Top all-time · #7057
Privacy Log
Personal blog · privacylog.blogspot.comsecurityweb
Privacy Log is a personal blog at privacylog.blogspot.com about security and web. Since 2010, 10 different Hacker News readers have linked it 18 times, most often “Mozilla's CSS (and Chrome 6) :visited solution is still vulnerable”. The last post was in 2023, but the archive is still widely read.
Too few sampled comments (8) to say how often HN recommends it.?
Why HN links it
HN readers link this blog for security and privacy write-ups: a CSS :visited history leak in Firefox and Chrome, Safari phishing popups, IPv6 privacy, and vulnerability disclosure disputes with HackerOne and PayPal.
Summarised by Claude from a sample of 8 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Finding privacy and security issues online. Includes live case studies!
Most-linked posts?
- Mozilla's CSS (and Chrome 6) :visited solution is still vulnerable3 people · 4 mentions · first linked 2010-09-07
- Security Flaws with Apple's Two-Factor Authentication2 people · 3 mentions · first linked 2019-08-08
- What Happens When You Send a Zero-Day to a Bank?2 people · 2 mentions · first linked 2017-04-21
What Hacker News says?
I would be more supportive if HackerOne just gave me a form so I can do this myself. I do not need HackerOne to take credit for my work and and do not need them to represent me. I'm a big boy and can follow my own ethics and take my own consequences. If other people feel the same way, I'll fork and make a repo. EFF is a great starting point but it is not nearly usable as a HOWTO. I'm putting my balls on the line by…
Comment linking /2008/10/pre-announcement.html
on “What Happens When You Send a Zero-Day to a Bank?”Submitted What Happens When You Send a Zero-Day to a Bank? as a story · 1494 points
HN discussionIf you are receiving your money or reputation from a platform (like HackerOne) then you are going to be underappreciated, undervalued, and treated like an expense that should be minimized. Here is what responsible disclosure looks like in 2020 from somebody that has self-worth: > (Message posted to Hacker One, and emailed to any address you can find, and sent in a letter by mail. Yes mail. Also copied in all those w…
Comment linking /
on ““We found PayPal vulnerabilities and PayPal punished us for it””Submitted The Second SHA-1 Hash Collision as a story · 39 points
HN discussionHere is my list of solo developer blogs. Usually they are on topic. This does not include personal blogs I follow that happen to be developers. @mdo (Bootstrop) - http://markdotto.com/ Keith Cirkel - https://www.keithcirkel.co.uk/ Coding – Corbin's Treehouse - https://www.corbinstreehouse.com/blog Aaditya Purani – Ethical Hacker - https://aadityapurani.com/ Ben Balter - http://ben.balter.com/ fulldecent - https://pr…
Comment linking /
on “Ask HN: What are good solo developer blogs that you enjoy reading?”Submitted Mozilla's CSS (and Chrome 6) :visited solution is still vulnerable as a story · 5 points
HN discussionSafari is also vulnerable to phishing popups that are indistinguishable from Apple popups. https://privacylog.blogspot.com/2019/06/safari-zero-day-any-...
Comment linking /2019/06/safari-zero-day-any-website-can-request.html
on “macOS 10.15 Vista”Submitted New UI to guarantee stronger user passwords as a story · 3 points
HN discussionI like the paper. It it is interesting to see other people that are interested in this. When I try to explain why IPv6 is a privacy failure and consumers should turn it off I get modded to oblivion. https://privacylog.blogspot.com/2019/09/ipv6-hurts-your-priv... But when other people are aware of passive attacks and see the economic incentives I think there might still be hope.
Comment linking /2019/09/ipv6-hurts-your-privacy-removes.html
on “Gnu: Net”Submitted Security Flaws with Apple's Two-Factor Authentication (2019) as a story · 2 points
HN discussionI confirm this. http://privacylog.blogspot.com/2010/08/mozillas-css-visited-... is still able to detect if i visited a link, on both Firefox 4 beta and Chrome 6. But i don't think it is a threat because Mozilla and Google also blocked document.getElementById(x).style.color. So wouldn't this be practically unexploitable ?
Comment linking /2010/08/mozillas-css-visited-solution-is-still.html
on “Mozilla's CSS (and Chrome 6) :visited solution is still vulnerable”Submitted What Happens When You Send a Zero-Day to a Bank? (2017) as a story · 2 points
HN discussionclickable http://privacylog.blogspot.com/2010/08/mozillas-css-visited-...
Comment linking /2010/08/mozillas-css-visited-solution-is-still.html
on “Firefox 4, chrome 6 and 7 still vulnerable to CSS history hack”Submitted Security Flaws with Apple's Two-Factor Authentication as a story · 2 points
HN discussionNot for all elements, but even if they say that is not going to create issues, i am already noticing styling troubles here and there on the web. This is not a good practice. The CSS history leakage problem is not so serious. Much worse are timing attack based on your cached images to check your history. And they do exist. More over it seems that somebody already got a trick around Mozilla's fix http://privacylog.blo…
Comment linking /2010/08/mozillas-css-visited-solution-is-still.html
on “Ask HN : Chrome 6 and 7 getComputedStyle(el,prop) is lying, did anyone notice?”Submitted Security Flaws With Apple's 2FA (2019, though flaws persist) as a story · 1 points
HN discussionSubmitted The Ethics of Not Disclosing Vulnerabilities as a story · 1 points
HN discussionSubmitted What happens when you report a web server vulnerability to Apple? as a story · 1 points
HN discussion
