Top all-time · #4296
Paul Moore
Personal blog · paul.reviewssecurity
Paul Moore's personal blog at paul.reviews covers security. Since 2015, 18 different Hacker News readers have linked it 18 times, most often “CyberAlarm: An independent security review and why you should avoid it”. It is still writing: the last post was on 2026-09-22, and you can follow it by feed.
Too few sampled comments (7) to say how often HN recommends it.?
Why HN links it
HN readers link Paul Moore's security write-ups, including reviews of the UK Police CyberAlarm code and TalkTalk's weak security, and password advice. Commenters cite them as sources.
Summarised by Claude from a sample of 7 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Paul Moore: Information Security Consultant & Researcher
Most-linked posts?
- CyberAlarm: An independent security review and why you should avoid it3 people · 3 mentions · first linked 2020-11-27
- /value-security-avoid-talktalk/3 people · 3 mentions · first linked 2015-10-23
- Behavioral Profiling: The password you can't change3 people · 3 mentions · first linked 2015-07-30
- Passwords: Using 3 Random Words Is a Really Bad Idea (2017)2 people · 2 mentions · first linked 2018-12-02
- Police CyberAlarm: Abysmal security, yet again2 people · 2 mentions · first linked 2022-08-02
- Don't let them paste passwords (2017)2 people · 2 mentions · first linked 2017-09-15
What Hacker News says?
Hopefully it's slightly less pathetic than the "Police CyberAlarm". https://paul.reviews/police-cyberalarm-abysmal-security-yet-... https://scottarc.blog/2022/07/04/police-cyberalarm-uses-alar...
Comment linking /police-cyberalarm-abysmal-security-yet-again/
on “UK Government scans all web servers hosted in the UK for vulnerabilities”Submitted Behavioral Profiling: The password you can't change as a story · 191 points
HN discussionI admit that, reading the code, I found it challenging to find a severe crypto bug simply because everything is wrong. Even their way of packing the data into a base64 is nonsense. The parser is nonsense. Almost every line of code is wrong. Without more context, I’m not quite convinced that the key is reliably anything other than a constant due to the use of PHP and the failure to validate that the variables in ques…
Comment linking /cyberalarm-an-independent-security-review-and-why-you-should-avoid-it/
on “Police CyberAlarm Uses Alarming Cryptography”Submitted Passwords: Using 3 Random Words Is a Really Bad Idea (2017) as a story · 43 points
HN discussionHonestly, the cryptography part of it is the least concerning (if it was just that it would be an easy fix). Here's a summary with some screenshots of the code: https://paul.reviews/cyberalarm-an-independent-security-revi... The entire project is an unsalvageable mess and so is their response - clearly they've outsourced the entire thing to idiots and are trying to cover their ass now that it's been publicized.
Comment linking /cyberalarm-an-independent-security-review-and-why-you-should-avoid-it/
on “Police CyberAlarm Uses Alarming Cryptography”Submitted Behavioral Profiling: The password you can't change (2015) as a story · 38 points
HN discussionSome quick googling gave me this: https://paul.reviews/passwords-why-using-3-random-words-is-a... (also good stuff here: https://security.stackexchange.com/questions/151165/is-rando... ) It seems the consensus is to use 5-6 words, and following the xkcd trick of 4 may not be enough.
Comment linking /passwords-why-using-3-random-words-is-a-really-bad-idea/
on “The Bare Minimum You Should Do to Protect Your Family's Data”Submitted The Property Jungle: I'm a security researcher, get me out of here as a story · 37 points
HN discussionThat would be useful, but won't solve the problem alone. It's highly likely there were any number of engineers in these companies fuming about poor practice, but lacking management support to prioritise it. Look at how TalkTalk ignored a security researcher's warnings a year before incurring a major attack. They were also storing in plain-text, available to support staff, and came up with comments like "We're squeak…
Comment linking /value-security-avoid-talktalk/
on “100M clear text passwords stolen from Russia's biggest social network”Submitted Don't let them paste passwords (2017) as a story · 3 points
HN discussionPaul Moore's findings from one year ago: https://paul.reviews/value-security-avoid-talktalk/
Comment linking /value-security-avoid-talktalk/
on “TalkTalk cyber-attack: Website hit by 'significant' breach”Submitted CyberAlarm: An independent security review and why you should avoid it as a story · 3 points
HN discussionPaul Moore covered their weak security a year ago [1]. Worth a read. I've always avoided TalkTalk because they keep sending me junk mail reminding me that they offer free broadband if I take out a phone package, etc. It just screams race to the bottom. 1. https://paul.reviews/value-security-avoid-talktalk/
Comment linking /value-security-avoid-talktalk/
on “TalkTalk cyber-attack: boy, 15, arrested in Northern Ireland”Submitted Police CyberAlarm: Abysmal security, yet again as a story · 2 points
HN discussionSubmitted Behavioral Profiling: The password you can't change as a story · 2 points
HN discussionSubmitted HarmBlock+ Safest Smartphone: Please Rotate Responsibly as a story · 1 points
HN discussionSubmitted Tiffin Tom: Fish, chips and a side of identity theft as a story · 1 points
HN discussionSubmitted Don't Let Them Paste Passwords as a story · 1 points
HN discussion
