Type and topic

Essays and writing about security and privacy

Every link here is classified as essays and writing about security and privacy.

Hall of Fame: 22
Candidates: 42
Median span: 5.2 yrs
First seen: 2009

Strongest Hall records

22 items

Myths about /dev/urandom

www.2uo.de 12 submissions · 12 people · 12.2 years

Hall of Fame Class of 2017-01 Resurfaced 2026-05-14

232max pts

Analysis of bank PIN numbers

www.datagenetics.com 21 submissions · 21 people · 13.2 years

Hall of Fame Class of 2018-08 Resurfaced 2024-05-14

255max pts

Why I Wrote PGP (1999)

www.philzimmermann.com 14 submissions · 13 people · 13.5 years

Hall of Fame Class of 2021-08 Resurfaced 2021-08-09

422max pts

Reasons not to use (i.e., be used by) Facebook

stallman.org 7 submissions · 7 people · 12.4 years

Hall of Fame Class of 2018-03 Resurfaced 2018-03-26

670max pts

Don't Use VPN Services

gist.github.com 12 submissions · 12 people · 10.6 years

Hall of Fame Class of 2020-10 Resurfaced 2023-05-23

408max pts

Against DNSSEC (2015)

sockpuppet.org 9 submissions · 9 people · 11.3 years

Hall of Fame Class of 2022-10 Resurfaced 2022-10-21

186max pts

Stop using JWT for sessions (2016)

cryto.net 11 submissions · 11 people · 8.0 years

Hall of Fame Class of 2018-11 Resurfaced 2018-11-01

248max pts

Social Cooling (2017)

www.socialcooling.com 7 submissions · 7 people · 8.3 years

Hall of Fame Class of 2023-12 Resurfaced 2025-10-05

2692max pts

Fingerprints are Usernames, not Passwords

blog.dustinkirkland.com 6 submissions · 6 people · 4.0 years

Hall of Fame Class of 2016-04 Resurfaced 2017-09-15

587max pts

Detecting the use of "curl | bash" server-side

www.idontplaydarts.com 7 submissions · 7 people · 6.7 years

Hall of Fame Class of 2020-05 Resurfaced 2020-12-09

500max pts

Pulling JPEGs out of thin air

lcamtuf.blogspot.com 7 submissions · 7 people · 9.6 years

Hall of Fame Class of 2022-01 Resurfaced 2019-03-23

444max pts

Google has most of my email because it has all of yours (2014)

mako.cc 7 submissions · 6 people · 9.6 years

Hall of Fame Class of 2022-10 Resurfaced 2025-05-06

453max pts

Bug 647959 – Add Honest Achmed's root certificate

bugzilla.mozilla.org 7 submissions · 7 people · 13.8 years

Hall of Fame Class of 2020-01 Resurfaced 2025-01-18

200max pts

Don't Copy-Paste from Website to Terminal

thejh.net 8 submissions · 7 people · 8.9 years

Hall of Fame Class of 2019-10 Resurfaced 2015-11-12

689max pts

The Line of Death

textslashplain.com 11 submissions · 11 people · 9.2 years

Hall of Fame Class of 2022-03 Resurfaced 2022-03-18

566max pts

RSA is a fragile cryptosystem

blog.trailofbits.com 5 submissions · 5 people · 5.2 years

Hall of Fame Class of 2024-09 Resurfaced 2022-04-01

708max pts

Dumb Ideas in Computer Security (2005)

www.ranum.com 7 submissions · 7 people · 13.9 years

Hall of Fame Class of 2023-01 Resurfaced 2023-01-25

265max pts

Forget privacy: you're terrible at targeting anyway

apenwarr.ca 5 submissions · 4 people · 4.7 years

Hall of Fame Class of 2023-10 Resurfaced 2023-10-16

312max pts

The Linux Backdoor Attempt of 2003 (2013)

freedom-to-tinker.com 6 submissions · 6 people · 5.7 years

Hall of Fame Class of 2023-12 Resurfaced 2023-12-29

298max pts

The Gentleperson's Guide To Forum Spies (2012)

cryptome.org 6 submissions · 6 people · 10.2 years

Hall of Fame Class of 2022-10 Resurfaced 2022-10-21

225max pts

When you browse Instagram and find Tony Abbott's passport number

mango.pdf.zone 6 submissions · 6 people · 4.0 years

Hall of Fame Class of 2024-08 Resurfaced 2023-02-28

2326max pts

A wall of lava lamps helps encrypt the internet

www.atlasobscura.com 5 submissions · 5 people · 5.2 years

Hall of Fame Class of 2023-02 Resurfaced 2023-02-24

356max pts

Recently resurfaced

latest 20+ point return

Myths about /dev/urandom

www.2uo.de 12 submissions · 12 people · 12.2 years

Hall of Fame Class of 2017-01 Resurfaced 2026-05-14

232max pts

Social Cooling (2017)

www.socialcooling.com 7 submissions · 7 people · 8.3 years

Hall of Fame Class of 2023-12 Resurfaced 2025-10-05

2692max pts

Google has most of my email because it has all of yours (2014)

mako.cc 7 submissions · 6 people · 9.6 years

Hall of Fame Class of 2022-10 Resurfaced 2025-05-06

453max pts

Bug 647959 – Add Honest Achmed's root certificate

bugzilla.mozilla.org 7 submissions · 7 people · 13.8 years

Hall of Fame Class of 2020-01 Resurfaced 2025-01-18

200max pts

Analysis of bank PIN numbers

www.datagenetics.com 21 submissions · 21 people · 13.2 years

Hall of Fame Class of 2018-08 Resurfaced 2024-05-14

255max pts

Candidates

Browse 42 candidates

NSA's Backdoor Key from Lotus Notes (2002)

www.cypherspace.org 4 submissions · 4 people · 10.3 years

Candidate Resurfaced 2023-09-18

Needs:5 submissions

564max pts

How do I give our security auditor the information he wants? (2011)

serverfault.com 13 submissions · 13 people · 14.6 years

Candidate Resurfaced 2023-06-18

Needs:2 breakout events 720+ days apart

204max pts

Write your passwords down (2010)

blog.jgc.org 4 submissions · 4 people · 14.4 years

Candidate Resurfaced 2023-08-07

Needs:5 submissions

116max pts

Parsing JSON is a Minefield

seriot.ch 4 submissions · 4 people · 2.8 years

Candidate Resurfaced 2019-08-17

Needs:5 submissions

559max pts

Remove my password from lists so hackers won't be able to hack me

github.com 6 submissions · 6 people · 7.0 years

Candidate Resurfaced 2024-12-28

Needs:2 breakout events 720+ days apart

504max pts

Why Static Websites Need HTTPS

www.troyhunt.com 6 submissions · 6 people · 3.2 years

Candidate Resurfaced 2020-01-25

Needs:2 breakout events 720+ days apart

328max pts

Inside a low-budget consumer hardware espionage implant

ha.cking.ch 3 submissions · 3 people · 6.5 years

Candidate Resurfaced 2024-05-15

Needs:5 submissions

591max pts

How I attacked myself using Google and I ramped up a $1000 bandwidth bill

www.behind-the-enemy-lines.com 4 submissions · 4 people · 13.9 years

Candidate Resurfaced 2015-09-23

Needs:5 submissions

775max pts

Reasons Not to Use Google

stallman.org 3 submissions · 3 people · 6.2 years

Candidate Resurfaced 2023-03-21

Needs:5 submissions

182max pts

Wacom tablets track every app you open

robertheaton.com 3 submissions · 3 people · 5.3 years

Candidate Resurfaced 2025-05-17

Needs:5 submissions

1594max pts

The curious case of the Raspberry Pi in the network closet (2019)

blog.haschek.at 4 submissions · 4 people · 4.0 years

Candidate Resurfaced 2024-01-08

Needs:5 submissions

799max pts

Flatpak – a security nightmare

flatkill.org 3 submissions · 3 people · 2.7 years

Candidate Resurfaced 2021-06-23

Needs:5 submissions

377max pts

Stop Using Encrypted Email

latacora.micro.blog 4 submissions · 4 people · 3.2 years

Candidate Resurfaced 2021-09-11

Needs:2 breakout events 720+ days apart5 submissions

475max pts

1.1.1.1 for Families

blog.cloudflare.com 4 submissions · 4 people · 3.0 years

Candidate Resurfaced 2021-10-28

Needs:2 breakout events 720+ days apart5 submissions

414max pts

I don't trust Signal

drewdevault.com 3 submissions · 3 people · 6.3 years

Candidate Resurfaced 2020-08-11

Needs:5 submissions

523max pts

The Linux Security Circus: On GUI isolation

theinvisiblethings.blogspot.com 5 submissions · 5 people · 11.3 years

Candidate Resurfaced 2016-03-05

Needs:2 breakout events 720+ days apart

126max pts

Let them paste passwords

www.ncsc.gov.uk 4 submissions · 4 people · 3.4 years

Candidate Resurfaced 2020-06-19

Needs:5 submissions3 active years

694max pts

How is NSA breaking so much crypto? (2015)

freedom-to-tinker.com 3 submissions · 3 people · 4.8 years

Candidate Resurfaced 2020-06-20

Needs:5 submissions

586max pts

JavaScript Cryptography Considered Harmful

matasano.com 3 submissions · 3 people · 4.3 years

Candidate Resurfaced 2014-06-17

Needs:2 breakout events 720+ days apart5 submissions

127max pts

Beg Bounties

www.troyhunt.com 3 submissions · 3 people · 4.2 years

Candidate Resurfaced 2026-02-04

Needs:5 submissions

280max pts

JSON Web Tokens should be avoided

paragonie.com 3 submissions · 3 people · 4.3 years

Candidate Resurfaced 2021-07-12

Needs:5 submissions

386max pts

Defending a website with Zip bombs

blog.haschek.at 4 submissions · 3 people · 6.5 years

Candidate Resurfaced 2024-01-10

Needs:5 submissions

631max pts

Cliff Stoll, the mad scientist who invented the art of hunting hackers

www.wired.com 3 submissions · 3 people · 4.3 years

Candidate Resurfaced 2024-03-27

Needs:5 submissions3 active years

384max pts

The Moral Character of Cryptographic Work

web.cs.ucdavis.edu 5 submissions · 5 people · 7.7 years

Candidate Resurfaced 2023-07-28

Needs:2 breakout events 720+ days apart

240max pts

We Should All Have Something To Hide

www.thoughtcrime.org 4 submissions · 4 people · 2.7 years

Candidate Resurfaced 2016-02-27

Needs:5 submissions

438max pts

Why JWTs Suck as Session Tokens (2017)

developer.okta.com 3 submissions · 3 people · 5.1 years

Candidate Resurfaced 2022-10-03

Needs:5 submissions

173max pts

LinkedIn: The Creepiest Social Network

www.interactually.com 3 submissions · 3 people · 4.7 years

Candidate Resurfaced 2015-04-03

Needs:2 breakout events 720+ days apart5 submissions

334max pts

Stealing sensitive browser data with the W3C Ambient Light Sensor API (2017)

blog.lukaszolejnik.com 9 submissions · 9 people · 2.5 years

Candidate Resurfaced 2019-10-14

Needs:2 breakout events 720+ days apart3 active years

113max pts

A better zip bomb

www.bamsoftware.com 3 submissions · 3 people · 6.5 years

Candidate Resurfaced 2025-12-19

Needs:5 submissions3 active years

483max pts

Reverse engineering a camera protocol for fun and profit

www.thirtythreeforty.net 5 submissions · 4 people · 2.4 years

Candidate Resurfaced 2022-10-05

Needs:3 active years

479max pts

Modern C++ Won't Save Us

alexgaynor.net 3 submissions · 3 people · 2.0 years

Candidate Resurfaced 2021-04-25

Needs:5 submissions3 active years

326max pts

If OpenSSL were a GUI

smallstep.com 4 submissions · 4 people · 2.6 years

Candidate Resurfaced 2025-01-27

Needs:5 submissions3 active years

744max pts

Operation Luigi: How I hacked my friend without her noticing

mango.pdf.zone 8 submissions · 4 people · 5.2 years

Candidate Resurfaced 2023-02-01

Needs:2 breakout events 720+ days apart

242max pts

Russians Engineer a Slot Machine Cheat that Casinos Can't Fix

www.wired.com 3 submissions · 3 people · 3.4 years

Candidate Resurfaced 2018-06-30

Needs:2 breakout events 720+ days apart5 submissions

391max pts

The second operating system hiding in every mobile phone

www.osnews.com 3 submissions · 3 people · 3.1 years

Candidate Resurfaced 2016-12-16

Needs:5 submissions

1036max pts

Target="_blank" – An underestimated vulnerability (2016)

www.jitbit.com 4 submissions · 4 people · 5.8 years

Candidate Resurfaced 2022-05-18

Needs:2 breakout events 720+ days apart5 submissions

264max pts

Show HN: Porting OpenBSD Pledge() to Linux

justine.lol 3 submissions · 3 people · 2.7 years

Candidate Resurfaced 2023-10-27

Needs:2 breakout events 720+ days apart5 submissions

571max pts

How the CIA used Crypto AG encryption devices to spy on countries for decades

www.washingtonpost.com 3 submissions · 3 people · 3.3 years

Candidate Resurfaced 2023-06-03

Needs:5 submissions3 active years

962max pts

The most backdoor-looking bug I’ve ever seen (2021)

words.filippo.io 3 submissions · 3 people · 2.3 years

Candidate Resurfaced 2024-05-10

Needs:5 submissions3 active years

173max pts

/bin/false is not security

www.semicomplete.com 3 submissions · 3 people · 6.3 years

Candidate Resurfaced 2017-12-28

Needs:2 breakout events 720+ days apart5 submissions

140max pts