Top all-time · #3381
Sjoerd Langkemper
Personal blog · sjoerdlangkemper.nlsecurityprogramming
Sjoerd Langkemper's personal blog at sjoerdlangkemper.nl covers security and programming. Since 2016, 23 different Hacker News readers have linked it 26 times, most often “Securing cookies with cookie prefixes”. It is still writing: the last post was on 2026-10-28, and you can follow it by feed.
Too few sampled comments (9) to say how often HN recommends it.?
Why HN links it
HN readers link Sjoerd Langkemper's posts on web security, including cookie prefixes, CSRF, timing attacks, token binding and htmx with CSP. Comments cite them as sources or background, without judging the writing.
Summarised by Claude from a sample of 9 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Securing cookies with cookie prefixes3 people · 3 mentions · first linked 2017-02-09
- String Comparison Timing Attacks2 people · 2 mentions · first linked 2024-05-29
- JavaScript can overwrite or remove HTTPONLY cookies2 people · 2 mentions · first linked 2020-05-27
- Password Hacking on TENEX: Using Paged Virtual Memory to Break Security2 people · 2 mentions · first linked 2016-11-01
- Running Etherkey on an ATmega32u4 to emulate a keyboard (2022)2 people · 2 mentions · first linked 2024-02-11
What Hacker News says?
> just like they failed to implement per-site cookies To be fair there has been an ugly solution to this recently, the `__Host-` cookie prefix: https://www.sjoerdlangkemper.nl/2017/02/09/cookie-prefixes/
Comment linking /2017/02/09/cookie-prefixes/
on “Css-only-chat: A truly monstrous async web chat using no JS on the front end”Submitted Htmx does not play well with content security policy as a story · 97 points
HN discussionJVM 8 isn't an implementation, it's a specification. Assuming you mean oracles implementation, it's likely that it is. https://www.sjoerdlangkemper.nl/2016/05/22/should-passwords-... http://www.daemonology.net/blog/2014-09-04-how-to-zero-a-buf... https://man.openbsd.org/explicit_bzero.3
Comment linking /2016/05/22/should-passwords-be-cleared-from-memory/
on “SSH gets protection against side-channel attacks”Submitted Preventing CSRF with the same-site cookie attribute as a story · 57 points
HN discussionI came to the same conclusion. Many string comparison implementations don't actually compare one character at a time. In one case strcmp seemed to compare eight characters at a time, so you would need to guess eight characters correctly to get a time difference. Glibc memcmp can compare 32 bytes at a time. In C# the timing of string compare depends on whether it does Unicode normalization or not. Even then, the diff…
Comment linking /2024/05/29/string-comparison-timing-attacks/
on “Listen to the whispers: web timing attacks that work”Submitted Password Hacking on TENEX: Using Paged Virtual Memory to Break Security as a story · 33 points
HN discussionA few more links that I collected recently on the topic https://github.com/golang/go/issues/73626 https://developer.mozilla.org/en-US/docs/Web/Security/Attack... https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/... https://web.dev/articles/fetch-metadata https://appliedgo.net/spotlight/csrf-dont-mess-with-my-site/ And some older ones that focused on Origin header rather than sec-fetch-* https://www.sjoerd…
Comment linking /2019/02/27/prevent-csrf-with-the-origin-http-request-header/
on “Cross-Site Request Forgery”Submitted String Comparison Timing Attacks as a story · 31 points
HN discussion> Several months ago, I built a project using USB host mode on a Raspberry Pi Pico, which uses a USB numpad to pass messages to an MQTT server. This uses the Rp2040's USB host mode https://gitlab.com/baiyibai/pico-w-usb-host-mqtt-numpad Maybe I read the README a little to quickly, but you seem to be using standard WiFi for communication. As stated in other comments in this thread, this solution already exists. USB t…
Comment linking /2022/11/16/running-etherkey-on-arduino-leonardo/
on “Benchmarking latency across common wireless links for microcontrollers”Submitted MySQL's Random Number Generator as a story · 6 points
HN discussionEverything else aside (where does one put the sleep?) probably stuff like https://www.sjoerdlangkemper.nl/2016/02/11/cracking-php-rand...
Comment linking /2016/02/11/cracking-php-rand/
on “CTTK: Constant-Time Toolkit”Submitted JavaScript can overwrite or remove HTTPONLY cookies as a story · 4 points
HN discussionToken binding provides something like that. With token binding you have a private/public key pair for each site that supports it. An identifier is created from the public key and signed with the private key, to prove your identity. https://www.sjoerdlangkemper.nl/2017/07/05/prevent-session-h...
Comment linking /2017/07/05/prevent-session-hijacking-with-token-binding/
on “Ask HN: What feature would you want the web to “force” next, after HTTPS?”Submitted Overwriting HttpOnly cookies using cookie jar overflow as a story · 3 points
HN discussionThis one surprised me: https://www.sjoerdlangkemper.nl/2024/06/26/htmx-content-secu... <div hx-disable> <%= raw(user_content) %> </div> So, I get that `raw` prevents htmx from being used. I get that `<script>` still works. But I find it scary that if `user_content` is `</div><div>...` that is actually injected, as raw HTML. I would expect that the `<%= raw(user_content) %> only has access to contents of the div it i…
Comment linking /2024/06/26/htmx-content-security-policy/
on “Htmx does not play well with content security policy”Submitted Attacking RSA Keys as a story · 2 points
HN discussionFrom their links: This feature adds a set of restrictions upon the names which may be used for cookies with specific properties. These restrictions enable user agents to smuggle cookie state to the server within the confines of the existing "Cookie" request header syntax, and limits the ways in which cookies may be abused. In a nutshell: `__Secure- ` cookies have to have the `Secure` flag, and `__Host- ` cookies hav…
Comment linking /2017/02/09/cookie-prefixes/
on “Ask HN: What should I use for authentication (WebID, OpenID, Password)?”Submitted Working with bits and bytes in Python 2 and 3 as a story · 2 points
HN discussionSubmitted The password guessing bug in Tenex as a story · 2 points
HN discussionSubmitted Running Etherkey on an ATmega32u4 to emulate a keyboard (2022) as a story · 1 points
HN discussionSubmitted Securing HTML fragments returned by API endpoints as a story · 1 points
HN discussionSubmitted Short session expiration does not help security as a story · 1 points
HN discussionSubmitted A method to do TLS on IoT devices as a story · 1 points
HN discussionSubmitted Hacking the Motorola MBP88Connect WiFi Camera as a story · 1 points
HN discussionSubmitted Securing cookies with cookie prefixes as a story · 1 points
HN discussionSubmitted Cracking PHP rand() as a story · 1 points
HN discussion
