Top all-time · #356
Graham Cluley
Personal blog · grahamcluley.comsecurity
Graham Cluley's personal blog at grahamcluley.com covers security. Since 2008, 151 different Hacker News readers have linked it 183 times, most often “The toothbrush DDoS attack: How misinformation spreads”. It is still writing: the last post was on 2026-10-30, and you can follow it by feed.
Rarely recommended · 2 of 38 sampled comments recommend it?
Why HN links it
HN readers link Graham Cluley's security blog, mostly as a citation for news on hacks, privacy and webcam spying, often to support a commenter's point.
- Recommended for · 2 comments
- one commenter lists it among good tech blogs; another calls it the personal infosec blog closest to Krebs, explained in simple terms
Summarised by Claude from a sample of 38 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Award-winning cybersecurity keynote speaker Graham Cluley has given 300+ talks around the world, and hosts the popular “Smashing Security” podcast.
Most-linked posts?
- The toothbrush DDoS attack: How misinformation spreads3 people · 3 mentions · first linked 2024-02-08
- Webcam spying without turning on the LED3 people · 3 mentions · first linked 2016-11-01
- US politicians think companies should be allowed to 'hack back' after WannaCry2 people · 2 mentions · first linked 2017-05-23
- Insurance giant AXA hit by ransomware attack after it stops covering ransoms2 people · 2 mentions · first linked 2021-05-18
- MacKeeper threatens to sue 14-year-old YouTuber2 people · 2 mentions · first linked 2016-07-19
- Security researchers rewarded $12.50 voucher to buy Yahoo T-shirt2 people · 2 mentions · first linked 2013-09-30
- Facebook’s plan to harvest medical records2 people · 2 mentions · first linked 2018-04-28
- /2 people · 2 mentions · first linked 2021-05-28
What Hacker News says?
https://grahamcluley.com/
Comment linking /
on “Ask HN: Favorite Blogs by Individuals?”Submitted 49% of workers, forced to change passwords, reuse same one with minor change as a story · 410 points
HN discussionAs others have mentioned, there is speculation about coercion from a certain 3 letter agency. Some have even suggested that the maintainers of TC left an encoded message to users: > Using TrueCrypt is not secure as it may contain unfixed security issues. Not Secure As. Whether this holds any weight, only the maintainers would know. More info: https://grahamcluley.com/truecrypt-hidden-message/
Comment linking /truecrypt-hidden-message/
on “RIAA’s YouTube-dl takedown ticks off developers and GitHub’s CEO”Submitted I can no longer recommend MailChimp as a story · 224 points
HN discussionI don't think this is a thing for two reasons : * firstly, not many people outside the security world knows that bugs are a valuable commodity for attackers. Same thing with internal orgs diagrams which are something you can sell to economic intelligence firms. * secondly, top-tier orgs like FAANG usually peppers a lot of telemetry around known bugs in production code in order to see if someone isn't exploiting them…
Comment linking /microsoft-bug-tracking-hack/
on “Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit”Submitted Feedly gets hit by DDoS attack, refuses to give in to blackmail as a story · 219 points
HN discussionYes. A news search points to last July when many social media/tech orgs decided to switch from whitelist/blacklist to allowlist/denylist. see https://grahamcluley.com/blacklist-whitelist-terminology/ I would've gone with yeslist/nolist - due to being shorter in writing and speech.
Comment linking /blacklist-whitelist-terminology/
on “Suspended from Google Play for listing supported subtitle formats”Submitted First actual computer bug was found today, 66 years ago as a story · 170 points
HN discussionnews has been out about facebook seeking access to medical records for a while now https://www.grahamcluley.com/facebooks-secret-plan-to-access...
Comment linking /facebooks-secret-plan-to-access-hospital-patient-records/
on “Facebook has asked U.S. banks to share financial information about customers”Submitted LG says it will push out firmware update for spy TVs, but no apologies as a story · 99 points
HN discussionhttps://grahamcluley.com/shouldnt-gmail-zip-files-password-i... Its been a while so i had trouble finding it (but Grok obliged) Moreover its always the edge cases that people are 'OK' with, but again if they can do it (setup the infrastructure) for one thing they can do it for anything, and it makes 'trusting' them seem naive. Since trusting was the original statement.
Comment linking /shouldnt-gmail-zip-files-password-infected/
on “Microsoft has a problem: lack of demand for its AI products”Submitted Bank refuses to pay ransom to hackers, sends dick pics instead as a story · 93 points
HN discussionCould be worse. They might write it on a flipboard next to a window. https://grahamcluley.com/plymouth-passport-offices-pitiful-p...
Comment linking /plymouth-passport-offices-pitiful-password-privacy/
on “We didn't encrypt your password, we hashed it”Submitted Security researchers rewarded $12.50 voucher to buy Yahoo T-shirt as a story · 65 points
HN discussionAbsolutely: https://www.grahamcluley.com/2013/12/webcam-spying-without-t...
Comment linking /2013/12/webcam-spying-without-turning-led-researchers-prove-possible/
on “FBI director: Cover up your webcam”Submitted Metasploit website hijacked via fax as a story · 60 points
HN discussionTo say that the "Chinese government" is involved I think understates the situation. We know as fact that their army has invested considerable time and money in a cyberwarfare unit. And that the company that operates the Firewall is a military contractor. When Sony was hacked a few months ago, the media couldn't wait to label it a "terrorist act" by North Korea. I just now searched Google News for "github terrorism".…
Comment linking /2015/03/github-ddos-attack/
on “Pin-pointing China's attack against GitHub”Submitted Insurance giant AXA hit by ransomware attack after it stops covering ransoms as a story · 56 points
HN discussionSure hope it is actual hardwired, and not hardware with an updatable firmware chip controlling the LED like apple used to do. https://grahamcluley.com/webcam-spying-without-turning-led-r...
Comment linking /webcam-spying-without-turning-led-researchers-prove-possible/
on “Dell Adding Hardware Privacy Driver for Linux”Submitted After raid on Covid whistleblower, it’s revealed password was on FL DoH website as a story · 44 points
HN discussionThe news "leaked" a bit early. http://grahamcluley.com/2014/05/change-ebay-password/
Comment linking /2014/05/change-ebay-password/
on “eBay customers’ personal data was compromised in March”Submitted Amazon staff said to be taking bribes to leak data as a story · 36 points
HN discussionPlease reread Someone1234’s comment. In my words: Nest devices had security issues in the past [1]. It’s very likely that they still have issues today (like most software). Once a hacker gains enough control of the device she can turn off the led because it’s software controlled[2]. [1] https://gizmodo.com/this-nest-security-flaw-is-remarkably-du... [2] https://www.grahamcluley.com/webcam-spying-without-turning-l...
Comment linking /webcam-spying-without-turning-led-researchers-prove-possible/
on “Google Forcing Nest Cameras’ Visual Indicator Light To Be On”Submitted Oracle has just given you another reason not to install Java on your Mac as a story · 23 points
HN discussion> My only audio recording device is my webcam and it is incapable of being in use without the light being on as far as I am aware. You assume that the light isn't controlled by the same software, that's not always the case, the FBI has admitted this. https://grahamcluley.com/2013/12/webcam-spying-without-turni... I take the view that anything under software control or the control of a chip I can't open is suspect, I…
Comment linking /2013/12/webcam-spying-without-turning-led-researchers-prove-possible/
on “Google listening in to your room shows importance of privacy defense in depth”Submitted MacKeeper threatens to sue 14-year-old YouTuber as a story · 21 points
HN discussion>The only way that the NSA could be actively making systems less secure would be if they were putting vulnerabilities into the source code or silicon. I just wanted to point out that the NSA does that.[1][2] [1] http://www.nytimes.com/interactive/2013/09/05/us/documents-r... [2] https://www.grahamcluley.com/2013/12/nsa-bribe-rsa-encryptio...
Comment linking /2013/12/nsa-bribe-rsa-encryption/
on “The NSA Is Hoarding Vulnerabilities”Submitted How to hack into an email account, just by knowing your victim's mobile number as a story · 20 points
HN discussion> because users OK all that when they sign up Reminds me of the "Facebook Security Simulator" game that was made around that time - https://www.grahamcluley.com/facebook-security-simulator/ and the term "privacy zuckering" was invented round about then to describe this UX dark pattern - https://darkpatterns.org/types-of-dark-pattern/privacy-zucke... So while Facebook may be on safe ground here _legally_ there was st…
Comment linking /facebook-security-simulator/
on “Facebook was warned in 2011 of data loopholes exploited by Cambridge Analytica”Submitted Twitter used users' 2FA phone numbers for targeted advertising as a story · 18 points
HN discussion
