Top all-time · #3843
SkullSecurity Blog
Personal blog · skullsecurity.org/blogsecurity
SkullSecurity Blog is a personal blog at skullsecurity.org about security. Since 2010, 19 different Hacker News readers have linked it 21 times, most often “Return of the Facebook Snatchers”. It is still writing: the last post was on 2026-03-30, and you can follow it by feed.
Too few sampled comments (6) to say how often HN recommends it.?
Why HN links it
Commenters link SkullSecurity posts and wiki pages on password cracking and password lists, leaked Facebook data, md5crypt hashing and DNS-based file exfiltration.
Summarised by Claude from a sample of 6 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Adventures In Security
Most-linked posts?
- Return of the Facebook Snatchers2 people · 2 mentions · first linked 2010-07-27
- Listing of public password leaks2 people · 2 mentions · first linked 2010-12-13
- Battle.net authentication misconceptions2 people · 2 mentions · first linked 2012-05-25
- Everything you need to know about hash length extension attacks (2012)2 people · 2 mentions · first linked 2012-09-25
What Hacker News says?
> You can choose to l33tify different combinations of letters in the password. passw0rd may be in the dictionary, but is p4ssword, or pa$$word? yes they are. well, actually, password cracking software (most used is Jack the Ripper) comes with a bunch of commandline tools that allow you to do substitutions and common variations to your password lists. generally, when trying to crack a specific target, you start with…
Comment linking /blog/?s=ripper
on “Why the password "this is fun" is 10 times more secure than "J4fS!2"”Submitted Battle.net authentication misconceptions as a story · 60 points
HN discussionIt's not great, though - it means that someone who hacks your server can get users' passwords a lot easier. I read a couple of weeks ago that Blizzard's games don't send the passwords to the server, they send a hash. Things are necessarily crappier on the web, of course. Edit: there's more detail at the link below. It looks clear that in at least some of their schemes they deliberately do not send the client passwor…
Comment linking /blog/2012/battle-net-authentication-misconceptions
on “Md5crypt is no longer strong enough”Submitted Everything you need to know about hash length extension attacks (2012) as a story · 58 points
HN discussionYou can integrate common passwords into your password choice UI. These guys did a nice example: http://howsecureismypassword.net/ Lists are available from various sources. Here's a good page http://www.skullsecurity.org/wiki/index.php/Passwords
Comment linking /wiki/index.php/Passwords
on “Poul-Henning Kamp: LinkedIn Password Leak? Salt Their Hide”Submitted Stuffing Javascript into DNS names as a story · 35 points
HN discussionA link to the actual torrent file: http://www.skullsecurity.org/blogdata/fbdata.torrent
Comment linking /blogdata/fbdata.torrent
on “100 million Facebook pages leaked on torrent site”Submitted Stuffing Javascript into DNS names as a story · 13 points
HN discussionThe guy who did it, and a link to the actual torrent file: http://www.skullsecurity.org/blog/?p=887
Comment linking /blog/?p=887
on “100 million Facebook pages leaked on torrent site”Submitted Everything you need to know about hash length extension attacks as a story · 5 points
HN discussion8 bytes at a time. Wouldn't that mean 100's, 1000's or 10's of thousands of requests for nonsensical subdomains of the same domain name (and that domain name is probably a silly one if you got it recently for 10 bucks). This is not anomalous DNS traffic? My imagination just does not stretch this far. If the title was just "Transfer a file via DNS", maybe I could play along. I think nstx preceded iodine. Here's anoth…
Comment linking /wiki/index.php/Dnscat
on “Exfiltrate Files with DNS Queries”Submitted Locks that can re-key themselves? as a story · 5 points
HN discussionSubmitted Return of the Facebook Snatchers as a story · 3 points
HN discussionSubmitted Epic "cnot" Writeup (highest value level from PlaidCTF) as a story · 2 points
HN discussionSubmitted Listing of public password leaks as a story · 2 points
HN discussionSubmitted Weaponizing dnscat with shellcode and Metasploit as a story · 2 points
HN discussionSubmitted Hacking crappy password resets (part 1) as a story · 1 points
HN discussionSubmitted Padding oracle attacks: in depth as a story · 1 points
HN discussionSubmitted Followup to my Facebook research as a story · 1 points
HN discussionSubmitted Return of the Facebook Snatchers as a story · 1 points
HN discussion
