your resolve supports DNSSEC, you can be reasonably sure that the…
Comment linking /Publishing_PGP_Keys_in_the_DNS
on “Keybase.io”Submitted Sandbox Rust Development with Rust Analyzer (2020) as a story · 27 points
HN discussionRe: "Anyone savvy enough to hang out on HN probably has a fair amount of valuable info in their Gmail account" Even if somebody else does get access to my (non gmail) email account, all they're going to see is PGP encrypted emails: https://grepular.com/Automatically_Encrypting_all_Incoming_E... Of course, you have to be running your own mail server to implement this.
Comment linking /Automatically_Encrypting_all_Incoming_Email
on “Hacked Gmail Account”Submitted Evolution Mail Users Easily Trackable Part 2 as a story · 26 points
HN discussionFireGPG has something built in to do this. It's called gpgAuth. http://getfiregpg.org/ It's discontinued though unfortunately. Although there are still people out there making it work with newer versions of Firefox: https://grepular.com/FireGPG_on_Firefox_5
Comment linking /FireGPG_on_Firefox_5
on “Introducing BrowserID: A better way to sign in”Submitted Dropbox Mobile: Less Secure Than Dropbox Desktop as a story · 16 points
HN discussion
