Privacy

2026 138 posts

October 2026 26 posts

EU privacy advocates accuse US data annotation firm of snooping on contractors theregister.com · “According to noyb, Persona collects biometric data to verify Outlier contractors are who they say they are, as well as gathering IP addresses, device info, geolocation data, addresses, and credit data of Outlier users.”
Oct 27
Judge Allows Google, Yahoo and Microsoft Subpoenas to Identify Gay-Torrents Users torrentfreak.com · “FlavaWorks can also request the most recent IP address that was used to access each account, covering the period from January 2025 onward.”
Oct 27
EFF to Brazil's ANPD: Data Privacy and Free Expression Must Underpin Platform Regulations eff.org · “Age verification technology is often inaccurate and privacy-invasive.”
Oct 26
Canadians Are Running Out Of Time To Oppose The Dangerous C-22 Surveillance Bill eff.org · “It also requires services to retain metadata for up to a year.”
Oct 24
Google can now use insights from your Gmail and Photos to target ads techlicious.com · “Google has added an exception to its promise that your emails and photos won’t be used to personalize ads.”
Oct 23
Greece's social media ban for under-15s: What you need to know euronews.com · “The new framework is due to apply from 1 January 2027.”
Oct 23
Two States Can Now Restrict Social Media Access. Here's What To Do Next eff.org · “But people in Georgia and Florida can no longer count on court injunctions to protect their access to the web.”
Oct 23
'VPNs at Risk': Tech Coalition Pushes Back on Piracy Blocking Duties for VPNs torrentfreak.com · “ACPA would allow courts to name VPN providers with 100,000 or more monthly U.S. users or subscribers in a blocking order.”
Oct 22
EFF's State Legislative Agenda to End ALPR Mass Surveillance eff.org · “In August 2026, Florida’s Department of Transportation ordered the removal of all ALPRs from the right-of-way on state highways within 30 days.”
Oct 22
Victory! Court Rules OPM Data Disclosure to DOGE Is Unlawful eff.org · “However, OPM should still clean up the cybersecurity mess it created.”
Oct 20
Require Police to Get a Warrant to Search ALPR Data eff.org · “Automated license plate readers (ALPRs) are mass surveillance.”
Oct 19
Meta grants itself right to scrape content from business customers for model training theregister.com · “Meta has no reservoir of good faith among the community that it can draw upon.”
Oct 18
We're Asking the Wisconsin Supreme Court to End Warrantless ALPR Searches eff.org · “Law enforcement entities throughout Wisconsin collect, store, share, and aggregate this ALPR data.”
Oct 18
As Federal Court Rules ALPRs are Mass Surveillance, EFF Gets Disappointing Ruling eff.org · “Networked ALPRs are not individual streetlight cameras.”
Oct 18
Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware citizenlab.ca · “This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads.”
Oct 17
DHS Inspector General Finds That TSA is Not Properly Safeguarding Passenger Facial Recognition Data eff.org · “…was able to access and extract sensitive passenger information, including driver’s license and passport images, during system troubleshooting and enhancements, without TSA’s knowledge.”
Oct 17
Windows 11's easiest account bypass gets the Microsoft boot theregister.com · “Microsoft has won this round of account workaround Whac-a-Mole, though another bypass may yet pop up.”
Oct 13
Colorado Woman Sues Flock After Cameras Used in False Package Theft Accusation gizmodo.com · “The scariest part is what happened to me can happen to anyone.”
Oct 10
YouTuber Says Cops Visited Him After He Built a Flock-Style Camera to Track Cops gizmodo.com · “A personal Flock surveillance camera to Flock the Flockers.”
Oct 9
US Postal Service To Start Exploring Its Always-On Surveillance Options techdirt.com · “The purpose of this pilot is to leverage the Postal Service’s unique ability to collect this valuable data.”
Oct 9
Disloyalty pluralistic.net · “These were identical trips, loaded via identical referrer URLs.”
Oct 9
When No ID Means No Internet: Age Verification and the Right to Access Information eff.org · “Age verification is not a neutral safety measure.”
Oct 9
We Demand More Information on How Marin Cops Illegally Shared Flock ALPR Data eff.org · “This sharing violated state law and ’exposed sensitive driver location information to misuse by the federal government.'”
Oct 5
Court Agrees with EFF: Utah's VPN Law Demands a Technical Impossibility eff.org · “Aylo is correct that the statute, as amended, now essentially imposes strict liability for entities like it when it comes to determining the location of its websites’ users.”
Oct 2
Met Police suspends use of phone-hacking software over Russian links theregister.com · “The DoJ isn’t alleging that Oxygen’s software contained malicious code or was used to gain unauthorized access to customer systems or data.”
Oct 2
While the Country Rejects ALPR Mass Surveillance, SF Settles for Weak Safeguards eff.org · “Without a warrant requirement, officers can search stored location data without showing probable cause to a judge, and will.”
Oct 1

September 2026 23 posts

EFF to San Francisco Police: Drones are Powerful Surveillance Tools That Require a Robust Policy eff.org · “Without appropriate safeguards around deployment and use, drones could be deployed to every call for service, collecting data along the way.”
Sep 29
Gouged pluralistic.net · “Every scam to make you pay more has a mirror-image scam that ensures you are paid less.”
Sep 29
Driver Ticketed For No Insurance Despite Having Insurance, Just Because Flock Said She Didn't techdirt.com · “The computer says you’re a criminal. The stuff law enforcement has always considered proof of legal vehicle use is no longer acceptable.”
Sep 28
DraftKings Is Using AI to Supercharge the Harms of Online Behavioral Advertising eff.org · “DraftKings is using its customers’ betting records to train a machine learning model to find losing gamblers.”
Sep 25
EU Kids Act Won't Keep the Internet Accountable and Trustworthy eff.org · “However they’re designed, age gates undermine civil liberties, reduce safety, and create barriers to internet entry, often at the expense of marginalized groups.”
Sep 24
Spymarks, Not Watermarks brand.io · “A spymark is a hidden signal that makes your work traceable without your knowledge or consent.”
Sep 22
Australia considers banning the use of smart glasses in government buildings yahoo.com · “Australia is considering barring the use of camera-equipped smart glasses in government workplaces due to privacy and security concerns, in what it said could be the first ban of its kind.”
Sep 22
Secure Messaging and AI Remain In Conflict Despite the Promise of TEEs eff.org · “TEEs can provide more security and privacy than simply running in the clear, but they are fundamentally different from actual encryption.”
Sep 18
Hackers Stole Flock's Camera Software, Revealing How the Company Tracks Cars and People 404media.co · “Hackers ripped down a Flock camera above a roadway, made a near-complete copy of the data stored inside it.”
Sep 17
A/I Shuts Down keepitfree.ai · “‘Stay human’ is not an empty phrase to us.”
Sep 16
Data Broker Radaris Loses Domains in Privacy Fight krebsonsecurity.com · “They won by attrition. Plaintiffs’ attorneys tired of procedural games and gave up.”
Sep 16
Apple Reference Image: A New Approach for Verified Photography security.apple.com · “Apple Reference Image offers a trustworthy, scalable guarantee that a reference image is what it claims to be: a real photograph, captured by a real sensor.”
Sep 15
The High Crime of 'LMAO': How Cops Are Treating Mass Surveillance As a Joke eff.org · “More than 30 agencies ran more than 6,300 searches with ‘TBD’ (short for ‘To Be Determined’) as the ‘reason.’”
Sep 15
Watch out: Apple timepiece can grab snippets of conversation without both speakers' consent theregister.com · “Our right to conversational privacy must include freedom from other people, without our clear opt-in consent, using technology to document what we are saying,” said EFF privacy director Adam Schwartz.
Sep 10
Cops Play Hide and Seek About Using Spy Tech to Avoid Scrutiny and Bad PR eff.org · “DO NOT MENTION ALPR USAGE TO THE OCCUPANTS OF THE VEHICLE. DO NOT MENTION ALPR USAGE IN YOUR REPORT OR COMPLAINT UNLESS ABSOLUTELY NECESSARY.”
Sep 10
EFF to Governor Newsom: Veto California's AB 1709 eff.org · “A.B. 1709 is a massive privacy and free speech nightmare.”
Sep 9
Meta's $17 Billion Settlement is a Bad Deal for Teens and All Social Media Users eff.org · “Rather than pushing Meta away from the collection, analysis, and retention of user data, the Settlement requires Meta to do more of it for the next ten years.”
Sep 8
Grindr pays £26M to settle UK privacy class action theregister.com · “While Grindr disputes the allegations, it recognizes and acknowledges the distress and loss of trust expressed by some of its UK users regarding that pre-2020 period.”
Sep 8
US troops can still be tracked by purchased location data, and Congress wants to know why theregister.com · “This change will essentially ensure that military device location data isn’t being included in bulk data sales being done by numerous vendors.”
Sep 6
RFK Jr. Wants Your Medical Records techdirt.com · “Since the spring of 2025, Health and Human Services Secretary Robert F. Kennedy, Jr. has sought federal access to Americans’ medical records to investigate whether vaccines cause autism.”
Sep 6
FBI Probes Service Selling 153M+ Drivers Licenses krebsonsecurity.com · “We have been continuously exfiltrating new data for over a year into our private database.”
Sep 2
Flock-Stalking, Nazi-Saluting Deputy Given Top Cop Honors Before Hastily Retiring techdirt.com · “The 43-page investigation found Fultz had posed for pictures as Adolf Hitler, freely used racial slurs in texts, masturbated on camera in his police vehicle.”
Sep 2
Texas and Florida Step Back from ALPRs eff.org · “ALPR mass surveillance, the indiscriminate, continuous collection and retention of location data on every driver, regardless of suspicion, should not exist.”
Sep 2

August 2026 25 posts

A List of ICE Subpoenas to Tech Companies eff.org · “ICE has been forced to withdraw others after users challenged them in court or companies pushed back.”
Aug 29
Belgian Orders Demand Pirate Site Operators' Bank Details, Crypto Wallets and Server Logs torrentfreak.com · “The intermediaries are not allowed to disclose the information-seeking request to their customers or any third parties, including the press.”
Aug 29
More Americans oppose police license plate cameras than support them techcrunch.com · “The company has been embroiled in controversy following reports of police abusing the cameras’ surveillance.”
Aug 29
Who's Tracking You? Use This New Service to Find Out krebsonsecurity.com · “A powerful and free new service called DecryptAds scrapes and correlates this adtech data and makes it simple to quickly learn a great deal about the entities that are tracking you.”
Aug 26
Zero-Knowledge Proofs Aren't Age Verification Silver Bullets eff.org · “No method of online age verification is privacy-protective, fully accurate, and capable of guaranteeing universal coverage.”
Aug 26
AliExpress accused of fingerprinting shoppers with silent audio trick that also muted a dev's headphones theregister.com · “Shortly after loading the AliExpress homepage, audio from my phone would stop playing.”
Aug 24
Grand jury declines to indict Ohio man charged with destroying Flock camera san.com · “Police estimated the damage at more than $1,000.”
Aug 21
EFF and Civil Society Groups Call on Nottinghamshire Police to Halt Live Face Recognition eff.org · “48% of people oppose scanning the faces of those walking on high streets when there is no suspected imminent threat.”
Aug 21
AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint blog.laserphile.com · “Connecting it to the destination causes the browser to actively process the graph, even though the final volume is zero.”
Aug 20
Some Tech Companies Have Privately Pushed Back on ICE Subpoenas. They Should All Do More. eff.org · “In the second half of 2025, the company received three Department of Homeland Security (DHS) subpoenas seeking account information from 11 users who posted content critical of ICE.”
Aug 19
Google has acquired the data of failed US airline Spirit theregister.com · “Google bid for and won for just $10 million - pending judicial approval… 100 million emails and 500 million items from Microsoft Teams, 17 million OneDrive files and 20.5 million items from SharePoint.”
Aug 18
Cloudflare silently injects its analytics when you switch nameservers news.ycombinator.com · “I switched my nameservers to Cloudflare in order to enable R2 bucket serving through my own subdomain, and I found out that it silently had injected a JS analytics snippet in my HTML-only JS-free site.”
Aug 16
Firefox is now the last major browser that still supports uBlock Origin pcworld.com · “Once Microsoft Edge moves to Manifest V3, ad-blocking extensions won’t have access to the functions needed to properly identify and block ads that occur while browsing websites and watching videos.”
Aug 14
How Google is making private AI practical with homomorphic encryption blog.google · “HEIR can convert pre-trained AI models that operate on unencrypted data to operate on encrypted inputs.”
Aug 14
Hundreds Of Drone-as-First-Responder Programs Could Soon Be Launched Across The Country techdirt.com · “The agency issued more waivers between April 2025 and February 2026 than it had in the previous seven years combined.”
Aug 11
Japanese Police Arrest NYAA 'First Uploader,' But Not by Watching the Swarm torrentfreak.com · “The tool does not analyse activity within the BitTorrent swarm itself. Instead, it analyses how data moves through torrent sites, such as index sites and tracker sites.”
Aug 11
US citizen detained by ICE at Atlanta airport as he boarded plane wsbtv.com · “There is no probable cause here. A matching name and birth date is not probable cause.”
Aug 11
Briar is in maintenance mode briarproject.org · “Meanwhile, the project didn’t have funding, we were reluctant to look for funding without having a long-term plan, and so we could only work on Briar in our spare time.”
Aug 11
Another Federal Judge Says Cell Tower Dumps Are Unconstitutional techdirt.com · “The Government is essentially asking the Court to allow it access to an entire haystack because it may contain a needle.”
Aug 7
tl;dv (Too Lazy; Didn't Validate): 181,874 Meetings Left Wide Open bobdahacker.com · “The CTO never came back to you.”
Aug 7
The offline messaging apps challenging internet shutdowns restofworld.org · “The decentralized architecture of the app means that there is no central server or database and therefore there cannot be a central kill switch.”
Aug 7
Californians' data deletion requests, DROP, become enforceable Aug. 1 nbcsandiego.com · “The alternative is you would have to contact 600 companies and say, please delete my information. And who’s got time for that?”
Aug 2
Governor Hochul and Attorney General James Announce Final SAFE for Kids Act Rules governor.ny.gov · “Social media companies must determine that a given user is an adult before providing them with algorithmic feeds.”
Aug 2
The SCREEN Act Threatens Privacy Far Beyond Adult Websites eff.org · “requiring a user to confirm that the user is not a minor shall not be sufficient”
Aug 1
Amending AB 1709 Doesn't Fix It: California's Social Media Ban Still Threatens Free Speech and Privacy eff.org · “the bill defines ‘addictive feeds’ so broadly that it covers virtually every functional recommendation algorithm”
Aug 1

July 2026 23 posts

EFF Guide to Recording Law Enforcement eff.org · “Officers exercising their official duties, particularly in public, do not have a reasonable expectation of privacy.”
Jul 31
Hims & Hers accused of sharing health secrets and hiding the cancel button theregister.com · “the consumer’s subscription would not be cancelled. Instead, the consumer would then have to click through approximately three to ten survey questions”
Jul 31
Jailed Flock vandal wipes out three cameras, racks up thousands in damages theregister.com · “less than 1 percent of the cars scanned are connected to crime, yet they still have details added to a database, such as vehicle manufacturer, model, color, license plate number, bumper stickers, and scratches.”
Jul 30
Court Shuts Down Federal Officers Who Wanted To Run A Stingray Device For A Month Straight techdirt.com · “The Fourth Amendment’s particularity requirement bars this sort of ‘rummaging’ through the proverbial home.”
Jul 29
404 Media Scores Leaked Document Detailing The Dozens Of Surveillance Tools ICE Has Access To techdirt.com · “The document covers everything from monitoring social media to tracking the movements of vehicles.”
Jul 29
Why Are Gay Bars Building Databases of Their Patrons? eff.org · “A venue cannot claim to be a safe space while feeding its patrons’ data to a third party database.”
Jul 29
DEF CON bans Meta-style 'pervert glasses' theregister.com · “Be sure to pack non-violating eyewear if you need them.”
Jul 29
San Francisco: Don't Fall for Industry Defense of Surveillance Pricing eff.org · “Privacy is a human right, not something that people should understand as a currency to give away or protect based on how it will impact the price of groceries.”
Jul 29
Protester Charged With Destroying Property After Giving CBP Agents His GrapheneOS 'Duress' Mode Passcode techdirt.com · “GrapheneOS provides users with the ability to set a duress PIN/Password that will irreversibly wipe the device once entered anywhere where the device credentials are requested.”
Jul 27
The Fourth Circuit Says Border Agents Can Search Your Phone By Hand, No Suspicion Required eff.org · “a person’s privacy interests in the personal data on a phone or laptop are extraordinarily different than their limited privacy interests in the contents of their suitcase.”
Jul 26
Apple's smart glasses are running late because they don't want to stir a privacy storm digitaltrends.com · “Removing video capture would make the glasses less controversial, but also less appealing.”
Jul 26
Hundreds of Drone-as-First-Responder Programs Could Soon Be Launched Across the Country eff.org · “The agency issued more waivers between April 2025 and February 2026 than it had in the previous seven years combined.”
Jul 26
Pope's official prayer app commits cardinal sin, leaks 700K+ users' info theregister.com · “With sequential user IDs and no rate limiting, an attacker could enumerate every single account on the platform. One GET request per user.”
Jul 26
Fed up with Big Tech, communities turn to data collectives for control restofworld.org · “The big companies have built themselves up on the backs of all these people creating data, who think it’s time to set their own terms now.”
Jul 26
GitHub Ordered to Remove Decentralized Messaging App Bitchat in India cyberinsider.com · “The app’s lack of mandatory registration, phone number verification, and centralized logging significantly impedes lawful interception and criminal investigations.”
Jul 24
Meta is toying with the idea of smart glasses that record everything, all the time gizmodo.com · “Meta is testing prototype smart glasses that record literally everything, all the time. The so-called ‘super-sensing’ glasses would reportedly capture photos ’every few seconds.’”
Jul 9
All Cars Sold in the EU Now Require a Camera Aimed at Your Face allaboutcookies.org · “Starting July 7, 2026, every new car sold in the European Union must include a driver monitoring camera aimed at your face.”
Jul 7
Microsoft Flips Windows Backup to On by Default Unless You're in the EU theregister.com · “An opt-out setting that quietly ships settings data off-device is exactly the sort of thing that adds to administrators’ workloads rather than lightening them.”
Jul 7
Showdown in Strasbourg: The unexpected return of Chat Control 1.0 heise.de · “The European Parliament cleared the way for a renewed extension of the so-called ‘Chat Control’ on Tuesday afternoon. With a narrow majority of 331 to 304 votes…”
Jul 7
Windows Identifier Used to Track Scattered Spider Perp After Microsoft Shared Info with FBI itnews.com.au · “Such GDIDs are typically used for diagnostic and crash reporting, feature-usage analysis, and detecting abuse patterns such as one machine repeatedly claiming free trials or licences.”
Jul 7
Apple's Hide My Email feature has a bug that's been exposing real email addresses techcrunch.com · “Details of the vulnerability haven’t been publicly disclosed, for fear that it will be exploited.”
Jul 3
Virginia Bans Sale of Geolocation Data hunton.com · “The ban on the sale of geolocation data goes into effect on July 1, 2026.”
Jul 2
My Father Wants to Age in Place. AI Will Be Watching longreads.com · “His coughs, toilet flushes, and even snippets of private conversations—Sensi records it all.”
Jul 2

June 2026 7 posts

European Digital ID Wallets Are a Gift to Google and Apple waag.org · “ID wallets are public infrastructure to access critical public services. They should remain interoperable across different devices and operating systems, free from vendor lock-in.”
Jun 30
Double Threat to Private Communications: Chat Control Relaunch patrick-breyer.de · “What we are witnessing this week is a blatant disregard for democratic processes and fundamental rights.”
Jun 29
US Agency Cancels Contract For Warrantless Tracking of Mobile Devices web.archive.org · “Webloc, which is made by a vendor called Penlink, sources data from consumer apps and advertising networks, which collect the location of mobile devices from consumers who download apps or browse the web.”
Jun 28
Nearly Half of LG Smart TV Apps Contain Residential Proxy SDKs spur.us · “Beneath that calm interface, however, a proxy SDK silently sells access to the home’s internet connection, making money in the background while the user stares at animated fish.”
Jun 28
We can still stop California's 3D printer surveillance scheme eff.org · “A printer surveillance system won’t work for its intended purpose, and will only harm law abiding users.”
Jun 26
Identity verification on Claude support.claude.com · “We are not using your identity data to train our models.”
Jun 21
What If It All Came Out? nymag.com · “Everyone who is smart is paranoid right now.”
Jun 15

May 2026 7 posts

EU Parliamentary Research Service calls VPNs "a loophole that needs closing" cyberinsider.com · “The Parliamentary Research Service describes commercial VPN services as a loophole that needs closing.”
May 9
France Moves to Break Encrypted Messaging reclaimthenet.org · “The French interior ministry is preparing legislation that would require backdoor access to all encrypted communications.”
May 8
Google broke reCAPTCHA for de-googled Android users reclaimthenet.org · “Users running GrapheneOS, CalyxOS, and LineageOS are now blocked from sites using reCAPTCHA unless they sign in to a Google account.”
May 8
Google Chrome silently installs a 4 GB AI model on your device without consent thatprivacyguy.com · “Chrome is reaching into the user’s filesystem on its own initiative and laying down a 4 GB ML binary while the foreground tab does something completely unrelated.”
May 5
Utah to hold websites liable for users who mask their location with VPNs tomshardware.com · “Sites would face liability if a Utah user accessed restricted content using a VPN, even if the site complied with all standard age verification requirements.”
May 4
US healthcare marketplaces shared citizenship and race data with ad tech giants techcrunch.com · “Healthcare.gov state exchanges leaked citizenship status, race, and income data to Google, Meta, and LinkedIn through tracking pixels.”
May 3
Maryland to ban A.I.-driven price increases in grocery stores nytimes.com · “The law prohibits grocery chains from using individual consumer data to set personalized prices at checkout.”
May 1

April 2026 5 posts

Online age verification is the hill to die on x.com · “Once you have to prove who you are to read, the internet you grew up with is gone.”
Apr 29
EU Age Control: The trojan horse for digital IDs juraj.bednar.io · “The EU’s age control proposal is functionally a digital ID mandate.”
Apr 25
Firefox Has Integrated Brave's Adblock Engine itsfoss.com · “Firefox has integrated the Rust-based adblock engine developed by Brave.”
Apr 24
Shuttered startups are selling old Slack chats and emails to AI companies fastcompany.com · “Failed startups are selling their old internal communications to AI training companies.”
Apr 17
US Bill Mandates On-Device Age Verification reclaimthenet.org · “A new US bill would require operating systems to verify user ages on-device.”
Apr 16

March 2026 7 posts

FBI Director Confirms Bureau Is Buying Americans Location Data Without Warrants techcrunch.com · “The FBI uses all tools to do our mission. We do purchase commercially available information that’s consistent with the Constitution.”
Mar 22
Do Not Turn Child Protection into Internet Access Control news.dyne.org · “Every age verification proposal, in every jurisdiction, ends in the same place. Universal identity checks for everyone.”
Mar 21
Bill C-22, the Lawful Access Act: Dangerous backdoor surveillance risks remain michaelgeist.ca · “The third revival of lawful access in Canada keeps the encryption backdoor language nearly intact.”
Mar 15
Florida judge rules red light camera tickets are unconstitutional cbs12.com · “The judge ruled that the camera vendor, not the local government, was effectively prosecuting drivers, in violation of due process.”
Mar 9
Proton Mail Helped FBI Unmask Anonymous 'Stop Cop City' Protester 404media.co · “While Proton Mail’s encryption protects message content, financial records remain vulnerable to government requests processed through proper legal procedures.”
Mar 6
Vehicle Tire Pressure Sensors Enable Silent Tracking darkreading.com · “Anyone equipped with roughly $100 worth of radio hardware can silently identify and re-identify the same vehicle repeatedly, building movement profiles without driver awareness or consent.”
Mar 4
Motorola announces a partnership with GrapheneOS motorolanews.com · “This collaboration marks a significant milestone in expanding the reach of GrapheneOS, and we applaud Motorola for taking this meaningful step towards advancing mobile security.”
Mar 2

February 2026 9 posts

US orders diplomats to fight data sovereignty initiatives reuters.com · “A State Department cable instructs embassies to oppose foreign laws requiring data to be stored locally.”
Feb 25
Russia Charges Telegram Founder Pavel Durov With Facilitating Terrorism meduza.io · “The illusion of anonymity has drawn armies of radicals, drug addicts, killers, and terrorists to the messenger.”
Feb 24
The Age Verification Trap: Verifying age undermines everyone's data protection spectrum.ieee.org · “Platforms are caught in a dilemma: enforce age restrictions or protect user privacy.”
Feb 21
Flock cameras gifted by Horowitz Foundation, avoiding public oversight thenevadaindependent.com · “It’s a short circuit of the democratic process.” — Jay Stanley, ACLU lawyer
Feb 20
Across the US, people are dismantling and destroying Flock surveillance cameras bloodinthemachine.com · “They’re robbing us!”
Feb 20
Every company building your AI assistant is now an ad company juno-labs.com · “Policy is a promise. Architecture is a guarantee.”
Feb 19
I verified my LinkedIn identity. Here's what I handed over. thelocalstack.eu · “You scanned your European passport for a European professional network, and your data went exclusively to North American companies.”
Feb 18
Chrome extensions spying on users' browsing data qcontinuum.substack.com · “287 Chrome extensions with a combined 65 million installs were exfiltrating browsing history to third-party servers.”
Feb 11
Discord/Twitch/Snapchat age verification bypass age-verifier.kibty.town · “A working bypass for the age verification system used by major platforms in regulated jurisdictions.”
Feb 11

January 2026 6 posts

Mobile carriers can get your GPS location an.dywa.ng · “The carrier-side API for assisted GPS is exposed to anyone with carrier access. Your phone reports its precise location on demand, regardless of app permissions.”
Jan 31
Minnesota Rejects DOJ Demand for Voter Rolls talkingpointsmemo.com · “Her letter is an apparent ransom to pay for our state’s peace and security.”
Jan 28
The Behavioral Cost of Personalized Pricing digitalseams.com · “Technology gives us not only quantity, but ubiquity—every piece of behavioral context can contribute to your prices.”
Jan 25
Microsoft gave FBI a set of BitLocker encryption keys to unlock suspects' laptops techcrunch.com · “Microsoft is making a tradeoff here between privacy and recoverability.”
Jan 24
So, you've hit an age gate. What now? eff.org · “Age verification systems are spreading faster than the public conversation about them. Here is what to do when you encounter one.”
Jan 16
New information extracted from Snowden PDFs through metadata version analysis libroot.org · “Document metadata in the original Snowden cache reveals additional context about which programs were active and how broadly they were authorized.”
Jan 10

2025 106 posts

November 2025 1 posts

Firefox's New Anti-Fingerprinting Protections Cut User Tracking by 70% blog.mozilla.org · “These new protections can reduce the number of uniquely fingerprinted users to just 20%, down from over 60% of users that can be fingerprinted without any protections.”
Nov 11

September 2025 2 posts

Privacy and Security Risks in the eSIM Ecosystem usenix.org · “Travel eSIMs often route user data through third-party networks including Chinese infrastructure regardless of user location.”
Sep 19
Zen Browser Had a Backdoor Enabled by Default github.com · “Zen browser, marketed as privacy-conscious, was found to have a serious backdoor. Multiple privacy concerns were practically ignored by developers.”
Sep 7

August 2025 2 posts

StarDict sends X11 clipboard to remote servers lwn.net · “Any selected text being sent to both servers over unencrypted HTTP, including potentially sensitive information like passwords from password managers or confidential documents.”
Aug 12
uBlock Origin Lite now available for Safari apps.apple.com · “The app uses declarative filtering, meaning it doesn’t require a continuous background process.”
Aug 5

July 2025 5 posts

You Shouldn't Have to Make Social Media Public to Get a Visa techdirt.com · “The government may interpret lack of social media activity or refusal to unlock accounts as an attempt to evade the requirement or deliberately hide online activity.”
Jul 24
UK Backing Down on Apple Encryption Backdoor arstechnica.com · “This is something that the vice-president is very annoyed about and which needs to be resolved. The Home Office is basically going to have to back down.”
Jul 21
ICE's Facial Recognition App of 200 Million Images 404media.co · “This app shows that biometric technology has moved well beyond just confirming someone’s identity. In the hands of ICE officers, it’s becoming a way to retrieve vast amounts of data about a person on demand just by pointing a camera in their face.”
Jul 17
Chrome's Hidden X-Browser-Validation Header Reverse Engineered github.com · “Chrome almost certainly uses this header as an integrity signal, verifying that the declared user agent matches the underlying platform, spotting user agent spoofing attempts.”
Jul 13
ICE Searching Insurance Database for Deportation Targets 404media.co · “ICE will stop at nothing to build a mass surveillance dragnet to track, surveil and criminalize all community members.”
Jul 9

June 2025 16 posts

Using WiFi Motion in the Xfinity app web.archive.org · “Subject to applicable law, Comcast may disclose information generated by your WiFi Motion to third parties without further notice to you in connection with any law enforcement investigation or proceeding, any dispute to which Comcast is a party, or pursuant to a court order or subpoena.”
Jun 30
Google Gemini is about to control your messages and calls, even if you say no laptopmag.com · “On July 7, Google’s Gemini assistant will be able to send a WhatsApp message, place a call, adjust your volume, or set a timer, even if you’ve told it not to track what you’re doing.”
Jun 29
Facebook is starting to feed its AI with private, unpublished photos theverge.com · “Meta tells The Verge that it’s not currently training its AI models on those photos, but it would not answer our questions about whether it might do so in future, or what rights it will hold over your camera roll images.”
Jun 28
Open Letter to Samsung: End Forced Israeli-Founded Bloatware Installations in the WANA Region smex.org · “Even disabling the bloatware is not effective as it can reappear after system updates.”
Jun 21
Websites Are Tracking You Via Browser Fingerprinting engineering.tamu.edu · “Perhaps more concerning, the researchers found that even users who explicitly opt out of tracking under privacy laws like Europe’s General Data Protection Regulation (GDPR) and California’s California Consumer Privacy Act (CCPA) may still be silently tracked across the web through browser fingerprinting.”
Jun 18
Helping You Find More Channels and Businesses on WhatsApp about.fb.com · “For people that have chosen to add WhatsApp to Accounts Center, we’ll also use your ad preferences and info from across your Meta accounts.”
Jun 16
Airlines Don’t Want You to Know They Sold Your Flight Data to DHS wired.com · “The big airlines—through a shady data broker that they own called ARC—are selling the government bulk access to Americans’ sensitive information, revealing where they fly and the credit card they used”
Jun 11
Menstrual tracking app data is a ‘gold mine’ for advertisers that risks women’s safety – report cam.ac.uk · “In fact, data on pregnancy is believed to be over two hundred times more valuable than data on age, gender or location for targeted advertising.”
Jun 11
Leaking the phone number of any Google user brutecat.com · “Using a $0.30/hour server with consumer-grade specs (16 vcpu), I’m able to achieve ~40k checks per second.”
Jun 9
EU launches EU-based, privacy-focused DNS resolution service helpnetsecurity.com · “The EU will not have access to configuration, data, etc. On top of that, DNS4EU will not be forced on anyone.”
Jun 9
Reverse Engineering Cursor's LLM Client tensorzero.com · “This also means that your credentials must be forwarded to Cursor’s servers, allowing them to collect data on your inferences and codebase.”
Jun 7
OpenAI Is Ordered to Save Every ChatGPT Chat — Even the Ones You Delete reclaimthenet.org · “Judge Wang denied OpenAI’s motion to lift the order on May 29, assuring the company during proceedings that user data would not be made publicly available.”
Jun 6
Twitter's new encrypted DMs aren't better than the old ones mjg59.dreamwidth.org · “Twitter can probably obtain your private keys, and admit that they can MITM you and have full access to your metadata.”
Jun 5
VC money is fueling a global boom in worker surveillance tech restofworld.org · “Many tools are first deployed in Latin America, where labor laws are less strictly enforced, according to Ayden Férdeline, a tech policy researcher in Berlin and a co-author of the report.”
Jun 4
Covert Web-to-App Tracking via Localhost on Android localmess.github.io · “This web-to-app ID sharing method bypasses typical privacy protections such as clearing cookies, Incognito Mode and Android’s permission controls.”
Jun 3
She Got an Abortion. So A Texas Cop Used 83,000 Cameras to Track Her Down eff.org · “The officer searched 6,809 different camera networks maintained by surveillance tech company Flock Safety, including states where abortion access is protected by law, such as Washington and Illinois. The search record listed the reason plainly: “had an abortion, search for female.””
Jun 1

May 2025 14 posts

The Trackers and SDKs in ChatGPT, Claude, Grok and Perplexity jamesoclaire.com · “Next was statsig.com and wow! I was blown away I found this one in 3 of the 4 apps.”
May 31
Introducing oniux: Kernel-level Tor isolation for any Linux app blog.torproject.org · “Unlike SOCKS, the application cannot accidentally leak data by failing to make some connection via the configured SOCKS, which may happen due to a mistake by the developer.”
May 31
By Default, Signal Doesn't Recall signal.org · “Apps like Signal have essentially no control over what content Recall is able to capture, and implementing “DRM” that works for you (not against you) is the best choice that we had.”
May 21
Pharma giant Regeneron to buy 23andMe and its customers' data for $256M techcrunch.com · “Regeneron said it will acquire 23andMe’s genomics service and its bank of 15 million customers’ personal and genetic data as part of the deal.”
May 19
O2 VoLTE: locating any customer with a phone call mastdatabase.co.uk · “Any O2 customer can be trivially located by an attacker with even a basic understanding of mobile networking.”
May 17
"We would be less confidential than Google" – Proton threatens to quit Switzerland over new surveillance law techradar.com · “This revision attempts to implement something that has been deemed illegal in the EU and the United States. The only country in Europe with a roughly equivalent law is Russia,” said Yen.
May 17
EU ruling: tracking-based advertising by Google, Microsoft, Amazon, X, across Europe has no legal basis iccl.ie · “The TCF is live on 80% of the Internet.”
May 15
How California sent residents' personal health data to LinkedIn themarkup.org · “As visitors filled out forms on the website, trackers on the same pages told LinkedIn their answers to questions about whether they were blind, pregnant, or used a high number of prescription medications.”
May 15
In Memoriam: John L. Young, Cryptome Co-Founder eff.org · “John L. Young, who died March 28 at age 89 in New York City, was among the first people to see the need for an online library of official secrets, a place where the public could find out things that governments and corporations didn’t want them to know.”
May 15
How Broken OTPs and Open Endpoints Turned a Dating App Into a Stalker's Playground alexschapiro.com · “BOOM – the OTP is directly in the response, meaning anyone’s account can be accessed with just their phone number.”
May 12
Microsoft Teams will soon block screen capture during meetings bleepingcomputer.com · “However, it should be noted that, even if screenshots are blocked, sensitive media and information shared in Teams meetings can still be captured by taking a photo of the conversation.”
May 10
Sam Altman Wants Your Eyeball privacyguides.org · “Simply put, the premise is this: scan your eyeball, get a biometric tag, verify yourself, buy our apps (and cryptocurrency).”
May 10
Irish Data Protection Commission fines TikTok €530 million and orders corrective measures following Inquiry into transfers of EEA User Data to China dataprotection.ie · “Throughout the Inquiry, TikTok informed the DPC that it did not store EEA User Data on servers located in China.”
May 2
Third Party Cookies Must Be Removed w3ctag.github.io · “Third-party (AKA cross-site) cookies are harmful to the web, and must be removed from the web platform.”
May 2

April 2025 17 posts

Indian court orders blocking of Proton Mail techcrunch.com · “On Tuesday, the Karnataka High Court directed the Indian government to block Proton Mail, a popular email service known for its enhanced security, following a legal complaint filed by New Delhi-based M Moser Design Associates.”
Apr 29
Did 5G kill the IMSI catcher? zetier.com · “An IMSI catcher is a tool that collects cellular signals and decodes packets to access and save off the IMSI.”
Apr 27
Facebook isn't eavesdropping, but the truth is more disturbing newatlas.com · “The problem is, outside of anecdotal cases, no one has ever been able to find clear evidence that this is actually happening.”
Apr 26
Like to play alone? Ubisoft is still watching you! noyb.eu · “The complainant discovered that, over a period of just 10 minutes, the game established a connection to external servers 150 times.”
Apr 24
Google Chrome will now continue to use third-party cookies digiday.com · “We’ve made the decision to maintain our current approach to offering users third-party cookie choice in Chrome, and will not be rolling out a new standalone prompt for third-party cookies.”
Apr 22
JUICYJAM: How Thai Authorities Use Online Doxxing to Suppress Dissent citizenlab.ca · “Thanks to a public leak of confidential military and police documents in March 2025, we can now attribute the campaign to the Royal Thai Armed Forces and/or the Royal Thai Police.”
Apr 20
Judge Rules Blanket Search of Cell Tower Data Unconstitutional 404media.co · “The judge also ruled that the cops could, this one time, still use the evidence they obtained through this unconstitutional search.”
Apr 18
The latest viral ChatGPT trend is doing 'reverse location search' from photos techcrunch.com · “It’s an obvious potential privacy issue. There’s nothing preventing a bad actor from screenshotting, say, a person’s Instagram Story and using ChatGPT to try to doxx them.”
Apr 18
Discord using AI face scans for age-verification in two specific scenarios 9to5mac.com · “If you opt for a face-scan, Discord says the age estimation is performed on your device, so is not uploaded or stored. If you choose ID, the scan will be uploaded, but will be deleted after verification.”
Apr 17
Reproducing Hacker News writing style fingerprinting antirez.com · “Indeed, for most of the users I tested this against, it worked very well, and often times it was the top result.”
Apr 16
It's easier than ever to de-censor videos jeffgeerling.com · “Years ago it would’ve required a supercomputer and a PhD to do this stuff.”
Apr 15
Microsoft starts final Windows Recall testing before rollout bleepingcomputer.com · “Recall is an opt-in Windows feature that screenshots active windows every few seconds, analyzes them, and allows Windows 11 users to search text within the snapshots.”
Apr 12
Government fails to keep Apple legal battle secret lawgazette.co.uk · “In a judgment handed down today, tribunal president Lord Justice Singh and Mr Justice Johnson said preventing disclosure even of the fact that a hearing was taking place would have represented ’the most fundamental interference with the principle of open justice’.”
Apr 8
Europe preparing to 'ease the burden' of landmark data privacy law therecord.media · “The European Commission is now finalizing a plan to simplify and potentially remove many of the regulatory requirements imposed by the continent’s complex and far-reaching General Data Protection Regulation, particularly those impacting small and medium-sized businesses.”
Apr 7
Gmail E2E is as terrible as expected michal.sapka.pl · “If I receive an “e2e” encrypted email from gmail, I will not be able to read it without going to a Google service.”
Apr 6
Verizon Call Filter API flaw exposed customers' incoming call history bleepingcomputer.com · “Call metadata might seem harmless, but in the wrong hands, it becomes a powerful surveillance tool.”
Apr 2
DEDA - tracking Dots Extraction, Decoding and Anonymisation toolkit github.com · “This process is integrated in almost every commercial colour laser printer. This means that almost every printout contains coded information about the source device, such as the serial number.”
Apr 1

March 2025 19 posts

Targeted advertising: the Autorité de la concurrence imposes a fine of €150,000,000 on Apple for the implementation of the App Tracking Transparency ("ATT") framework autoritedelaconcurrence.fr · “While advertising tracking only needs to be refused once, the user must always confirm their consent a second time.”
Mar 31
Everyone knows all the apps on your phone peabee.substack.com · “Until a few years ago, any app you installed on an Android device could see all other apps on your phone without your permission.”
Mar 29
Madison Square Garden Bans Fan After Surveillance System IDs Him as a Critic of Its CEO gizmodo.com · “Since 2018, the venue has been equipped with facial recognition tools used to identify people deemed to be potential security threats.”
Mar 29
I drove 300 miles in rural Virginia, then asked police to send me their public surveillance footage of my car. Here's what I learned. cardinalnews.org · “Not only do we not have a right to privacy in public; we don’t even have a right to see ourselves as the government and police might see us.”
Mar 28
DNA testing company 23andMe files for bankruptcy protection, CEO resigns techcrunch.com · “Then in 2023, it suffered a massive cyberattack in which the data of its nearly 7 million customers, including users’ genetic predisposition and ancestry reports, was stolen by hackers.”
Mar 24
Attorney General Bonta Urgently Issues Consumer Alert for 23andMe Customers oag.ca.gov · “Given 23andMe’s reported financial distress, I remind Californians to consider invoking their rights and directing 23andMe to delete their data and destroy any samples of genetic material held by the company.”
Mar 22
Meta settles UK 'right to object to ad-tracking' lawsuit by agreeing not to track plaintiff techcrunch.com · “A human rights campaigner, Tanya O’Carroll, has succeeded in forcing social media giant Meta not to use her data for targeted advertising.”
Mar 22
A Win for Encryption: France Rejects Backdoor Mandate eff.org · “The proposed law was a surveillance wishlist disguised as anti-drug legislation.”
Mar 21
ChatGPT hit with privacy complaint over defamatory hallucinations techcrunch.com · “AI companies should stop acting as if the GDPR does not apply to them, when it clearly does.”
Mar 20
Amazon's Echo is ending its 'Do Not Send Voice Recordings' feature, starting March 28 techcrunch.com · “Amazon Echo users will no longer have the option to process their Alexa voice recordings locally, which means those recordings (with the exception of certain Alexa features like wake word detection) will be sent to the company’s cloud.”
Mar 15
Healthcare Staff Database with 86,000 Records Exposed Online hipaajournal.com · “Medical documents were also found that included diagnoses, prescriptions, and treatments, which Fowler presumed served as proof of medical grounds for missing shifts.”
Mar 14
In Memoriam: Mark Klein, AT&T Whistleblower Who Revealed NSA Mass Spying eff.org · “Mark stood up and told the truth at great personal risk to himself and his family.”
Mar 12
First Porn, Now Skin Cream? 'Age Verification' Bills Are Out of Control eff.org · “Age verification laws do far more than ‘protect children online’—they require the creation of a system that collects vast amounts of personal information from everyone.”
Mar 7
As Bangladesh's factories turn to surveillance and automation, garment workers feel the pressure restofworld.org · “Each machine could replace between one and six workers, and the largest factories surveyed anticipated cutting 22% of their workforce.”
Mar 6
NCSC, GCHQ, UK Gov't expunge advice to "use Apple encryption" for Barristers, Solicitors (etc…) — co-incidental with Apple lawsuit against HMG's demanding a backdoor in the same alecmuffett.com · “the politically inconvenient ADP-promoting “for barristers” document has actually been wholesale deleted from the internet, with a HTTP redirect put in place to point to the inferior “defending democracy” documents.”
Mar 5
How Google tracks Android device users before they've even opened an app theregister.com · “Leith says the DSID advertising cookie is created shortly after the user logs into their Google account – part of the Android startup process – with a tracking file linked to that account placed into the Google Play Service’s app data folder.”
Mar 4
Meet Rayhunter: A New Open Source Tool from EFF to Detect Cellular Spying eff.org · “Rayhunter works by intercepting, storing, and analyzing the control traffic (but not user traffic, such as web requests) between the mobile hotspot Rayhunter runs on and the cell tower to which it’s connected.”
Mar 4
Cellebrite zero-day exploit used to target phone of Serbian student activist securitylab.amnesty.org · “Since the exploits identified in this research target core Linux kernel USB drivers, the vulnerability is not limited to a particular device or vendor and could impact over a billion Android devices.”
Mar 1
Xcode constantly phones home lapcatsoftware.com · “And all of these connections from Xcode, to every domain, require login to your Apple Developer account, so Apple is definitely receiving identifying information about you in any case.”
Mar 1

February 2025 17 posts

An update on our terms of use blog.mozilla.org · “The reason we’ve stepped away from making blanket claims that ‘We never sell your data’ is because, in some places, the LEGAL definition of ‘sale of data’ is broad and evolving.”
Feb 28
Authorities worldwide can see more than ever, with Big Tech as their eyes proton.me · “The US government made nearly 500,000 data requests to Google and Meta — more than all the other members of the so-called 14 Eyes Alliance combined.”
Feb 28
Tracking You from a Thousand Miles Away! Turning a Bluetooth Device into an Apple AirTag Without Root Privileges nroottag.github.io · “The attacker doesn’t need to be anywhere near you - they can track your location from thousands of miles away as long as there are Apple devices passing near you.”
Feb 27
Signal's CEO: Then We're Leaving Sweden swedenherald.com · “The purpose of the bill – which may be passed next year – is for the police and Security Service to be able to request message history in retrospect for individuals suspected of crimes.”
Feb 25
'Hey Number 17!' 404media.co · “Y Combinator supports an AI startup that’s pitching granular machine vision surveillance of factory workers.”
Feb 25
In Memoriam - OnlineSafetyAct.co.uk onlinesafetyact.co.uk · “The following sites and services have stated that the Online Safety Act 2023 is the reason for their closing, or for geo-blocking UK users.”
Feb 23
Apple Pulls Encrypted iCloud Security Feature in UK Amid Government Backdoor Demands macrumors.com · “We are gravely disappointed that the protections provided by ADP will not be available to our customers in the UK given the continuing rise of data breaches and other threats to customer privacy,” Apple said in a statement.
Feb 21
Critics say new Google rules put profits over privacy bbc.com · “By explicitly allowing a tracking technique that they previously described as incompatible with user control, Google highlights its ongoing prioritisation of profits over privacy,” said Lena Cohen, staff technologist at the Electronic Frontier Foundation.
Feb 16
Olson v. County of Grant (opinion, No. 23-35365) govinfo.gov · “This appeal presents a scenario in which agencies from two different state jurisdictions shared a defendant’s sensitive phone data without consent, without a warrant, and without any pending charges, or even an investigation by the out-of-state agency requesting access to the data.”
Feb 14
Watchdog ponders why Apple doesn't apply its strict app tracking rules to itself theregister.com · “Apple is feeling the heat over its acclaimed iPhone privacy policy after a German regulator’s review of iOS tracking consent alleged that the tech giant exempted itself from the rules it enforces on third-party developers.”
Feb 14
Introducing Privacy Pass authentication for Kagi Search blog.kagi.com · “When we cannot track you even if we wanted to, that’s genuine privacy.”
Feb 13
Leaking the email of any YouTube user for $10,000 brutecat.com · “There wasn’t any server-side limit to the length of a recording name.”
Feb 12
Larry Ellison wants to put all America's data, including DNA, in one big Oracle system for AI to study theregister.com · “As long as countries will put their data - all of it - in a single place we can use AI to help manage the care of all of the patients and the population at large,” Ellison said
Feb 12
A 2023 study concluded CAPTCHAs are 'a tracking cookie farm for profit masquerading as a security service' that made us spend 819 million hours clicking on traffic lights to generate nearly $1 trillion for Google pcgamer.com · “Both are valuable to Google, with the tracking cookies generated by the former potentially contributing to ad targeting, and data from the latter being applied toward AI model training, either internally at Google or sold to another company.”
Feb 10
Bad Smart Watch Auth sprocketfox.io · “Anyone can connect to the device at any time and start issuing commands. You can pull activity data, sleep data, heart rate data, menstrual data.”
Feb 9
The UK's Demands for Apple to Break Encryption Is an Emergency for Us All eff.org · “There is no technological compromise between strong encryption that protects the data and a mechanism to allow the government special access to this data.”
Feb 8
Everyone knows your location: tracking myself down through in-app ads timsh.org · “This is the worst thing about these data trades that happen constantly around the world - each small part of it is (or seems) legit. It’s the bigger picture that makes them look ugly.”
Feb 2

January 2025 13 posts

When everything becomes a profit center… a.wholelottanothing.org · “But as Americans, we basically have no real rights to privacy, so my home address showed up in the PulsePoint logs and then a guy from Servpro read it and promptly arrived at my door hawking his services.”
Jan 31
California Law Enforcement Misused State Databases More Than 7,000 Times in 2023 eff.org · “The sheriff’s department’s 6,789 abuses made up a majority of the record 7,275 violations across California that were reported to the state Department of Justice (CADOJ) in 2023 regarding the California Law Enforcement Telecommunications System (CLETS).”
Jan 30
Facial Recognition Backfires on Police in Ohio Murder Case gizmodo.com · “The only evidence pointing to Tolbert was a report from Clearview AI, which explicitly said in a disclaimer at the bottom that the results ‘are to be treated as investigative leads and should not be solely relied upon for making an arrest.’”
Jan 28
Brazil bans Worldcoin from giving crypto for eye scans cointelegraph.com · “offering crypto as compensation could compromise the validity of user consent for collecting sensitive biometric data.”
Jan 27
Texas Is Enforcing Its State Data Privacy Law. So Should Other States. eff.org · “The Texas Attorney General’s office estimates that 45 million Americans, including those in Texas, unwittingly downloaded this software that collected their information, including location information, without notice or consent.”
Jan 25
Hacking Subaru: Tracking and Controlling Cars via the STARLINK Admin Panel samcurry.net · “Using the access provided by the vulnerability, an attacker who only knew the victim’s last name and ZIP code, email address, phone number, or license plate could have done the following:”
Jan 23
VICTORY! Federal Court (Finally) Rules Backdoor Searches of 702 Data Unconstitutional eff.org · “In 2021 alone, the FBI conducted 3.4 million warrantless searches of US person’s 702 data.”
Jan 22
The FTC's Ban on GM and OnStar Selling Driver Data Is a Good First Step eff.org · “In reality, no consumer knowingly agrees to let their carmaker sell their driving data to other companies.”
Jan 22
Unique 0-click deanonymization attack targeting Signal, Discord and hundreds of platform gist.github.com · “Signal instantly dismissed my report, saying it wasn’t their responsibility and it was up to users to hide their identity”
Jan 21
Let's talk about AI and end-to-end encryption blog.cryptographyengineering.com · “Once a sufficiently-powerful general-purpose agent has been deployed on your phone, the only question that remains is who is given access to talk to it.”
Jan 17
Massive data breach exposes precise locations for users of many popular apps 9to5mac.com · “Millions of pieces of precise location data have been released, showing users’ most visited locations such as their home, workplace, and more.”
Jan 13
Homomorphic Encryption in iOS 18 boehs.org · “With that being said, technical understanding is no substitute for consent, which should have been requested by Apple along with a proper explanation.”
Jan 11
They squandered the holy grail xeiaso.net · “This is the holy grail for remotely attested trusted compute.”
Jan 6

2024 133 posts

December 2024 9 posts

VW Suffers Major Breach Exposing Location of 800,000 Electric Vehicles cyberinsider.com · “In some cases, the GPS data was precise to within 10 centimeters.”
Dec 27
Why Dumb TVs Deserve a Comeback makeuseof.com · “A common security risk associated with smart TVs is Automatic Content Recognition (ACR), which tracks what’s on your screen and sends this data to advertisers.”
Dec 15
Microsoft Recall screenshots credit cards and Social Security numbers, even with the "sensitive information" filter enabled tomshardware.com · “However, what my experiment proves is that it’s pretty much impossible for Microsoft’s AI filter to identify every situation where sensitive information is on screen and avoid capturing it.”
Dec 12
X41 Reviewed Mullvad VPN x41-dsec.de · “The most serious vulnerabilities are considered to be race conditions and temporal safety violations leading to memory corruption issues in the signal handler code.”
Dec 11
Atrium Health Data Breach Impacts 585,000 People securityweek.com · “Atrium said it’s difficult to precisely determine what data was transmitted to third-parties, but it’s assuming that all users of the MyAtriumHealth or MyCarolinas patient portal between January 2015 and July 2019 are affected.”
Dec 9
Airline informant received thousands from passenger cash seizures atlantanewsfirst.com · “The DEA wasn’t keeping records of its encounters unless it found cash or drugs,” Horowitz said.
Dec 8
How Much Do I Need to Change My Face to Avoid Facial Recognition? gizmodo.com · “Asking our governments to create laws to protect us is much easier than changing our faces dramatically all the time.”
Dec 8
Employee lawsuit accuses Apple of spying on its workers semafor.com · “For Apple employees, the Apple ecosystem is not a walled garden. It is a prison yard.”
Dec 6
FTC bans data brokers from selling Americans' sensitive location data bleepingcomputer.com · “Virginia-based Gravy Analytics and its subsidiary Venntel used this information to build products and services, allowing customers to search through at least three years of historical data (including raw, precise mobile location data).”
Dec 4

November 2024 6 posts

Children and teenagers under 16 to be banned from social media after parliament passes world-first laws abc.net.au · “There are no penalties for young people or parents who flout the rules.”
Nov 28
Lights Out: Tools for controlling webcam LED on ThinkPad X230 github.com · “These were created as a practical demonstration that malware can record video through the webcam without the LED indication.”
Nov 27
Do you need ID to read the REAL-ID rules? papersplease.org · “You shouldn’t need ID to read the law, just as you shouldn’t need ID to travel by common carrier.”
Nov 25
Italian food delivery app Foodinho eats another privacy fine techcrunch.com · “Foodinho has also been banned from using riders’ biometric data, such as facial recognition, for identity verification.”
Nov 25
Senators Say TSA's Facial Recognition Program Is Out of Control, Here's How to Opt Out gizmodo.com · “This technology will soon be in use at hundreds of major and mid-size airports without an independent evaluation of the technology’s precision or an audit of whether there are sufficient safeguards in place to protect passenger privacy”
Nov 24
Cops Suspect iOS 18 iPhones Are Communicating to Force Reboots, Making Unlocking Harder macrumors.com · “This can be very detrimental to the acquisition of digital evidence”
Nov 7

October 2024 7 posts

LinkedIn fined $335 million in EU for tracking ads privacy breaches techcrunch.com · “As well as being fined, LinkedIn has been given three months to bring its European operations into compliance with the GDPR.”
Oct 25
The Global Surveillance Free-for-All in Mobile Ad Data krebsonsecurity.com · “Collectively, these stories expose how the broad availability of mobile advertising data has created a market in which virtually anyone can build a sophisticated spying apparatus capable of tracking the daily movements of hundreds of millions of people globally.”
Oct 23
LTESniffer: An Open-source LTE Downlink/Uplink Eavesdropper github.com · “However, those messages sent in plaintext can be completely analyzable. For example, the broadcast messages sent by the cell tower, or the messages at the beginning of the connection are completely visible.”
Oct 22
macOS sometimes leaks traffic after system updates mullvad.net · “Unfortunately apps are not required to respect the routing table and can send traffic outside the tunnel if they try to. Some examples of apps that do this are Apple’s own apps and services since macOS 14.6, up until a recent 15.1 beta.”
Oct 16
China-linked group Salt Typhoon hacked US broadband providers and breached wiretap systems securityaffairs.com · “The WSJ states that the compromise remained undisclosed due to possible impact on national security.”
Oct 7
Meta confirms it may train its AI on any image you ask Ray-Ban Meta AI to analyze techcrunch.com · “The only way to “opt out” is to simply not use Meta’s multimodal AI features in the first place.”
Oct 4
ABC News hacks into popular robot vacuum, watches owner through camera abc.net.au · “His robot was vulnerable to being hacked from afar, and Ecovacs hadn’t done anything about it, despite being warned back in December 2023.”
Oct 3

September 2024 14 posts

FTC Report Confirms: Commercial Surveillance is Out of Control eff.org · “The FTC also found that some companies were not actually deleting user data in response to deletion requests.”
Sep 29
Telegram will now hand over your phone number and IP if you’re a criminal suspect theverge.com · “If Telegram receives a valid order from the relevant judicial authorities that confirms you’re a suspect in a case involving criminal activities that violate the Telegram Terms of Service, we will perform a legal analysis of the request and may disclose your IP address and phone number to the relevant authorities.”
Sep 23
Federal civil rights watchdog sounds alarm over DOJ, DHS and HUD use of facial recognition technology therecord.media · “As a result, the report said it is impossible to know how many evictions from public housing FRT played a role in.”
Sep 20
FTC Staff Report Finds Large Social Media and Video Streaming Companies Have Engaged in Vast Surveillance of Users with Lax Privacy Controls and Inadequate Safeguards for Kids and Teens ftc.gov · “The report lays out how social media and video streaming companies harvest an enormous amount of Americans’ personal data”
Sep 19
Is Tor still safe to use? blog.torproject.org · “From the limited information The Tor Project has, we believe that one user of the long-retired application Ricochet was fully de-anonymized through a guard discovery attack.”
Sep 18
Warning: DNS encryption in Little Snitch 6.1 may occasionally fail obdev.at · “There appears to be a bug in macOS Sequoia causing some requests to bypass the installed DNS proxy and be sent unencrypted to the system’s default name server instead.”
Sep 18
Facebook admits to scraping every Australian adult user's public photos and posts to train AI, with no opt-out option abc.net.au · “Ms Claybaugh admitted to the inquiry that those opt-out options were not offered to Australians.”
Sep 13
Feeld dating app – Your nudes and data were publicly available fortbridge.co.uk · “We can build upon the previous vulnerability ‘Read other people’s messages’ and we can access the attachments (images and videos) that have been shared between users.”
Sep 11
Bug lets anyone bypass WhatsApp’s ‘View Once’ privacy feature techcrunch.com · “But a bug in how WhatsApp implements its so-called “View Once” feature in its browser-based web app allows any malicious recipient to display and save the picture and video, which should vanish immediately after being viewed.”
Sep 11
[tor-relays] Artikel 5 e.V. - Another police raid in Germany - general assembly on Sep 21st 2024 forum.torproject.org · “Apart from one burnt (middle relay) node and some billing paperwork for the exit node this was all about, the team left the house after one and a half hours with mostly empty hands.”
Sep 10
Ford Patents In-Car System That Eavesdrops So It Can Play You Ads motortrend.com · “For one, there’s a recognition that an occupant’s “natural inclination to seek minimal or no ads” should be balanced with “maximum opportunity for ad-based monetization.””
Sep 7
Clearview AI Faces €30.5M Fine for Building Illegal Facial Recognition Database thehackernews.com · “Facial recognition is a highly intrusive technology that you cannot simply unleash on anyone in the world,”
Sep 6
Should truckers be allowed to sing along with the radio? freightwaves.com · “Amazon denies they have asked their partners not to sing.”
Sep 4
Microsoft's 'Recall' feature can't be uninstalled after all mashable.com · “We are aware of an issue where Recall is incorrectly listed as an option under the ‘Turn Windows features on or off’ dialog in Control Panel,”
Sep 3

August 2024 12 posts

Did your car witness a crime? Police may be coming for your Tesla sfchronicle.com · “Based on this information, I respectfully request that a warrant is authorized to seize this vehicle from the La Quinta Inn parking lot so this vehicle’s surveillance footage may be searched via an additional search warrant at a secure location.”
Aug 31
Dutch DPA imposes a fine of 290 million euro on Uber because of transfers of drivers' data to the US autoriteitpersoonsgegevens.nl · “It concerns account details and taxi licences, but also location data, photos, payment details, identity documents, and in some cases even criminal and medical data of drivers.”
Aug 26
Is Telegram really an encrypted messaging app? blog.cryptographyengineering.com · “Telegram clearly fails to meet this stronger definition for a simple reason: it does not end-to-end encrypt conversations by default.”
Aug 25
Telegram app founder Pavel Durov reportedly arrested at French airport theguardian.com · “Pavel Durov, billionaire co-founder and chief executive of the Telegram messaging app, was arrested at the Bourget airport outside Paris on Saturday evening, TF1 TV said, citing an unnamed source.”
Aug 24
National Public Data Published Its Own Passwords krebsonsecurity.com · “KrebsOnSecurity has learned that another NPD data broker which shares access to the same consumer records inadvertently published the passwords to its back-end database in a file that was freely available from its homepage until today.”
Aug 21
Inside the "3 Billion People" National Public Data Breach troyhunt.com · “Curious, I took 100M samples and found that only 31% of the rows had unique SSNs, so extrapolating that out, 2.9B would be more like 899M.”
Aug 14
State of Texas v. General Motors LLC and OnStar LLC texasattorneygeneral.gov · “The Driving Data collected and sold by General Motors included data from over 14 million of its vehicles, and the data of more than 1.8 million Texans.”
Aug 14
Federal Appeals Court Finds Geofence Warrants Are "Categorically" Unconstitutional eff.org · “the quintessential problem with these warrants is that they never include a specific user to be identified”
Aug 12
Vulnerability Allowed Eavesdropping via Sonos Smart Speakers securityweek.com · “A low-privileged, close-proximity attacker could exploit this vulnerability to remotely execute arbitrary code”
Aug 12
The surveilled society: Who is watching you and how rnz.co.nz · “Sometimes you are just asked to trust the FR function is not switched on.”
Aug 11
EFF's Concerns About the UN Draft Cybercrime Convention eff.org · “The proposed UN Cybercrime Convention is an extensive surveillance pact.”
Aug 10
Apple memory holed its broken promise for an OCSP opt-out lapcatsoftware.com · “The company apparently hopes we forget that it ever made the promise.”
Aug 7

July 2024 16 posts

Meta to pay Texas $1.4 billion for using facial recognition technology without users' permission texastribune.org · “The settlement, announced Tuesday, does not act as an admission of guilt and Meta maintains no wrongdoing.”
Jul 30
Announcing Swift Homomorphic Encryption swift.org · “BFV is based on the ring learning with errors (RLWE) hardness problem, which is quantum resistant.”
Jul 30
How did Facebook intercept their competitor's encrypted mobile app traffic? haxrob.net · “Facebook had acquired Onavo for approximately $120M USD in 2013 and needed to put this technology in good use.”
Jul 28
Courts Close the Loophole Letting the Feds Search Your Phone at the Border reason.com · “The Fourth Amendment still applies at the border, despite the feds’ insistence that it doesn’t.”
Jul 26
Intent to End OCSP Service letsencrypt.org · “When someone visits a website using a browser or other software that checks for certificate revocation via OCSP, the Certificate Authority (CA) operating the OCSP responder immediately becomes aware of which website is being visited from that visitor’s particular IP address.”
Jul 23
Google Chrome is no longer 'deprecating third-party cookies' 9to5google.com · ““Instead of deprecating third-party cookies,” Google revealed today that it will “introduce a new experience in Chrome that lets people make an informed choice that applies across their web browsing.””
Jul 23
Traveling this summer? Maybe don’t let the airport scan your face. vox.com · “Everyone, regardless of citizenship, can opt out when it comes to domestic flights in the US.”
Jul 23
USPS shared customer postal addresses with Meta, LinkedIn and Snap techcrunch.com · “we were unaware of any configuration of the platform that collected personal information from the URL and that shared it without our knowledge with social media.”
Jul 18
For advertising: Firefox now collects user data by default heise.de · “More serious, however, is the fact that Mozilla also activates the feature directly - users must therefore deactivate the PPA manually by opting out.”
Jul 16
User alleges Gemini AI scanning Google Drive hosted PDF files without explicit permission: Google says otherwise tomshardware.com · “Just pulled up my tax return in @Google Docs–and unbidden, Gemini summarized it.”
Jul 15
CA4: No REP in one's Google location data fourthamendment.com · “There is no reasonable expectation of privacy in one’s Google location data. It’s willingly shared with Google.”
Jul 14
A Simple Firmware Update Completely Hides a Device's Bluetooth Fingerprint today.ucsd.edu · “This defense can be rolled out incrementally, requiring only software modification on at least one widely-used Bluetooth Low Energy chipset”
Jul 14
Crooks Steal Phone, SMS Records for Nearly All AT&T Customers krebsonsecurity.com · “AT&T also acknowledged the customer records were exposed in a cloud database that was protected only by a username and password (no multi-factor authentication needed).”
Jul 12
Russia forces Apple to remove dozens of VPN apps from App Store bleepingcomputer.com · “If you need additional information regarding this removal or the laws and requirements in Russia, we encourage you to reach out directly to Roskomnadzor.”
Jul 10
Linksys Velop routers send Wi-Fi passwords in plaintext to US servers stackdiary.com · “These packets included the configured SSID name and password in clear text, identification tokens for the network within a broader database, and an access token for a user session, potentially paving the way for a man-in-the-middle (MITM) attack.”
Jul 9
Microsoft's Xandr grants GDPR rights at a rate of 0% noyb.eu · “However, despite collecting vast amounts of detailed information about people, Xandr reports an astonishing 0% response rate to access and erasure requests in 2022.”
Jul 9

June 2024 11 posts

ID Verification Service for TikTok, Uber, X Exposed Driver Licenses 404media.co · “The breach highlights that identity services could themselves become a target for hackers.”
Jun 27
Google is testing facial recognition technology for campus security, starting at site near Seattle cnbc.com · “At the Kirkland testing site, people entering the building will not be able to opt out of the facial screening.”
Jun 27
EU Council has withdrawn the vote on Chat Control stackdiary.com · “Belgium’s draft law, which was supposed to be adopted as the Council’s negotiating position, was instead postponed indefinitely.”
Jun 20
UK's Total Fitness exposed nearly 500K images of members, staff through unprotected database theregister.com · “Jeremiah Fowler told The Register more than 474,000 images of both members and staff – including men, women, and children – were stored in a database that was left unprotected and publicly accessible without the need for a password.”
Jun 19
Private Cloud Compute: A new frontier for AI privacy in the cloud security.apple.com · “When we launch Private Cloud Compute, we’ll take the extraordinary step of making software images of every production build of PCC publicly available for security research.”
Jun 10
Microsoft Will Switch Off Recall by Default After Security Backlash wired.com · “If you don’t proactively choose to turn it on, it will be off by default.”
Jun 7
How Online Privacy Is Like Fishing spectrum.ieee.org · “What seems normal to us in the security community is whatever was commonplace at the beginning of our careers.”
Jun 6
Leaked Google database reveals its secret privacy and security failures engadget.com · “As a result, our database of objects detected from Street View now inadvertently contains a database of geolocated license plate numbers and license plate number fragments”
Jun 5
Microsoft hit with EU privacy complaints over schools’ use of 365 Education suite techcrunch.com · “Under the current system that Microsoft is imposing on schools, your school would have to audit Microsoft or give them instructions on how to process pupils’ data.”
Jun 5
Majority for chat control possible: Users who refuse scanning to be prevented from sharing photos and links patrick-breyer.de · “If a user refuses the scanning, they would be blocked from sending or receiving images, photos, videos and links (Article 10).”
Jun 3
Stealing everything you’ve ever typed or viewed on your own Windows PC is now possible with two lines of code: inside the Copilot+ Recall disaster simonwillison.net · “In practice, that audience’s needs are a very small (tiny, in fact) portion of Windows userbase”
Jun 1

May 2024 15 posts

PayPal is building an ad network based on your Venmo data theverge.com · “If you’re someone who’s buying products on the web, we know who is buying the products where, and we can leverage the data”
May 29
Finally an alternative to Big Tech, your new open-source mobile ecosystem - Mobifree f-droid.org · “Both app stores were built on tracking users to sell their data, thereby giving Apple and Google power over how citizens receive services from their own governments.”
May 28
Surveilling the Masses with Wi-Fi-Based Positioning Systems arxiv.org · “Applying this technique over the course of a year, we learned the precise locations of over 2 billion BSSIDs around the world.”
May 27
Almost all citizens of city of Eindhoven have their personal data exposed bitdefender.com · “Two files containing the personal data of 221,511 inhabitants of Eindhoven were accessible to unauthorised parties for a period of time last year.”
May 27
Windows Recall sounds like a privacy nightmare: here's why I'm worried techradar.com · “Note that Recall does not perform content moderation. It will not hide information such as passwords or financial account numbers.”
May 22
Why Your Wi-Fi Router Doubles as an Apple AirTag krebsonsecurity.com · “Apple’s API will return the geolocations of up to 400 more BSSIDs that are nearby the one requested.”
May 22
Slack under attack over sneaky AI training policy techcrunch.com · “But, it turns out that if you don’t want Slack to use your data, you have to email the company to opt out.”
May 21
See what's changing in Firefox: Better insights, same privacy blog.mozilla.org · “We understand that any new data collection might spark some questions.”
May 14
Apple and Google deliver support for unwanted tracking alerts in iOS and Android apple.com · “Bluetooth tag manufacturers including Chipolo, eufy, Jio, Motorola, and Pebblebee have committed that future tags will be compatible.”
May 13
Why Your VPN May Not Be As Secure As It Claims krebsonsecurity.com · “In our testing, the VPN always continued to report as connected, and the kill switch was never engaged to drop our VPN connection.”
May 8
Introducing SecureDrop Protocol securedrop.org · “The server has access to minimal metadata, theoretically opening the door to deployment in adversarial environments.”
May 7
Proton Mail Discloses User Data Leading to Arrest in Spain restoreprivacy.com · “Upon receiving the recovery email from Proton Mail, Spanish authorities further requested Apple to provide additional details linked to that email, leading to the identification of the individual.”
May 6
A million Australian pubgoers wake up to find personal info listed on leak site theregister.com · “The leak site alleges Outabox contracted development of some software to offshore developers, and that those coders were given access to data gathered by gaming venues – including facial biometrics, scans of drivers’ licenses, and club membership details.”
May 6
DNS traffic can leak outside the VPN tunnel on Android mullvad.net · “These finding also shows once again that "Block connections without VPN" does not live up to its name (or documentation) and that it has multiple flaws.”
May 3
Microsoft bans US police departments from using enterprise AI tool for facial recognition techcrunch.com · “The new terms leave wiggle room for Microsoft.”
May 2

April 2024 12 posts

FCC Fines AT&T, Sprint, T-Mobile, and Verizon Nearly $200 Million for Illegally Sharing Access to Customers' Location Data docs.fcc.gov · “Yet, even after being made aware of this unauthorized access, all four carriers continued to operate their programs without putting in place reasonable safeguards”
Apr 29
Health insurance giant Kaiser will notify millions of a data breach after sharing patients' data with advertisers techcrunch.com · “Kaiser said that the data shared with advertisers includes member names and IP addresses, as well as information that could indicate if members were signed into a Kaiser Permanente account or service”
Apr 29
The Not-So-Silent Type: Vulnerabilities Across Keyboard Apps Reveal Keystrokes to Network Eavesdroppers citizenlab.ca · “Our analysis found that eight of the nine apps identified contained vulnerabilities that could be exploited to completely reveal the contents of users’ keystrokes in transit.”
Apr 26
UK's Investigatory Powers Bill approved to become law theregister.com · “Other key concerns revolve around the IPB’s amendment that would force tech companies to consult the UK government before rolling out security updates to software.”
Apr 26
FTC Fines Mental Health Startup Cerebral $7 Million for Major Privacy Violations thehackernews.com · “Cerebral sent out promotional postcards, which were not in envelopes, to over 6,000 patients that included their names and language that appeared to reveal their diagnosis and treatment to anyone who saw the postcards”
Apr 17
96% of US hospital websites share visitor info with Meta, Google, data brokers theregister.com · “And two thirds of hospital websites had some kind of data transfer to a third-party domain that we couldn’t even identify”
Apr 12
Apple alerts users in 92 nations to mercenary spyware attacks techcrunch.com · “Apple previously described the attackers as “state-sponsored” but has replaced all such references with “mercenary spyware attacks.””
Apr 11
FCC looks to limit how domestic violence abusers use connected cars cyberscoop.com · “No survivor of domestic violence and abuse should have to choose between giving up their car and allowing themselves to be stalked and harmed by those who can access its connectivity and data”
Apr 10
Online porn restrictions are leading to a VPN boom popsci.com · “Leading VPN provider Top10 VPN claims demand from VPN services jumped 275% on March 15, the same day Pornhub cut off access in Texas.”
Apr 6
Google fixes two Pixel zero-day flaws exploited by forensics firms bleepingcomputer.com · “Forensic companies are rebooting devices in ‘After First Unlock’ state into fastboot mode on Pixels and other devices to exploit vulnerabilities there and then dump memory.”
Apr 5
Keeping your data from Apple is harder than expected aalto.fi · “It turned out that the participants weren’t able to prevent any of the apps from sharing their data with other applications or the service provider.”
Apr 4
Google agrees to destroy browsing data collected in Incognito mode theverge.com · “Though the plaintiffs valued the proposed settlement at $5 billion, which was the amount they originally sought in damages, Castañeda said that they are ‘receiving zero.’”
Apr 2

March 2024 10 posts

Tell HN: Reddit now blocks VPN access via browser, 'old' subdomain included news.ycombinator.com · “I’m unable to access reddit via browser when using VPN.”
Mar 31
Facebook snooped on users' Snapchat traffic in secret project, documents reveal techcrunch.com · “I can’t think of a good argument for why this is okay. No security person is ever comfortable with this, no matter what consent we get from the general public.”
Mar 26
Mozilla Drops Onerep After CEO Admits to Running People-Search Networks krebsonsecurity.com · “But on March 21, Shelest released a lengthy statement wherein he admitted to maintaining an ownership stake in Nuwber, a consumer data broker he founded in 2015”
Mar 22
Time to delete your Glassdoor account and data cellio.dreamwidth.org · “Glassdoor now requires your real name and will add it to older accounts without your consent if they learn it, and your only option is to delete your account.”
Mar 14
CEO of Data Privacy Company Onerep.com Founded Dozens of People-Search Firms krebsonsecurity.com · “A search in DomainTools for the email address [email protected] shows it is associated with the registration of at least 179 domain names, including dozens of mostly now-defunct people-search companies targeting citizens of Argentina, Brazil, Canada, Denmark, France, Germany, Hong Kong, Israel, Italy, Japan, Latvia and Mexico, among others.”
Mar 14
Airbnb is banning indoor security cameras theverge.com · “Airbnb will no longer allow hosts to use indoor security cameras, regardless of where they’re placed or what they’re used for.”
Mar 11
How We Bypassed Safari 17's Advanced Audio Fingerprinting Protection fingerprint.com · “Apple knows, and the company decided to fight the identification possibility in Safari 17, but their measures don’t fully work.”
Mar 9
You can not simply publicly access private secure links, can you? vin01.github.io · “A link submitted to urlscan.io as unlisted, was accessed 12 times within 1 hour of submission”
Mar 7
Cracking Meta's Messenger Certificate Pinning on macOS texts.blog · “By modifying just 4 of the binary’s 97,477,728 bytes we can now intercept requests!”
Mar 5
listening in on the neighborhood computer.rip · “It’s not perfect, but the distance from your house to a ShotSpotter sensor correlates fairly well with your household income. The wealthier you are, the less surveilled you are.”
Mar 2

February 2024 13 posts

What Happens to Your Sensitive Data When a Data Broker Goes Bankrupt? themarkup.org · “Seven months later it filed for bankruptcy and has agreed to sell the company.”
Feb 28
FTC to ban Avast from selling browsing data for advertising purposes bleepingcomputer.com · “The FTC also said Avast stored this information indefinitely and sold it to over 100 third parties between 2014 and 2020 through their Jumpshot subsidiary.”
Feb 26
Keep your phone number private with Signal usernames signal.org · “If you use Signal, your phone number will no longer be visible to everyone you chat with by default.”
Feb 20
Microsoft Is Spying on Users of Its AI Tools schneier.com · “The only way Microsoft or OpenAI would know this would be to spy on chatbot sessions.”
Feb 20
ExpressVPN User Data Exposed Due to Bug securityweek.com · “Normally, when a user is connected to ExpressVPN, their DNS requests are sent to the company’s servers.”
Feb 19
German credit agency earns millions through unlawful customer manipulation noyb.eu · “The company appears to be making millions of euros by selling people in Germany their own data.”
Feb 16
French Healthcare Payments Processor Breaches Affect Half of Population securityweek.com · “France’s data protection agency CNIL is investigating massive data breaches at two companies that manage third-party healthcare payments, warning that more than 33 million people may be affected.”
Feb 14
How Walmart, Delta, Chevron and Starbucks are using AI to monitor employee messages cnbc.com · “It’s always tracking real-time employee sentiment, and it’s always tracking real-time toxicity,”
Feb 10
Google saves your conversations with Gemini for years by default techcrunch.com · “Please don’t enter confidential information in your conversations or any data you wouldn’t want a reviewer to see or Google to use to improve our products, services, and machine learning technologies,”
Feb 9
Security flaw in a popular smart helmet allowed silent location tracking techcrunch.com · “That 6-digit group code simply isn’t random enough,”
Feb 9
Police intelligence services unlawfully spied on whole population groups nltimes.nl · “According to the CTIVD, these intelligence services sometimes receive a signal “about a person or a few persons” and then decide to investigate an entire community based on that.”
Feb 8
Final Decision on Chromebook Case in Denmark theprivacydad.com · “From 1 August 2024 onwards, Danish schools will no longer be allowed to enable Chromebooks and Google platforms to collect students’ personal data for processing.”
Feb 7
Confirming Large-Scale Pegasus Surveillance of Jordan-based Civil Society citizenlab.ca · “At least 14 of the victims confirmed by Citizen Lab analysis work in media, such as journalists or staff. The rest are activists, lawyers, and other members of civil society.”
Feb 5

January 2024 8 posts

Microsoft Edge ignores user wishes, slurps tabs from Chrome without permission theregister.com · “Nothing seems to turn it off.”
Jan 31
Appeals Court: FBI's Safe-Deposit Box Seizures Violated Fourth Amendment reason.com · “The FBI violated the Fourth Amendment when its agents rifled through the contents of more than 700 safe-deposit boxes”
Jan 23
Google Is Tracking You Even In Incognito Mode, New Disclaimer Is Up news.abplive.com · “Google has finally admitted that it tracks your search history, activities, the websites you visit and the services they use even in Incognito mode.”
Jan 21
Tell HN: Russia has started blocking OpenVPN/WireGuard connections news.ycombinator.com · “For the past three days Russians have been unable to use their VPN services working via OpenVPN/WireGuard protocols, and some even have reported that in certain situations SSH connections have stopped working.”
Jan 20
Your washing machine could be sending 3.7 GB of data a day tomshardware.com · “Johnie’s initial screenshot showed that on a chosen day, the device uploaded 3.57GB and downloaded about 100MB, and the data traffic was almost constant.”
Jan 13
Outlook is Microsoft's new data collection service proton.me · “Americans, thanks to their government’s refusal to pass privacy legislation, are never even informed this is happening.”
Jan 11
Meta ignores the users' right to easily withdraw consent noyb.eu · “This is illegal, as the GDPR clearly states that withdrawing your consent must be ‘as easy as’ giving it.”
Jan 11
This holographic camera turns any window into an invisible camera digitalcameraworld.com · “Parking cameras that can be completely hidden.”
Jan 5

2023 141 posts

December 2023 14 posts

My CCPA Dialog With OpenAI dbreunig.com · “We can confirm that your email does not appear in our training dataset.”
Dec 28
In 2023 Organic Maps got its first million users organicmaps.app · “It’s possible to do even more in 2024 if we get enough donations to scale the infrastructure, reward our contributors, or hire a full-time working team.”
Dec 23
Rite Aid Banned from Using AI Facial Recognition After FTC Says Retailer Deployed Technology without Reasonable Safeguards ftc.gov · “Rite Aid will be prohibited from using facial recognition technology for surveillance purposes for five years”
Dec 20
Your Smart TV Knows What You're Watching themarkup.org · “These TVs can capture and identify 7,200 images per hour, or approximately two every second.”
Dec 18
Google will no longer hold onto people's location data in Google Maps: meaning it can't turn that info over to the police businessinsider.com · “That means Google itself will no longer have access to user location history data. And by extension, neither will law enforcement”
Dec 16
Ubiquiti users claim to have access to other people's devices securityaffairs.com · “However this time I was presented with 88 consoles from another account. I had full access to these consoles, just as I would my own.”
Dec 15
House Intelligence Committee FISA "Reform" Bill Would Greatly Expand the Class of Businesses and Other Entities Required to Assist in FISA 702 Surveillance zwillgen.com · “the expanded definition would appear to cover data centers, colocation providers, business landlords, shared workspaces, or even hotels where guests connect to the Internet.”
Dec 11
Report: 2.6 billion personal records compromised by data breaches in past two years: underscoring need for end-to-end encryption apple.com · “The findings underscore that strong protections against data breaches in the cloud, like end-to-end encryption, have only grown more essential since last year’s report and the launch of Advanced Data Protection for iCloud.”
Dec 11
How we investigated France's mass profiling machine lighthousereports.com · “Those flagged as high risk are subject to special investigations where fraud controllers are empowered to visit people’s homes unannounced, count toothbrushes to guess how many people live there, question their neighbours and scour bank records.”
Dec 8
Apple Confirms Governments Using Push Notifications to Surveil Users macrumors.com · “In this case, the federal government prohibited us from sharing any information.”
Dec 8
23andMe is updating its TOS to force binding arbitration with a limited opt-out window stackdiary.com · “Because these terms were put in place on November 30, 2023 – it has already been over a week, and most users might not understand why this is important or relevant.”
Dec 7
Building end-to-end security for Messenger engineering.fb.com · “Messenger, however, has a long history of storing people’s messages for them so that they can access them whenever they need without having to store them locally.”
Dec 7
23andMe confirms hackers stole ancestry data on 6.9 million users techcrunch.com · “On Friday, genetic testing company 23andMe announced that hackers accessed the personal data of 0.1% of customers, or about 14,000 individuals.”
Dec 5
No new top boss at NSA until it answers questions about buying up location, browsing data theregister.com · “The administration is abusing the CUI designation to keep this unclassified information from the American public,” Wyden continued.
Dec 2

November 2023 17 posts

CSAR: European Parliament rejects mass scanning of private messages. Here is why edri.org · “On this basis, the Parliament firmly rejected rules which would force companies to scan huge volumes of people’s private messages – instead now requiring there to be reasonable suspicion.”
Nov 30
The Feds' Vehicle 'Kill Switch' Mandate Is a Gross (and Dangerous) Violation of Privacy fee.org · “advanced drunk and impaired driving prevention technology must be standard equipment in all new passenger motor vehicles”
Nov 24
US govt pays AT&T to let cops search Americans' phone records – 'usually' without a warrant theregister.com · “Under Hemisphere, the White House Office of National Drug Control Policy (ONDCP) pays telco AT&T to provide all federal, state, local, and tribal law enforcement agencies with the ability to request searches of trillions of domestic phone records dating back to at least 1987, plus the four billion call records added every day.”
Nov 23
Morgan Stanley Fined $6.5 Million for Exposing Customer Information securityweek.com · “The moving company, the AG says, sold the computer equipment at internet auctions without Morgan Stanley’s knowledge.”
Nov 22
Nothing Chats, the Sunbird-based iMessage app, is a privacy nightmare with unencrypted messages and images 9to5google.com · “Sunbird has access to every message sent and received through the app.”
Nov 20
Cryptographers Solve Decades-Old Privacy Problem nautil.us · “For now, neither scheme is practically useful: Preprocessing currently helps at the extremes, when the database size balloons toward infinity.”
Nov 18
Privacy is Priceless, but Signal is Expensive signal.org · “We estimate that by 2025, Signal will require approximately $50 million dollars a year to operate.”
Nov 16
Child sexual abuse online: effective measures, no mass surveillance europarl.europa.eu · “In the adopted text, MEPs excluded end-to-end encryption from the scope of the detection orders to guarantee that all users’ communications are secure and confidential.”
Nov 14
It's Still Easy for Anyone to Become You at Experian krebsonsecurity.com · “Your only option at this point is recreate your account at Experian and steal it back from the ID thieves!”
Nov 11
Debunking the Myth of “Anonymous” Data eff.org · “For data brokers dealing in our personal information, our data can either be useful for their profit-making or truly anonymous, but not both.”
Nov 11
Microsoft lays hands on login data: Beware of the new Outlook heise.de · “Without informing or inquiring about this, Microsoft grants itself access to the IMAP and SMTP login data of users of the new Outlook.”
Nov 10
Perfectly legal for cars to harvest your texts, call logs theregister.com · “Even if the text message is deleted from the smartphone, the Honda vehicle retains a copy in on-board memory, even after the smartphone is disconnected.”
Nov 9
Are we doing this again? Yes, we’re doing this again. webdevlaw.uk · “Force technology companies to inform the Home Office in advance of security and privacy features they want to add, including encryption, and force them to disable features which the government objects to”
Nov 9
Ombudsman: European Commission’s concealment of secret ‘expert list’ on CSAM regulation constitutes ‘maladministration’ iccl.ie · “After the Commission acknowledged to the EU Ombudsman that it, in fact, had such a list, but failed to disclose its existence to Dr Kris Shrishak, the Ombudsman held the Commission’s behaviour constituted “maladministration”.”
Nov 8
Increasing trust for embedded media android-developers.googleblog.com · “The new Android WebView Media Integrity API will give embedded media providers access to a tailored integrity response that contains a device and app integrity verdict so that they can ensure their streams are running in a safe and trusted environment”
Nov 2
Finding You: The Network Effect of Telecommunications Vulnerabilities for Location Disclosure citizenlab.ca · “Telecom insiders understand that the vulnerabilities in the SS7 signaling protocol used in 3G roaming have enabled the development of commercial surveillance products that provide their operators with anonymity, multiple access points and attack vectors, a ubiquitous and globally-accessible network with an unlimited list of targets, and virtually no financial or legal risks.”
Nov 1
How Bear does analytics with CSS herman.bearblog.dev · “I don’t think any bots hover and instead just use JS to interact with the page, so I can, with reasonable certainty, assume that this is a human reader.”
Nov 1

October 2023 14 posts

German court bans LinkedIn from ignoring "Do Not Track" signals stackdiary.com · “The court said this communication is misleading, as LinkedIn is legally required to respect the Do Not Track requests.”
Oct 31
The Norwegian Data Protection Authority's decision against Meta is extended to the EU/EEA and made permanent datatilsynet.no · “Meta has stated that they will ask users for consent to use their data for behavioural marketing in the future. However, the company has not introduced any actual changes yet, and thus the illegal activities continue to this very day.”
Oct 31
Google Chrome's new "IP Protection" will hide users' IP addresses bleepingcomputer.com · “The first phase, dubbed “Phase 0,” will see Google proxying requests only to its own domains using a proprietary proxy. This will help Google test the system’s infrastructure and buy more time to fine-tune the domain list.”
Oct 24
A Controversial Plan to Scan Private Messages for Child Abuse Meets Fresh Scandal wired.com · “Mekić then found out that the ads, which have garnered at least 4 million views, were only displayed in seven EU countries: the Netherlands, Sweden, Belgium, Finland, Slovenia, Portugal, and the Czech Republic.”
Oct 24
UK Government Caught Surveilling Social Media of Teaching Assistants and Librarians reclaimthenet.org · “These educators found file lengths spanning up to 60 pages, documenting their tweets and comments opposing the government’s policies and criticizing the schools inspectorate, Ofsted.”
Oct 23
Adtech Surveillance and Government Surveillance are Often the Same Surveillance eff.org · “The company says it purchased data on over a billion devices. The government, in turn, can buy access to geolocation data on all those devices, when generally they’d have to show probable cause and get a warrant to get that same data.”
Oct 21
Encrypted traffic interception on Hetzner and Linode targeting the largest Russian XMPP (Jabber) messaging service notes.valdikss.org.ru · “The attacker has issued several new TLS certificates using Let’s Encrypt service which were used to hijack encrypted STARTTLS connections on port 5222 using transparent MiTM proxy. The attack was discovered due to expiration of one of the MiTM certificates, which haven’t been reissued.”
Oct 20
Breyer on chat control investigative research: EU Commissioner as double agent of foreign interference patrick-breyer.de · “Research published yesterday by several European media outlets has revealed that an international campaign in support of the EU’s proposed child sexual abuse regulation has been largely orchestrated and financed by a network of organisations with links to the tech industry and security services.”
Oct 20
Mastercard Should Stop Selling Our Data eff.org · “Mastercard takes this a step further, as U.S. PIRG reported, by analyzing the amount and frequency of transactions, plus the location, date, and time to create categories of cardholders and make inferences about what type of shopper you may be.”
Oct 15
Tainting the CSAM client-side scanning database. blog.xot.nl · “There is no independent way for the service providers or the devices to verify that the fingerprints in this data actual correspond to CSAM.”
Oct 13
Slack's Google Drive App can share your private Docs and Drive files kapwing.com · “The problem is, that preview image gets re-uploaded to Slack’s CDN, and is in high resolution and is now accessible to everyone in my Slack workspace.”
Oct 12
Transcript Dutch parliamentary hearing on EU Chat Control and Client Side Scanning berthub.eu · “What we are talking about now is that in all our WhatsApp groups, our Signal groups, our Telegram groups, a new participant will join the conversation, namely an EU logo.”
Oct 12
The US Is Openly Stockpiling Dirt on All Its Citizens wired.com · “Perhaps most controversially, the report states that the government believes it can “persistently” track the phones of “millions of Americans” without a warrant, so long as it pays for the information.”
Oct 4
Predictive Policing Software Terrible At Predicting Crimes themarkup.org · “In the end, the success rate was less than half a percent. Fewer than 100 of the predictions lined up with a crime in the predicted category, that was also later reported to police.”
Oct 2

September 2023 21 posts

Europol Sought Unlimited Data Access in Online Child Sexual Abuse Regulation balkaninsight.com · “All data is useful and should be passed on to law enforcement, there should be no filtering by the [EU] Centre because even an innocent image might contain information that could at some point be useful to law enforcement”
Sep 30
I Tested an HDMI Adapter That Demands Your Location, Browsing Data, Photos, and Spams You with Ads 404media.co · “It insisted it needed all of this data in order to mirror the screen from my phone to a monitor that I owned, via a cable that is physically connected between the two.”
Sep 29
Google claims to support privacy while lobbying against it proton.me · “Since 2019, Alphabet and its subsidiaries have spent more than $125 million on federal lobbying, campaign contributions, and trade associations”
Sep 29
Decade of newborn child registry data stolen in MOVEit mass-hack techcrunch.com · “Ontario’s government-funded birth registry has confirmed a data breach affecting some 3.4 million people who sought pregnancy care, including the personal health data of close to two million newborns and children across the Canadian province.”
Sep 27
School Surveillance Tools Are Harming Kids and Making It More Difficult to Finish Homework, Report Finds gizmodo.com · “Shockingly, 38% of teachers said they were even aware of a student who was contacted by law enforcement as a result of the monitoring.”
Sep 23
0-days exploited by commercial surveillance vendor in Egypt blog.google · “In the case of this campaign, if the target went to any ‘http’ site, the attackers injected traffic to silently redirect them to an Intellexa site, c.betly[.]me.”
Sep 22
Today The UK Parliament Undermined The Privacy, Security, And Freedom Of All Internet Users eff.org · “As enacted, the OSB allows the government to force companies to build technology that can scan regardless of encryption–in other words, build a backdoor.”
Sep 21
British journalist held by police at Luton airport for five hours without arrest theguardian.com · “Police told Broomfield they were engaged in “a mopping up operation”. They seized his phone and laptop and have since refused to return them.”
Sep 20
Quantum Resistance and the Signal Protocol signal.org · “We then combine these two shared secrets together so that any attacker must break both X25519 and CRYSTALS-Kyber to compute the same shared secret.”
Sep 19
Some new snippets from the Snowden documents electrospaces.net · “Appelbaum also provides some new information about the Snowden documents in general, by saying that The Intercept “closed their Snowden archive and reportedly it has been destroyed.” (page 63, note 17)”
Sep 18
TikTok fined €345m for breaking EU data law on children’s accounts theguardian.com · “It also found that the “family pairing” scheme, which gives an adult control over a child’s account settings, did not check whether the adult “paired” with the child user was a parent or guardian.”
Sep 15
How mobile apps illegally share your personal data noyb.eu · “In reality, the transmission of their personal data began without any interaction on their part – and before they even had a chance to think about consent.”
Sep 14
The million-dollar reporter meduza.io · “Timchenko’s hacked iPhone had a Latvian SIM card. Citizen Lab recorded the first Pegasus-related activity in Latvia in 2018, and experts believe Riga still uses NSO Group’s products today, says Scott-Railton.”
Sep 13
Wifi can read through walls news.ucsb.edu · “In the team’s experiments, three off-the-shelf WiFi transmitters send wireless waves in the area. WiFi receivers are then mounted on an unmanned vehicle that emulates a WiFi receiver grid as it moves.”
Sep 11
NYPD spent millions to contract with firm banned by Meta for fake profiles theguardian.com · “New York police are legally permitted to use fake social media profiles and if someone unknowingly accepts a friend request from a cop it counts as consent, according to Stop legal director David Siffert.”
Sep 8
UK 'spy clause' for scanning encrypted messages... can't theregister.com · “The government saying ’no scanning until it’s technically feasible’ is nonsense. Scanning is fundamentally incompatible with end-to-end encrypted messaging apps.”
Sep 8
Mullvad on Tailscale: Privately browse the web tailscale.com · “It’s not true anonymity, because that’s a problem Tailscale is not trying to solve.”
Sep 7
If You've Got a New Car, It's a Data Privacy Nightmare gizmodo.com · “Mozilla said it was unable to determine whether the brands encrypt any of the data they collect, and only Mercedes-Benz responded to the organization’s questions.”
Sep 6
Google Chrome pushes browser history-based ad targeting theregister.com · “That is to say: the popup is a notice that you’ve been opted in with a little link to your settings to disable the tech if you so wish.”
Sep 6
The Secret Weapon Hackers Can Use to Dox Nearly Anyone in America for $15 404media.co · “All of that data cost $15 in Bitcoin. The bot sometimes offers the Social Security number too for $20.”
Sep 4
X/Twitter has updated its Terms of Service to let it use Posts for AI training stackdiary.com · “It’s funny how that works because now you’re going to be working for Elon Musk, and he does not plan to pay you, and he certainly does not plan to ask for your permission to use your content this way.”
Sep 1

August 2023 9 posts

IBM promised to back off facial recognition: then it signed a $69.8 million contract to provide it theverge.com · “In September 2020, IBM described such "one-to-many" matching systems as "the type of facial recognition technology most likely to be used for mass surveillance, racial profiling, or other violations of human rights."”
Aug 31
Hackers Can Silently Grab Your IP Through Skype. Microsoft Is In No Rush to Fix It 404media.co · “Only after 404 Media contacted Microsoft for comment did the company say it would patch the issue in an upcoming update.”
Aug 30
Some rough impressions of Worldcoin blog.cryptographyengineering.com · “In principle, Tools for Humanity’s servers can re-bind an existing iris code to a new identity commitment. They can then send that new commitment to the chain using a special call in the smart contract.”
Aug 23
Cellebrite asks cops to keep its phone hacking tech 'hush hush' techcrunch.com · “We don’t really want any techniques to leak in court through disclosure practices, or you know, ultimately in testimony, when you are sitting in the stand, producing all this evidence and discussing how you got into the phone”
Aug 19
Infrastructure audit completed by Radically Open Security mullvad.net · “VPN servers accept remote logins from administrators, who technically have the ability to tap into production users’ VPN traffic”
Aug 9
Android 14 introduces first-of-its-kind cellular connectivity security features security.googleblog.com · “In other words, the network decides whether traffic is encrypted and the user has no visibility into whether it is being encrypted.”
Aug 8
Police raid WorldCoin cryptocurrency warehouse in Nairobi capitalfm.co.ke · “The officers went to the offices along Mombasa Road armed with a search warrant and left with machines they believe stores data gathered by the firm.”
Aug 7
In every reported case where police mistakenly arrested someone using facial recognition, that person has been Black businessinsider.com · “In 2020, Detroit’s police chief said their facial recognition technology, when used alone, fails 96% of the time, Insider previously reported.”
Aug 6
They Didn’t Ask to Go Viral. Posting on Social Media Without Consent Is Immoral wired.com · “If I were to post your name, address, and phone number, you would have legal recourse. And yet the same is not true for your image.”
Aug 5

July 2023 15 posts

The U.K. Government Is Very Close To Eroding Encryption Worldwide eff.org · “In response to this outpouring of resistance, the U.K. government’s response has been to wave its hands and deny reality.”
Jul 28
[wei] Ensure Origin Trial enables full feature github.com · “An origin trial can enable the RuntimeFeature, which will allow full access to the API, provided the base::Feature is also enabled (see change to origin_trial_context.cc).”
Jul 26
Apple already shipped attestation on the web, and we barely noticed httptoolkit.com · “Fundamentally though, it’s exactly the same concept: a way that web servers can demand your device prove it is a sufficiently ’legitimate’ device before browsing the web.”
Jul 25
Senate bill crafted with DEA targets end-to-end encryption, requires online companies to report drug activity therecord.media · “Many privacy advocates caution that, if passed in its current form, the bill could be a death blow to end-to-end encryption services because it includes particularly controversial language holding companies accountable for conduct they don’t report if they “deliberately blind” themselves to the violations.”
Jul 24
Man Found Guilty of Child Porn, Because He Ran a Tor Exit Node (The Story of William Weber) lowendbox.com · “The law was changed a few weeks later to include private persons and sole traders as protected lsps, not just companies, but they had to convict me.”
Jul 23
Apple says it would remove iMessage and FaceTime in the UK rather than break end-to-end encryption 9to5mac.com · “It strongly objects to requirements such as backdoors for end-to-end encryption, reporting changes to product security features before they are released and being forced to disable security features before an appeals process can take place.”
Jul 20
Temporary ban on behavioural advertising on Facebook and Instagram datatilsynet.no · “Should Meta not comply with the decision, the company risks a coercive fine of up to one million NOK per day.”
Jul 17
Signal president says company will not comply with proposed U.K. 'mass surveillance' law requiring mandatory message scanning before encryption fortune.com · “You cannot create a back door that only the good guys can go through.”
Jul 15
Brute-forcing a macOS user's real name from a browser using mDNS fingerprint.com · “By default, Apple devices expose the first name of a user in their local hostnames, which we are going to use for the name brute-forcing technique.”
Jul 13
Democrats call on DOJ to investigate tax sites for sharing financial information with Meta theverge.com · “TaxSlayer, H&R Block, and TaxAct all confirmed that they shared “extensive taxpayer data” through Meta’s pixel in the senators’ report.”
Jul 12
US Spies Are Buying Americans' Private Data. Congress Has a New Chance to Stop It wired.com · “The bipartisan duo is seeking stronger warrant requirements for the surveillant data constantly accumulated by people’s cellphones. They argue that it shouldn’t matter whether a company is willing to accept payment from the government in lieu of a judge’s permission.”
Jul 9
ProtonMail Rewrites Your Emails jfloren.net · “Therefore, all user-applied signatures will be broken. Tough luck, bucko, we’re the SECURE email company, you’ll upload your private key to our servers and you’ll like it!”
Jul 7
France passes bill to allow police remotely activate phone camera, microphone, spy on people gazettengr.com · “But lawmakers agreed to the bill late Wednesday as Justice Minister Eric Dupond-Moretti insisted the bill would affect only “dozens of cases a year.””
Jul 6
Open Letter from Security and Privacy Researchers in relation to the Online Safety Bill haddadi.github.io · “There is no technological solution to the contradiction inherent in both keeping information confidential from third parties and sharing that same information with third parties.”
Jul 5
Four companies must stop using Google Analytics imy.se · “IMY issues an administrative fine of 12 million SEK against Tele2 and 300,000 SEK against CDON, which has not taken the same extensive protective measures as Coop and Dagens Industri.”
Jul 4

June 2023 11 posts

How the Great Firewall of China Detects and Blocks Fully Encrypted Traffic gfw.report · “GFW exempts a connection if its first payload has more than 50% printable ASCII.”
Jun 30
Apple joins opposition to encrypted message app scanning bbc.com · “The UK could become the first liberal democracy to require the routine scanning of people’s private chat messages, including chats that are secured by end-to-end encryption.”
Jun 28
Discovering that your car battery monitor is siphoning up your location data doubleagent.net · “App store misleads consumers by stating that no personal data is collected or shared.”
Jun 26
US firm 'breached GDPR' by reputation-scoring EU citizens theregister.com · “That data, noyb alleges, was fed into an automated system that generates "reputation scores" that TeleSign sells to its customers, which includes TikTok, Salesforce, Microsoft and AWS, among others, for verifying the identity of a person behind a phone number and preventing fraud.”
Jun 24
Criminalization of encryption : the 8 december case laquadrature.net · “In total, there are more than 150 questions related to the issue of encryption and digital practices in the investigation file.”
Jun 22
Introducing Mullvad Leta: a search engine used in the Mullvad Browser mullvad.net · “Mullvad Leta uses the Google Search API as a proxy, caching each search.”
Jun 20
How we tried to book a train ticket and ended up with a databreach with 245,000 records zerforschung.org · “On the off chance we created an account – and to our surprise we were able to successfully log in with it.”
Jun 19
The Dutch government wants to automatically and administratively gain permission to target victims of hackers berthub.eu · “Or, more concretely, if your computer gets hacked by group X and there was a warrant to intercept the traffic of group X, the Dutch services now gain automatic approval to also intercept your communications or hack you.”
Jun 11
iOS 17 automatically removes tracking parameters from links you click on 9to5mac.com · “This process happens transparently during browser navigation in Safari Private Browsing mode, and links that the user clicks on from Mail and Messages app.”
Jun 8
10 years after Snowden's first leak, what have we learned? theregister.com · “If you ask the government – if you caught them in a room, and they were talking off the record – they would say the biggest impact for us from the Snowden disclosures is that it made big tech companies less cooperative.”
Jun 7
It's infuriatingly hard to understand how closed models train on their input simonwillison.net · “Given this lack of transparency, there’s no way to confidently state that private data that is passed to them isn’t being used to further train future versions of these models.”
Jun 4

May 2023 8 posts

Federal Judge Makes History in Holding That Border Searches of Cell Phones Require a Warrant eff.org · “The number of warrantless device searches at the border and the significant invasion of privacy they represent is only increasing. In Fiscal Year 2022, CBP conducted an all-time high of 45,499 device searches.”
May 30
Removing the support for forwarded ports mullvad.net · “This has led to law enforcement contacting us, our IPs getting blacklisted, and hosting providers cancelling us.”
May 29
Private Spies Hired by the FBI and Corporate Firms Infiltrate Discord, Reddit, WhatsApp leefang.com · “We’ve done this at scale since 2018 so there’s some trust in the personas that we’ve built up, whether they’re on Discord, on Telegram, or wherever.”
May 28
PyPI was subpoenaed blog.pypi.org · “In this case, however, PSF determined with the advice of counsel that our only course of action was to provide the requested data.”
May 24
FBI abused surveillance law to snoop on protesters, donors theregister.com · “The FBI misused controversial surveillance powers more than 278,000 times between 2020 and early 2021 to conduct warrantless searches on George Floyd protesters, January 6 rioters who stormed the Capitol, and donors to a Congressional campaign”
May 23
Leaked Government Document Shows Spain Wants to Ban End-to-End Encryption wired.com · ““Ideally, in our view, it would be desirable to legislatively prevent EU-based service providers from implementing end-to-end encryption,” Spanish representatives said in the document.”
May 22
Toyota: Car location data of 2 million customers exposed for ten years bleepingcomputer.com · “According to a security notice published in the company’s Japanese newsroom, the data breach resulted from a database misconfiguration that allowed anyone to access its contents without a password.”
May 12
India bans flagship client for the Matrix network element.io · “As we understand it, Indian government officials claim to have approved the ban due to Element (and other apps) not having representatives in India.”
May 5

April 2023 9 posts

Google has just updated its 2FA Authenticator app defcon.social · “We analyzed the network traffic when the app syncs the secrets, and it turns out the traffic is not end-to-end encrypted.”
Apr 26
Smartphones With Popular Qualcomm Chip Secretly Share Private Information With US Chip-Maker nitrokey.com · “This data is sent without user consent, unencrypted, and even when using a Google-free Android distribution.”
Apr 25
Global Encryption Coalition Steering Committee Statement on EU-US Cooperation on Turning Public Opinion Against Encryption globalencryption.org · “Recent media reports state that senior government officials in the US and EU agreed to cooperate on measures to shape public opinion with the goal of legitimising the demands of law enforcement agencies to access encrypted communications.”
Apr 24
The EARN IT Bill Is Back, Seeking To Scan Our Messages and Photos eff.org · “In 2020, the Irish police received 4,192 reports from NCMEC. Of those, only 852 (20.3%) were confirmed as actual CSAM. Only 9.7% of the reports were deemed to be “actionable.””
Apr 21
Mullvad VPN was subject to a search warrant. Customer data not compromised mullvad.net · “In line with our policies such customer data did not exist. We argued they had no reason to expect to find what they were looking for and any seizures would therefore be illegal under Swedish law.”
Apr 20
French publisher arrested in London on terrorism charge theguardian.com · “He was questioned for six hours and then arrested for alleged obstruction in refusing to disclose the passcodes to his phone and computer.”
Apr 18
Inside Google's Plan to Kill the Cookie gizmodo.com · “Privacy Sandbox is that alternative. It’s complicated, but the easiest way to explain it is that it turns Chrome and Android into tracking tools.”
Apr 10
Google to Ban Financial Lending Apps From Accessing User Photos, Contacts pcmag.com · “By accessing borrowers’ personal contacts and their personal images, debt collectors have sent manipulated photos to friends and family of debtors. A number of these targeted individuals took their lives after the harassment, TechCrunch says.”
Apr 8
I declined to share my medical data with advertisers at my doctor’s office. One company claimed otherwise statnews.com · “On the day I gave birth, the Phreesia representative replied, “Unfortunately, since we have deleted your authorization, we no longer have a copy of that authorization on file to provide you.””
Apr 7

March 2023 9 posts

The European Commission does not understand what is written in its own Chat Control bill mullvad.net · “Above all, she continues to claim that it’s possible to scan end-to-end encrypted communication without breaking the encryption.”
Mar 28
Here is the FBI’s Contract to Buy Mass Internet Data vice.com · “Team Cymru, the company ultimately selling this data to the FBI, obtains it from deals with ISPs by offering them threat intelligence in return.”
Mar 28
Utah is first US state to limit teen social media access bbc.com · “Utah has become the first US state to require social media firms get parental consent for children to use their apps and verify users are at least 18.”
Mar 25
uBlock Origin 1.48.0 github.com · “This leads to numerous reports of "uBlock stopped working", which are simply caused by the fact that at launch time the browser started to load webpages before uBO was ready to filter properly (because the filter lists were not fully loaded in memory).”
Mar 21
Vivaldi co-founder: Advertisers 'stole the internet from us' xda-developers.com · “For us, how you technically do the tracking, you can say it’s a little bit better to do it client-side than server-side, but for me, the idea that your browser is building a profile on you…. No, no, no, that’s wrong.”
Mar 12
Telehealth startup Cerebral shared millions of patients' data with advertisers techcrunch.com · “Cerebral has revealed it shared the private health information, including mental health assessments, of more than 3.1 million patients in the United States with advertisers and social media giants like Facebook, Google and TikTok.”
Mar 10
The FBI Just Admitted It Bought US Location Data wired.com · “Federal Bureau of Investigation has acknowledged for the first time that it purchased US location data rather than obtaining a warrant.”
Mar 9
Secret Service and ICE break the law with fake phone towers theregister.com · “The phone surveillance report offers six recommendations to help the agencies comply with their legal and policy obligations. But annoyingly it redacts statistical data about the number of investigations utilizing CSS devices in 2020 and 2021.”
Mar 4
"There is no prosecution at any cost." tuta.com · “Hartmann warned against weakening end-to-end encryption through client-based content scanning. “By doing so, the commission is in effect undermining the most important digital protection tool,” the investigator said, “because compromised encryption is not encryption in the end.””
Mar 2

February 2023 7 posts

The Camera-Shy Hoodie macpierce.com · “By pointing the LEDs back at the camera and setting them to a tuned strobe, the security camera’s capture becomes overexposed, significantly losing definition of the scene.”
Feb 27
Signal would 'walk' from UK if Online Safety Bill undermined encryption bbc.com · “Encryption is either protecting everyone or it is broken for everyone.”
Feb 24
U.S. Supreme Court Declines to Hear Wikimedia Foundation’s Challenge to NSA Mass Surveillance diff.wikimedia.org · “Under this program, the NSA systematically searches the contents of internet traffic entering and leaving the United States, including Americans’ private emails, messages, and web communications.”
Feb 21
Germany Raises Red Flags About Palantir’s Big Data Dragnet wired.com · “The ruling said that the Hamburg law, and a similar law in Hesse, “allow police, with just one click, to create comprehensive profiles of persons, groups, and circles,” without differentiating between suspected criminals and people who are connected to them.”
Feb 19
The Online Safety Bill: An attack on encryption element.io · “The bill takes a wrecking ball to the very fabric of encryption, by requiring encrypted messaging apps to scan for abusive content within the app (or the app’s underlying operating system).”
Feb 9
Windows 11: a spyware machine out of users' control? techspot.com · “just after the first boot, Windows 11 was quick to try and reach third-party servers with absolutely no prior user permission or intervention.”
Feb 8
EU chat control law will ban open source operating systems mullvad.net · “To comply with the law all of it would have to shut down, globally, as the servers providing software and security updates can’t tell the difference between a web server, a Japanese software developer, a refrigerator and an EU teenager.”
Feb 1

January 2023 7 posts

IPinside: Korea’s mandatory spyware palant.info · “If this request fails, the banking website will deny entry and ask that you install IPinside LWS Agent first. So in South Korea running this application isn’t optional.”
Jan 25
Is Apple checking images we view in the Finder? eclecticlight.co · “There is no evidence that local images on a Mac have identifiers computed and uploaded to Apple’s servers when viewed in Finder windows.”
Jan 21
Firefox found a way to keep ad-blockers working with Manifest V3 theverge.com · “the high-level takeaway is that Mozilla’s version of Manifest V3 keeps the feature Google removed, while adding support for the more limited replacement as well.”
Jan 19
The IAB loves tracking users. But it hates users tracking them. shkspr.mobi · “As part of the UID2 API they specifically describe how an advertiser must "normalise" their users’ email addresses.”
Jan 16
NSA asks Congress to let it get on with that warrantless data harvesting, again theregister.com · “"Section 702 cannot be used to target Americans anywhere in the world or any person inside the United States regardless of nationality. No exceptions," Nakasone said.”
Jan 15
Apple Fined $8.5 Million for Illegally Collecting iPhone Owners' Data for Ads gizmodo.com · “With iPhones running iOS 14.6 and below, Apple’s Personalized Advertising privacy setting was turned on by default, leaving users to seek out the control on their own if they wanted to protect their information.”
Jan 8
BREAKING: Meta prohibited from use of personal data for advertising noyb.eu · “The alleged switch of legal basis happened exactly on 25 May 2018 at midnight when the GDPR came into force.”
Jan 4

2022 112 posts

December 2022 10 posts

Privacy is ok tbray.org · “Indeed, bad people can and (I’m sure) do use cryptography to evade surveillance.”
Dec 29
CCC captures U.S. military biometrics database ccc.de · “GPS coordinates of past deployment locations, and a massive biometrics database with names, fingerprints, iris scans and photos of 2,632 people.”
Dec 27
Reverse Engineering TikTok's VM Obfuscation nullpt.rs · “Information such as user location, device type, and various hardware metrics are combined to create a unique "fingerprint" that can potentially be used to track a user’s activity on and off the app.”
Dec 23
Show HN: Portable Secret – How I store my secrets and communicate privately mprimi.github.io · “I created Portable Secret to securely exchange documents via email with my mother, who can’t be expected to learn PGP, age, or similar.”
Dec 21
ThreeUK is blocking Tutanota tutanota.com · “Even though we reached out to ThreeUK over one month ago, the issue is still not fixed.”
Dec 21
Facial recognition tech gets woman booted from Rockettes show due to employer nbcnewyork.com · “Conlon says she posed no threat, but the guards still kicked her out with the explanation that they knew she was an attorney.”
Dec 20
How did Roomba-recorded photos end up on Facebook? technologyreview.com · “The images were not taken by a person, but by development versions of iRobot’s Roomba J7 series robot vacuum.”
Dec 19
BundesMessenger, a secure messenger for Germany's public administration element.io · “BundesMessenger is a modified version of Element which we’re working with BWI to develop and maintain.”
Dec 16
End-to-end encrypted messages need more than libsignal mjg59.dreamwidth.org · “But there’s rather more to producing a secure and usable client than just sprinkling on some libsignal.”
Dec 10
Apple introduces end-to-end encryption for backups support.apple.com · “With Advanced Data Protection, the number of data categories that use end-to-end encryption rises to 25 and includes your iCloud Backup, Photos, Notes, and more.”
Dec 7

November 2022 5 posts

maps.google.com now redirects to google.com/maps garrit.xyz · “Congratulations, you now have permission to geo-track me across all of your services.”
Nov 24
Apple sends DSID with iPhone analytics data, tests show gizmodo.com · “Knowing the DSID is like knowing your name.”
Nov 21
Indian ISPs: We already give govt full access to web traffic entrackr.com · “The CMS, however, undercuts these requests by letting the government access data in real time without individual requests.”
Nov 10
Signal Introduces Stories signal.org · “Stories also happen to be one of the most common feature requests we receive from all over the world.”
Nov 7
Microsoft is phoning home the content of PowerPoint slides rogermexico.bearblog.dev · “It makes sense: the tool is reading your text and suggesting designs/delivering stock photography.”
Nov 7

October 2022 14 posts

Iran's Secret Manual for Controlling Protesters' Mobile Phones theintercept.com · “The tools can slow their data connections to a crawl, break the encryption of phone calls, track the movements of individuals or large groups, and produce detailed metadata summaries of who spoke to whom, when, and where.”
Oct 30
The Iran Firewall - A preliminary report blog.thc.org · “IP addresses are rarely fully blocked.”
Oct 28
Why Signal won't compromise on encryption, with president Meredith Whittaker theverge.com · “We are not going to compromise on privacy, and that is our stance.”
Oct 27
SiriSpy - iOS bug allowed apps to eavesdrop on your conversations with Siri rambo.codes · “This would happen without the app requesting microphone access permission and without the app leaving any trace that it was listening to the microphone.”
Oct 26
EasyList is in trouble and so are many ad blockers adguard.com · “If you’re using an ad blocker, there’s a 99.99% chance you are using EasyList or one of its derivatives.”
Oct 19
Google Engineers Joked About How Incognito Mode Isn't Very Incognito futurism.com · “We are limited in how strongly we can market Incognito because it’s not truly private, thus requiring really fuzzy, hedging language that is almost more damaging.”
Oct 15
Everyone going to the World Cup must have this app - experts are now sounding the alarm nrk.no · “The Ehteraz app, which everyone over 18 coming to Qatar must download, also gets a number of other accesses such as an overview of your exact location, the ability to make direct calls via your phone and the ability to disable your screen lock.”
Oct 15
How Equifax used employment records it collects from 2.5 million companies to fire dozens of its own employees for working second jobs businessinsider.com · “Equifax used one of its own products, The Work Number, to help it suss out who was holding down multiple jobs simultaneously.”
Oct 14
Removing SMS support from Signal Android (soon) signal.org · “The most important reason for us to remove SMS support from Android is that plaintext SMS messages are inherently insecure.”
Oct 12
Dutch employee fired by U.S. firm for shutting off webcam awarded €75,000 in court nltimes.nl · “The demand to keep the camera activated was an unreasonable intrusion on the plaintiff’s privacy rights, the court ruled.”
Oct 9
Brave browser to start blocking annoying cookie consent banners bleepingcomputer.com · “In some cases, however, these banners can serve as trackers themselves, as they engage in a privacy-breaching data exchange before the user even has a chance to opt out.”
Oct 9
How fateful? chan.co.za · “There were 33 recorded occasions where we may have crossed paths, mostly on campus.”
Oct 4
Did Apple's privacy feature help to drive its own ad business? adguard.com · “While Apple effectively tracks users on its own platform, the pre-installed apps are exempted from displaying a message asking permission to track users.”
Oct 3
TikTok Tracks You Across the Web, Even If You Don't Use App consumerreports.org · “TikTok gets medical information from WebMD, where a pixel reported that we’d searched for "erectile dysfunction."”
Oct 1

September 2022 9 posts

Browsers with built-in VPNs - the new normal? Microsoft bakes a VPN into Edge and turns it on adguard-vpn.com · “A VPN built into a browser is not a substitute for a full-fledged VPN service.”
Sep 30
House Democrats debut new bill to limit US police use of facial recognition techcrunch.com · “Some cities, states and police departments have limited their use of facial recognition in recent years.”
Sep 30
Fitbit users will have to sign into Google from 2023 theregister.com · “Support of Fitbit accounts will continue until at least early 2025.”
Sep 24
US border forces are seizing Americans' phone data and storing it for 15 years engadget.com · “CBP keeps any information it takes from people’s devices for 15 years.”
Sep 16
The Follower driesdepoorter.be · “Software compares the Instagram with the recorded footage.”
Sep 12
On my resignation as regulator of the Dutch intelligence and security services berthub.eu · “Under this new law, my specific role (technical risk analysis) would mostly be eliminated.”
Sep 10
Peter Eckersley, may his memory be a blessing community.letsencrypt.org · “He later served on the initial board of directors of the Internet Security Research Group.”
Sep 3
Here Is the Manual for the Mass Surveillance Tool Cops Use to Track Phones vice.com · “Queries that exceed 100,000 signals will result in the overage signals being dropped.”
Sep 2
Arti 1.0.0 is released: Our Rust Tor implementation is ready for production use. blog.torproject.org · “We rely on users and volunteers to find problems in our software and suggest directions for its improvement.”
Sep 2

August 2022 13 posts

AdGuard publishes the world's first ad blocker built on Manifest V3 adguard.com · “Manifest V3, Chrome’s new extension API, is no longer an illusory threat.”
Aug 30
Google cracks down on VPN based adblockers community.blokada.org · “This could mean Google is cracking down on VPN-based ads and tracker filtering apps behind the scenes.”
Aug 29
Protect Your Inbox: DuckDuckGo Email Protection Beta Now Open to All! spreadprivacy.com · “In our closed Email Protection beta, we found that approximately 85% of beta testers’ emails contained hidden email trackers.”
Aug 25
Accepted chromium 104.0.5112.101-1 (source) into unstable mail-archive.com · “Change default search engine to DuckDuckGo for privacy reasons.”
Aug 24
Google refuses to reinstate man’s account after he took medical images of son’s groin theguardian.com · “Mark was cleared of any criminal wrongdoing, but Google has said it will stand by its decision.”
Aug 23
Class action against Oracle's worldwide surveillance machine iccl.ie · “Oracle claims to have amassed detailed dossiers on 5 billion people, and generates $42.4 billion in annual revenue.”
Aug 23
The downfall of smart TVs: From promises of seamless viewing to ad tool on steroids adguard.com · “There is no doubt that other companies live by this creed, if they are not talking about it out loud.”
Aug 22
Workplace surveillance is coming for you pluralistic.net · “The bossware problem is a boss problem, in other words.”
Aug 22
uBlock Origin works best on Firefox github.com · “This feature requires the webRequest.filterResponseData() API, currently only available in Firefox.”
Aug 21
VPNs on iOS are a scam michaelhorowitz.com · “Data leaves the iOS device outside of the VPN tunnel.”
Aug 16
Arrest of suspected developer of Tornado Cash fiod.nl · “On Wednesday 10 August, the FIOD arrested a 29-year-old man in Amsterdam.”
Aug 12
iOS Privacy: Instagram and Facebook can track anything you do on any website in their in-app browser krausefx.com · “The iOS Instagram and Facebook app render all third party links and ads within their app using a custom in-app browser.”
Aug 10
U.S. Treasury Sanctions Notorious Virtual Currency Mixer Tornado Cash home.treasury.gov · “The ultimate goal of sanctions is not to punish, but to bring about a positive change in behavior.”
Aug 8

July 2022 11 posts

Australian activist can't use encrypted apps, must let police access phone abc.net.au · “He is not allowed to use any encrypted messaging apps, like Signal or WhatsApp.”
Jul 31
Who is collecting data from your car? themarkup.org · “Wejo’s investors include GM, Microsoft, and defense and intelligence contractor Palantir.”
Jul 30
Mullvad is now available on Amazon mullvad.net · “You can gift time and give it to a friend without knowing their account number.”
Jul 26
Twitter data breach exposes contact details for 5.4M accounts; on sale for $30k 9to5mac.com · “This bug resulted from an update to our code in June 2021.”
Jul 23
UK intelligence recycles "think of the children" argument for borking encryption theregister.com · “This is an old, old argument – as old as encryption itself.”
Jul 22
TeamViewer installs suspicious font only useful for web fingerprinting ctrl.blog · “It leaks who TeamViewer’s customers are to every website they visit.”
Jul 20
Glassdoor not so anonymous webworm.co · “Glassdoor is legally required to release the contact details of the posters directly to Zuru, via Zuru’s attorneys.”
Jul 19
New documents reveal scale of US Government's cell phone location data tracking aclu.org · “The 6,168 pages of location records we reviewed contain approximately 336,000 location points obtained from people’s phones.”
Jul 18
Help me identify possible tracking device found in my car gist.github.com · “Car starts and runs without it, but every warning light on the dashboard comes on.”
Jul 9
Billion-record stolen Chinese database for sale on breach forum theregister.com · “HackerDan offered to sell the lot for 10 Bitcoin – about $200,000.”
Jul 5
Google allowed a sanctioned Russian ad company to harvest user data for months propublica.org · “Of particular concern, the analysis showed that Google shared data with RuTarget about users browsing websites based in Ukraine.”
Jul 1

June 2022 12 posts

Cryptocurrency Titan Coinbase Providing "Geo Tracking Data" to ICE theintercept.com · “An email released through the FOIA request shows that Coinbase didn’t require ICE to agree to an End User License Agreement, standard legalese that imposes limits on what a customer can do with software.”
Jun 30
Massive Trove of Gun Owners' Private Information Leaked by California Attorney General thereload.com · “The leaked information includes the person’s full name, race, home address, date of birth, and date their permit was issued.”
Jun 28
How we built a $1M ARR open source SaaS plausible.io · “We’re a completely independent, self-funded and bootstrapped team of four.”
Jun 24
Google: Italian SA stops use of Google Analytics gpdp.it · “In determining that the processing was unlawful, the Italian SA reiterated that an IP address is a personal data and would not be anonymised even if it were truncated – given Google’s capabilities to enrich such data through additional information it holds.”
Jun 23
We are removing the option to create new subscriptions mullvad.net · “Subscriptions clearly offer a lot of convenience but as we’ve seen that convenience comes at a cost and we no longer think this is an acceptable trade-off.”
Jun 20
Facebook Says Apple is Too Powerful. They're Right. eff.org · “Unfortunately, reality has an anti-surveillance bias.”
Jun 20
About Bunny Fonts fonts.bunny.net · “Simply swap “https://fonts.bunny.net/css" in place of “https://fonts.googleapis.com/css" on your website’s source code and let your users enjoy better privacy.”
Jun 19
Pop-ups are dead, long live pop-ups: or, the bait-and-switch hidden in today's cookie announcement webdevlaw.uk · “As we’ve known for a good while now, and as the announcement states, the Data Reform Bill will shift the responsibility for consent popups from service providers to browsers.”
Jun 17
Firefox rolls out Total Cookie Protection by default to more users worldwide blog.mozilla.org · “Total Cookie Protection works by creating a separate “cookie jar” for each website you visit.”
Jun 14
Ask HN: Is there a TV on the market without “Smart TV” features? news.ycombinator.com · “Or is there at least one where Smart mode can be turned off verifiably AND it doesn’t keep enticing you to turn it on by withholding ease of use or some convenience feature until you just give up?”
Jun 11
VSCodium: Free/Libre Open Source Software Binaries of VS Code vscodium.com · “Microsoft’s vscode source code is open source (MIT-licensed), but the product available for download (Visual Studio Code) is licensed under this not-FLOSS license and contains telemetry/tracking.”
Jun 3
Tim Hortons app violated privacy laws in collection of 'vast amounts' of sensitive location data priv.gc.ca · “The investigation uncovered that Tim Hortons continued to collect vast amounts of location data for a year after shelving plans to use it for targeted advertising, even though it had no legitimate need to do so.”
Jun 1

May 2022 4 posts

How a Single Raspberry Pi made my Home Network Faster brianchristner.io · “Statistically, our household is averaging 15% of queries blocked and a spike over a lousy weather weekend of 30% blocked.”
May 29
Big Tech talks up privacy while trying to kill privacy laws theregister.com · “The report examined 31 states when state legislatures were considering privacy legislation and identified 445 lobbyists and lobbying firms working on behalf of Amazon, Apple, Google, Meta, and Microsoft, along with industry groups like TechNet and the State Privacy and Security Coalition.”
May 29
Chat control: EU Commission presents mass surveillance plan on May 11 patrick-breyer.de · “According to a poll 72% of citizens oppose the indiscriminate scanning of their private communications.”
May 10
CDC Tracked Millions of Phones to See If Americans Followed COVID Lockdown Orders vice.com · “SafeGraph, the company the CDC paid $420,000 for access to one year of data, includes Peter Thiel and the former head of Saudi intelligence among its investors.”
May 3

April 2022 9 posts

You can now ask Google to remove your phone number, email or address from search krebsonsecurity.com · “Its homepage includes a copy of my credit report, Social Security card, phone bill, and a fake but otherwise official looking government ID card.”
Apr 29
Internet spring cleaning: How to delete Instagram, Facebook and other accounts blog.mozilla.org · “Also note that the company says after that period, it may keep copies of your data in “backup storage” to recover in some instances such as software error and legal issues.”
Apr 24
Google gives Europe a ‘reject all’ button for tracking cookies theverge.com · “Previously, Google allowed users to accept all tracking cookies with a single click, but forced people to click through various menus to reject them all.”
Apr 24
De-AMP: Cutting out Google and enhancing privacy brave.com · “AMP pages are served from Google’s servers, though designed to look like they’re coming from the original publisher’s site.”
Apr 19
Virginia police routinely use secret GPS pings to track people’s cell phones insidenova.com · “Police never described Durvin as a suspect in the search warrant application they submitted seeking permission to track him and court records show he has not been charged with any crimes in Virginia since police took out the warrant.”
Apr 16
WireGuard multihop available in the Mullvad app mullvad.net · “All the traffic is encrypted twice directly on your device.”
Apr 12
An Ode to Apple’s Hide My Email empty.coffee · “Most websites we sign up for don’t need our “real” email anyway.”
Apr 10
Sam Altman’s Worldcoin promised them free crypto for an eyeball scan buzzfeednews.com · “The men were offering all comers a T-shirt and a voucher for $20 worth of Worldcoin, which one of the men boasted would appreciate 500%.”
Apr 6
Vizio TVs are now showing banner ads over live TV flatpanelshd.com · “Vizio will first identify what is on your screen and then place interactive banner ads over live TV programs.”
Apr 3

March 2022 7 posts

Hackers Gaining Power of Subpoena Via Fake "Emergency Data Requests" krebsonsecurity.com · “It is now clear that some hackers have figured out there is no quick and easy way for a company that receives one of these EDRs to know whether it is legitimate.”
Mar 29
Obtaining My Personal Data From Amazon Was a Nightmare theintercept.com · “The first thing I learned is that Amazon is in no hurry to give you your data, nor does it really encourage you to ask for it in the first place.”
Mar 27
wireproxy: A userspace WireGuard client that exposes itself as a proxy github.com · “wireproxy is a completely userspace application that connects to a wireguard peer, and exposes a socks5/http proxy or tunnels on the machine.”
Mar 26
Librem 5: first impressions incoherency.co.uk · “In February 2018 I placed an order for a Librem 5.”
Mar 21
EARN-IT threatens encryption and therefore user freedom fsf.org · “Once a backdoor is made, we don’t get to specify how it’s used, or by whom.”
Mar 11
Just Say No to CBDCs theupheaval.substack.com · “But you can’t, since these FedCoins are coded as usable for consumer purchases only, and will expire and vanish in seven days.”
Mar 10
Retrieving your browsing history through a CAPTCHA varun.ch · “This proof of concept looks somewhat like a reCAPTCHA challenge, and styles visited links to look like black squares.”
Mar 5

February 2022 13 posts

No user accounts, by design f-droid.org · “F-Droid has never had a method to identify or track users in the Android client app, and getting information from f-droid.org has also never required any kind of identity information.”
Feb 28
Is Grammarly a Keylogger? What Can You Do About It? kolide.com · “Yet, by explicit definition, any tool that logs a user’s keystrokes and sends them to a third party is technically a keylogger.”
Feb 25
Howard Anglin: In our cashless society, we need to take digital jail seriously thehub.ca · “The government doesn’t need to break down your door anymore to effectively remove you from society.”
Feb 22
New York Is Now Using Cameras With Microphones to Ticket Loud Cars roadandtrack.com · “Your vehicle was recorded by a camera that takes a pictures of the vehicle and the license plate.”
Feb 16
Key Senators Have Voted For The Anti-Encryption EARN IT Act eff.org · “But the kind of abusive images they’re concerned about are already highly illegal under federal law.”
Feb 11
uBlock Origin 1.41 github.com · “The reason is that I did not provide an exact link to the origin of the hsluv-0.1.0.min.js library used by uBO to implement dark theme (uBO’s About page does credit the author of the library).”
Feb 10
Why is the Zoom app listening on my microphone when not in a meeting? community.zoom.com · “This bug was addressed in the Zoom client for macOS version 5.9.3 and we recommend you update to version 5.9.3 to apply the fix.”
Feb 9
Tell HN: Stack Exchange (Stack Overflow) is now blocking Tor news.ycombinator.com · “I tried to contact them by e-mail and they didn’t bother to respond, as is par for the course these days.”
Feb 8
You can change your number signal.org · “Blocked contacts or people you haven’t spoken with on Signal will not be notified of a number change.”
Feb 7
IRS To Ditch Biometric Requirement for Online Access krebsonsecurity.com · “ID.me says it has approximately 64 million users, with 145,000 new users signing up each day.”
Feb 7
The EARN IT Act is back, and it’s more dangerous than ever cyberlaw.stanford.edu · “The only real change is the replacement of that bill’s already-tepid language attempting to protect encryption, with language from the September 2020 House version of the bill.”
Feb 5
Silenced AirTags with disabled speakers are popping up for sale online gizmodo.com · “There are no software updates that Apple can release that will make a physically modified AirTag start to make noise again, and the other included safety features are still dependent on victims not only having an up-to-date smartphone but also being technically savvy enough to download and use the necessary apps to find rogue AirTags nearby.”
Feb 3
GDPR enforcer rules that IAB Europe’s consent popups are unlawful iccl.ie · “All data collected through the TCF must now be deleted by the more than 1,000 companies that pay IAB Europe to use the TCF.”
Feb 2

January 2022 5 posts

Israel police uses NSO's Pegasus to spy on citizens calcalistech.com · “All of these surveillances, as well as those to be detailed later in this article, were conducted against Israeli citizens, without a court order, while taking advantage of a legal loophole.”
Jan 18
Revealed: UK Gov't Plans Publicity Blitz to Undermine Privacy of Your Chats rollingstone.com · “The same slide notes that the campaign “must not start a privacy vs safety debate.””
Jan 16
Diskless infrastructure in beta (System Transparency: stboot) mullvad.net · “Running the system in RAM does not prevent the possibility of logging.”
Jan 12
T-Mobile begins blocking iPhone users from enabling iCloud Private Relay in the US 9to5mac.com · “Customers who chose plans and features with content filtering (e.g. parent controls) do not have access to the iCloud Private Relay to allow these services to work as designed.”
Jan 10
Why Facebook keeps collecting people's data and building their profiles even when their accounts are deactivated digiday.com · “And the company has no data retention policy limiting the length of time it keeps deactivated accounts and the photos and other data associated with them frozen in virtual cryogenic stasis.”
Jan 6

2021 158 posts

December 2021 10 posts

The Belgian government has removed 'backdoor requirement' from new law after international protest tutanota.com · “This draft included a passage that would have forced companies such as WhatsApp and Signal to decrypt their encrypted chats upon request by the authorities for criminal investigation.”
Dec 21
MOFCOM Issues New Encryption Import Control Effective Immediately sanctionsnews.bakermckenzie.com · “Encryption technologies with encryption strength exceeding the specified threshold can no longer be freely transferred to a Chinese party.”
Dec 21
An iframe from googlesyndication.com tries to access the Camera and Microphone techsparx.com · “There is no legitimate purpose for an advertising network to access either the camera or microphone.”
Dec 19
Boston Police Bought Spy Tech With a Pot of Money Hidden From the Public propublica.org · “A WBUR investigation with ProPublica found elected officials and the public were largely kept in the dark when Boston police spent $627,000 on this equipment by dipping into money seized in connection with alleged crimes.”
Dec 18
CCPA Scam November 2021 from Princeton University blog.freeradical.zone · “I had a minor panic attack, literally, upon receipt, as I thought I was about to be sued.”
Dec 17
Apple Removes All References to Controversial CSAM Scanning Feature From Its Child Safety Webpage macrumors.com · “However, despite Apple’s efforts, the controversy didn’t go away.”
Dec 15
How to build large-scale end-to-end encrypted group video calls signal.org · “There is no off the shelf software that would allow us to support calls of that size while ensuring that all communication is end-to-end encrypted, so we built our own open source Signal Calling Service to do the job.”
Dec 15
Chrome Users Beware: Manifest V3 is Deceitful and Threatening eff.org · “Like FLoC and Privacy Sandbox before it, Manifest V3 is another example of the inherent conflict of interest that comes from Google controlling both the dominant web browser and one of the largest internet advertising networks.”
Dec 9
Germany: New government plans 'right to encryption' tutanota.com · “There will be a right to encryption, and the state must also offer the option of genuine encrypted communication.”
Dec 3
Testing Phone-Sized Faraday Bags mattblaze.org · “In my experiments, I found I could sometimes achieve approximately 90 dB attenuation by carefully wrapping the generator in foil and double folding the seams on all sides, which is quite good (comparable to commercial pouches).”
Dec 2

November 2021 5 posts

SUCCESS! New German government calls for European ban on biometric mass surveillance reclaimyourface.eu · “The newly-agreed German government coalition has called for a Europe-wide ban on public facial recognition and other biometric surveillance.”
Nov 25
LAPD: Hidden Spy Camera Detection using Smartphone Time-of-Flight Sensors dl.acm.org · “Tiny hidden spy cameras concealed in sensitive locations including hotels and bathrooms are becoming a significant threat worldwide.”
Nov 18
ProctorU is dystopian spyware shkspr.mobi · “They also want complete control over your laptop, including the ability to silently transfer files and run arbitrary programs.”
Nov 9
iPhone Apps Can Tell Many Things About You Through the Accelerometer mysk.blog · “Currently, iOS allows any installed app to access accelerometer data without explicit permission from the user.”
Nov 8
IAB Europe warns of GDPR breach finding techcrunch.com · “Is this the beginning of the end for the hated tracking cookie consent pop-up?”
Nov 5

October 2021 17 posts

Wacom drawing tablets track the name of every application that you open robertheaton.com · “Why does a device that is essentially a mouse need a privacy policy?”
Oct 31
Avoiding bot detection: How to scrape the web without getting blocked? github.com · “The IP pool is mainly sourced from users of HolaVPN and an app monetization SDK.”
Oct 31
Grand jury subpoena for Signal user data, Central District of California (again!) signal.org · “It’s impossible to turn over data that we never had access to in the first place.”
Oct 29
Edward Snowden Slams Sam Altman's Worldcoin: 'Don't Catalogue Eyeballs' decrypt.co · “Worldcoin, which already touts a $1 billion valuation, aims to onboard more people into crypto by doling out free coins to anyone who scans their eyes on a device called "the Orb" that will convert an image of your eyes into "short numeric code" to check whether you already have Worldcoins.”
Oct 26
Privacy is a Human Right blog.torproject.org · “Privacy is about protecting what makes us humans: our day-to-day behavior, our personality, our fears, our relationships, and our vulnerabilities.”
Oct 26
Here's the FBI's Internal Guide for Getting Data from AT&T, T-Mobile, Verizon vice.com · “The document, a 139 page slide presentation dated 2019, is written by the FBI’s Cellular Analysis Survey Team (CAST).”
Oct 25
Government orders Google to track anyone searching certain names, addresses, and phone numbers dailymail.co.uk · “The U.S. government is using ‘keyword warrants’ to uncover the identity of anyone who searches Google and other search engines for certain search terms that may be related to a crime, according to a new report.”
Oct 25
Proton wins appeal in Swiss court over surveillance laws swissinfo.ch · “A Swiss court has upheld the appeal of Geneva-based Proton, a provider of secure and anonymous email services, limiting its obligation to monitor traffic and retain data for surveillance purposes.”
Oct 24
Police Can't Demand You Reveal Your Phone Passcode and Then Tell a Jury You Refused eff.org · “The State cannot compel a suspect to recall and share information that exists only in his mind.”
Oct 22
Privacy-preserving Brave Search Replaces Google as the Default Search Engine in the Brave Browser brave.com · “Brave Search is currently not displaying ads, but the free version of Brave Search will soon be ad-supported.”
Oct 20
Wearable Microphone Jamming sandlab.cs.uchicago.edu · “We engineered a wearable microphone jammer that is capable of disabling microphones in its user’s surroundings, including hidden microphones.”
Oct 16
Kape Technologies (Formerly Crossrider) Now Owns ExpressVPN, CyberGhost, Private Internet Access, Zenmate, and a Collection of VPN "Review" Websites restoreprivacy.com · “Kape Technologies (formerly Crossrider) has now acquired four different VPN services and a collection of VPN "review" websites that rank Kape’s VPN holdings at the top of their recommendations.”
Oct 13
Android Mobile OS Snooping By Samsung, Xiaomi, Huawei and Realme Handsets scss.tcd.ie · “There is no opt out from this data collection.”
Oct 11
O&O ShutUp10++: Free antispy tool for Windows 10 and 11 oo-software.com · “Some services log all your keystrokes, share your Wi-Fi access data with your Facebook contacts, or connect your computer to a public and potentially unsecured network without asking.”
Oct 9
Account deletion within apps required starting January 31 developer.apple.com · “The updates to App Store Review Guideline 5.1.1 last June provided users with greater control over their personal data, stating that all apps that allow for account creation must also allow users to initiate deletion of their account from within the app.”
Oct 6
Data of Over 1.5 Billion Facebook Users Sold on Hacker Forum privacyaffairs.com · “It’s alleged that the data was obtained by scraping publicly available data shared by users.”
Oct 4
New study reveals iPhones aren't as private as you think tomsguide.com · “Much of this data collection takes place after the phone is first turned on, before the user logs into an Apple or Google account, and even when all optional data-sharing settings are disabled.”
Oct 3

September 2021 9 posts

As Google sets burial date for legacy Chrome Extensions, fears for ad-blockers grow theregister.com · “Thereafter, only Manifest V3 extensions will be supported in Chrome, a change that critics fear will hobble the add-ons and make them little more than toys.”
Sep 28
Spy tech that followed kids home for remote learning the74million.org · “Over the next six months, Matlock got nearly 1,300 similar emails from Gaggle, a surveillance company that monitors students’ school-issued Google and Microsoft accounts.”
Sep 19
The new warrant: how US police mine Google for your location and search history theguardian.com · “Google revealed for the first time in August that it received 11,554 geofence location warrants from law enforcement agencies in 2020, up from 8,396 in 2019 and 982 in 2018.”
Sep 16
A Single Laser Fired Through a Keyhole Can Expose Everything Inside a Room gizmodo.com · “But researchers at the Stanford Computational Imaging Lab have expanded on a technique called non-line-of-sight imaging so that just a single point of laser light entering a room can be used to see what physical objects might be inside.”
Sep 9
Australia's new mass surveillance mandate digitalrightswatch.org.au · “The Australian government has new laws on the books to hack your computer, your online accounts, and just about any piece of technology and networks you come into contact with.”
Sep 7
ProtonMail deletes 'we don't log your IP' boast from website after French climate activist reportedly arrested theregister.com · “ProtonMail responded to this request by providing the IP address and the fingerprint of the browser used by the collective.”
Sep 7
Apple Delays Rollout of Controversial Child Safety Features to Make Improvements macrumors.com · “Apple has delayed the rollout of the Child Safety Features that it announced last month following negative feedback, the company has today announced.”
Sep 3
Sky Subscribers' Piracy Habits Directly Help Premier League Block Illegal Streams torrentfreak.com · “UK ISP Sky Broadband is monitoring the IP addresses of servers suspected of streaming pirated content to subscribers and supplying that data to an anti-piracy company working with the Premier League.”
Sep 2
WhatsApp Ireland hit with record fine of €225m by DPC rte.ie · “However, eight of around 40 of those authorities disagreed with the draft conclusions, including the DPC’s proposed fine of up to €50m.”
Sep 2

August 2021 27 posts

58% of Hacker News, Reddit and tech-savvy audiences block Google Analytics plausible.io · “It turns out 58% of Hacker News readers, Reddit users and other techies block Google Analytics.”
Aug 31
Show HN: We built an end-to-end encrypted alternative to Google Photos news.ycombinator.com · “We’ve built a fault-tolerant data replication layer that replicates your data to two different storage providers in the EU.”
Aug 29
EU agency advises against using search & browsing history for credit scores therecord.media · “The European Union’s lead data protection supervisor has recommended on Thursday that personal data such as search queries & internet browsing history should not be used for the assessment of credit scores and creditworthiness.”
Aug 28
The All-Seeing "i": Apple Just Declared War on Your Privacy edwardsnowden.substack.com · “Apple’s new system, regardless of how anyone tries to justify it, will permanently redefine what belongs to you, and what belongs to them.”
Aug 26
Google says geofence warrants make up one-quarter of all US demands techcrunch.com · “According to the data, Google received 982 geofence warrants in 2018, 8,396 in 2019 and 11,554 in 2020.”
Aug 22
EFF Joins Global Coalition Asking Apple CEO Tim Cook to Stop Phone-Scanning eff.org · “EFF has joined the Center for Democracy and Technology (CDT) and more than 90 other organizations to send a letter urging Apple CEO Tim Cook to stop the company’s plans to weaken privacy and security on Apple’s iPhones and other products.”
Aug 21
University Researchers Who Built a CSAM Scanning System Urge Apple to Not Use the 'Dangerous' Technology macrumors.com · “Knowledgeable observers argued a system like ours was far from feasible.”
Aug 20
NeuralHash Collisions: The Limits of Apple’s Image Hashing blog.roboflow.com · “It’s really important that the opposite is also true (two images that are not the same do not have matching NeuralHashes) because otherwise Apple’s system could falsely accuse people of trading in CSAM.”
Aug 19
Working Collision? github.com · “Can you verify that these two images collide?”
Aug 18
Apple says researchers can vet its child safety features. But it’s suing a startup that does just that. technologyreview.com · “Apple is suing a company that makes software to let security researchers do exactly that.”
Aug 18
Stop using Zoom, Hamburg's DPA warns state government techcrunch.com · “Hamburg’s state government has been formally warned against using Zoom over data protection concerns.”
Aug 17
Secret terrorist watchlist with 2 million records exposed online bleepingcomputer.com · “The list was left accessible on an Elasticsearch cluster that had no password on it.”
Aug 16
Many Americans aren't aware they're being tracked with facial recognition while shopping techradar.com · “While San Francisco banned the police from using facial recognition back in 2019 and the EU called for a five year ban on the technology last year, several major retailers in the US including Lowe’s, Albertsons and Macy’s have been using it for both fraud and theft detection.”
Aug 16
Apple regrets confusion over 'iPhone scanning' bbc.com · “He said that - in hindsight - introducing two features at the same time was "a recipe for this kind of confusion".”
Aug 13
The Deceptive PR Behind Apple’s “Expanded Protections for Children” piotr.is · “In contrast to how easy it is to explain to “an average Joe” why Google’s or Facebook’s business models pose a threat to people’s privacy, it’s very hard to explain why Apple’s new mechanism is even worse.”
Aug 12
Internet of Snitches puri.sm · “Imagine an Internet of Snitches, each scanning whatever data they have access to for evidence of crime.”
Aug 12
Firefox 91 Introduces Enhanced Cookie Clearing blog.mozilla.org · “When you decide to tell Firefox to forget about a website, Firefox will automatically throw away all cookies, supercookies and other data stored in that website’s “cookie jar”.”
Aug 10
Apple’s Mistake stratechery.com · “In this case, though, Apple is building the capability, and the only thing holding the company back is policy.”
Aug 9
One Bad Apple hackerfactor.com · “In the six years that I’ve been using these hashes at FotoForensics, I’ve only matched 5 of these 3 million MD5 hashes.”
Aug 8
Why I Wrote PGP philzimmermann.com · “Privacy is as apple-pie as the Constitution.”
Aug 8
In internal memo, Apple addresses concerns around new Photo scanning features, doubles down on the need to protect children 9to5mac.com · “We know that the days to come will be filled with the screeching voices of the minority.”
Aug 7
CalyxOS calyxos.org · “CalyxOS is an Android mobile operating system that puts privacy and security into the hands of everyday users.”
Aug 6
The Problem with Perceptual Hashes rentafounder.com · “When such algorithms are used to detect criminal activities, especially at Apple scale, many innocent people can potentially face serious problems.”
Aug 6
Apple's Plan to "Think Different" About Encryption Opens a Backdoor to Your Private Life eff.org · “That’s not a slippery slope; that’s a fully built system just waiting for external pressure to make the slightest change.”
Aug 5
Why Facebook’s claims about the Ad Observer are wrong blog.mozilla.org · “In our view, those claims simply do not hold water.”
Aug 5
The Cryptocurrency Surveillance Provision Buried in the Infrastructure Bill is a Disaster for Digital Privacy eff.org · “The mandate to collect names, addresses, and transactions of customers means almost every company even tangentially related to cryptocurrency may suddenly be forced to surveil their users.”
Aug 3
Why printers add secret tracking dots bbc.com · “There is a long-running debate over whether it is ethical for printers to be attaching this information to documents without users knowing.”
Aug 1

July 2021 10 posts

We Need To Talk About The Insecurity Industry edwardsnowden.substack.com · “The first thing I do when I get a new phone is take it apart.”
Jul 26
Images from another user displayed in message github.com · “Best case the images are from another contact of B and messages got crossed, worst case they are from an unknown party, who’s data has now been leaked.”
Jul 25
Apple sued in nightmare case involving teen wrongly accused of shoplifting, driver's permit used by impostor, and unreliable facial-rec tech theregister.com · “Apple and SIS have a qualified law enforcement privilege that allows them to err in store security-related accusations and not be sued for it.”
Jul 19
Amazon Shuts Down NSO Group Infrastructure vice.com · “Amazon Web Services (AWS) has shut down infrastructure and accounts linked to Israeli surveillance vendor NSO Group, Amazon said in a statement.”
Jul 19
Revealed: leak uncovers global abuse of cyber-surveillance weapon theguardian.com · “The leak contains a list of more than 50,000 phone numbers that, it is believed, have been identified as those of people of interest by clients of NSO since 2016.”
Jul 18
People Staring at Computers kylemcdonald.net · “In 2011 I was still under the false belief that all varieties of law enforcement are designed to protect the public from harm.”
Jul 11
Open letter: Ban surveillance-based advertising vivaldi.com · “These practices seriously undermine competition and take revenue away from content creators.”
Jul 7
Chatcontrol: European Parliament approves mass surveillance of private communications patrick-breyer.de · “In today’s vote, 537 Members of the European Parliament approved Chatcontrol, with 133 voting against and 24 abstentions.”
Jul 6
Tencent Deploys Facial Recognition to Detect Minors Gaming at Night sixthtone.com · “Tencent began testing the use of facial recognition to check users’ age in Beijing and Shenzhen as of late 2018.”
Jul 6
Intuit to Share Payroll Data from 1.4M Small Businesses With Equifax krebsonsecurity.com · “At the time, all you needed to view someone’s entire work and salary history was their Social Security number and date of birth.”
Jul 1

June 2021 11 posts

I Will Never Use a Microsoft Account to Log Into My Own PC extremetech.com · “Specifically, Windows 11 Home will now require both internet access and a Microsoft account in order to set up the PC.”
Jun 28
How I was let go for refusing to deploy a dark pattern peachesnstink.com · “In other words, email addresses were being saved to the database when a user inputs an email and the input loses focus.”
Jun 25
What's Inside the EU Green Pass QR Code? gir.st · “What is not included is the date during which she is considered immune.”
Jun 22
Apple's iCloud+ “VPN” metzdowd.com · “In one move, Apple has taken onion routing from a specialized tool for hackers to something that will be in daily use on billions of devices.”
Jun 16
Amazon is blocking Google’s FLoC digiday.com · “But Amazon’s blocking appears scattered.”
Jun 15
Stripe Identity: Verify identities with confidence stripe.com · “Poor image capture is the most common reason legitimate users are mistakenly rejected.”
Jun 14
Irish police to be given powers over passwords bbc.com · “Irish police will have the power to compel people to provide passwords for electronic devices when carrying out a search warrant under new legislation.”
Jun 14
Australian Federal Police and FBI nab criminal underworld figures in worldwide sting using encrypted app abc.net.au · “Authorities say they were able to read up to 25 million messages in real time.”
Jun 8
Why We Should End the Data Economy thereboot.com · “The more companies know about you, the more power they have over you.”
Jun 4
PayPal Shuts Down Long-Time Tor Supporter with No Recourse eff.org · “PayPal denied that the shutdown was related to the concerns about Tor, claiming only that “the situation has been determined appropriately” and refusing to offer a specific explanation.”
Jun 2
Amazon US customers have one week to opt out of mass wireless sharing theguardian.com · “Users can disable Sidewalk in the settings section of the Alexa or Ring apps, but have until 8 June to do so.”
Jun 1

May 2021 12 posts

'Apple is eating our lunch': Google employees admit in lawsuit that the company made it nearly impossible for users to keep their location private businessinsider.com · “Google continued collecting location data even when users turned off various location-sharing settings, made popular privacy settings harder to find, and even pressured LG and other phone makers into hiding settings precisely because users liked them, according to the documents.”
May 29
voice2json: Command-line tools for speech and intent recognition on Linux voice2json.org · “voice2json is a collection of command-line tools for offline speech/intent recognition on Linux.”
May 21
How the UK's Online Safety Bill threatens Matrix matrix.org · “The bill itself does not actually provide a definition of harmful, instead relying on service providers to assess and decide on this.”
May 20
Pentagon Surveilling Americans Without a Warrant, Senator Reveals vice.com · “The Pentagon is carrying out warrantless surveillance of Americans, according to a new letter written by Senator Ron Wyden and obtained by Motherboard.”
May 13
Cross-Browser Tracking Vulnerability in Tor, Safari, Chrome, and Firefox fingerprintjs.com · “The vulnerability uses information about installed apps on your computer to assign you a permanent unique identifier even if you switch browsers, use incognito mode, or use a VPN.”
May 13
Germany bans Facebook from handling WhatsApp data euronews.com · “The regulator suggested that the decision wasn’t just about protecting users’ privacy but also to avoid the use of data “to influence voters’ decisions to manipulate democratic choices,” citing the upcoming September 26 parliamentary elections in Germany.”
May 11
I Mailed an AirTag and Tracked Its Progress; Here’s What Happened intego.com · “Apple touts their network of nearly a billion devices capable of spotting AirTags, and if there are that many, it should be easy to track this envelope across the country.”
May 11
Facebook threatens to make iOS users pay. Please do it, Mr. Zuckerberg zdnet.com · “Facebook is unhappy about this because it makes money by tracking you all over the web until the end of time.”
May 7
WhatsApp will progressively kill features until users accept new privacy policy androidpolice.com · “However, after a few weeks of that, WhatsApp will then switch off all incoming notifications and calls for your account, effectively rendering it useless.”
May 7
ClearURLs: automatically remove tracking elements from URLs github.com · “Many websites use tracking elements in the URL (e.g. https://example.com?utm_source=newsletter1&utm_medium=email&utm_campaign=sale) to mark your online activity.”
May 5
Me2BA Product Testing Spotlight Report Published: Data Sharing in Primary & Secondary School Mobile Apps me2ba.org · “The Me2B Alliance Product Testing team audited a random sample of 73 apps from 38 schools in 14 states across the U.S., covering over half a million people (students, their families, educators, etc.).”
May 5
The Instagram ads Facebook won't show you signal.org · “Being transparent about how ads use people’s data is apparently enough to get banned; in Facebook’s world, the only acceptable usage is to hide what you’re doing from your audience.”
May 4

April 2021 20 posts

Grand jury subpoena for Signal user data, Central District of California signal.org · “Because everything in Signal is end-to-end encrypted by default, the broad set of personal information that is typically easy to retrieve in other apps simply doesn’t exist on Signal’s servers.”
Apr 28
Google Promised Its Contact Tracing App Was Completely Private, But It Wasn’t themarkup.org · “California governor Gavin Newsom endorsed his state’s version of the app, calling it “100% private & secure” in a tweet last December.”
Apr 27
Experian's Credit Freeze Security is Still a Joke krebsonsecurity.com · “Experian’s page for retrieving someone’s credit freeze PIN requires little more information than has already been leaked by big-three bureau Equifax and a myriad other breaches.”
Apr 26
EFF Sues Proctorio on Behalf of Student It Falsely Accused of Copyright Infringement to Get Critical Tweets Taken Down eff.org · “Proctorio has responded to public criticism by attacking people who speak out.”
Apr 22
Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer from an app's perspective signal.org · “By a truly unbelievable coincidence, I was recently out for a walk when I saw a small package fall off a truck ahead of me.”
Apr 21
The Fourth Amendment Is Not For Sale Act wyden.senate.gov · “To amend section 2702 of title 18, United States Code, to prevent law enforcement and intelligence agencies from obtaining subscriber or customer records in exchange for anything of value, to address communications and records in the possession of intermediary internet service providers, and for other purposes.”
Apr 21
Apple introduces AirTag apple.com · “AirTag is also designed with a set of proactive features that discourage unwanted tracking, an industry first.”
Apr 20
All the Numbers are US: Large-scale Abuse of Contact Discovery in Mobile Messengers ndss-symposium.org · “Using an accurate database of mobile phone number prefixes and very few resources, we have queried 10 % of US mobile phone numbers for WhatsApp and 100 % for Signal.”
Apr 19
Proposal: Treat FLoC like a security concern make.wordpress.org · “WordPress powers approximately 41% of the web – and this community can help combat racism, sexism, anti-LGBTQ+ discrimination and discrimination against those with mental illness with a few lines of code.”
Apr 18
Huawei was able to eavesdrop on Dutch mobile network KPN: Report nltimes.nl · “Huawei also knew which numbers were tapped by police and intelligence services.”
Apr 18
Luca App: CCC calls for an immediate moratorium ccc.de · “The unending series of security problems and the vendor’s heavy-handed responses are evidence of a fundamental lack of competence and care.”
Apr 16
Google misled consumers about the collection and use of location data accc.gov.au · “The Court ruled that when consumers created a new Google Account during the initial set-up process of their Android device, Google misrepresented that the ‘Location History’ setting was the only Google Account setting that affected whether Google collected, kept or used personally identifiable data about their location.”
Apr 16
Use DuckDuckGo Extension to Block FLoC, Google’s New Tracking Method in Chrome spreadprivacy.com · “Google has created a new tracking method called FLoC, put it in Chrome, and automatically turned it on for millions of users.”
Apr 15
Bitcoin Is a ‘Boon for Surveillance’, Says Former CIA Director decrypt.co · “The technology behind Bitcoin is a “boon for surveillance” and shouldn’t be shunned by governments but embraced, according to an ex-CIA boss.”
Apr 14
WhatsApp's new privacy policy is so bad it might be illegal androidpolice.com · “The Hamburg commissioner for data protection and freedom of information, Johannes Caspar, is looking to stop Facebook from aggregating the data from WhatsApp, fearing that the company would use it to expand its marketing and advertising business.”
Apr 13
School custodian refuses to download phone app that monitors location, says it got her fired cbc.ca · “A school custodian says she was fired after refusing to put an app on her phone that checked her location, citing privacy concerns.”
Apr 13
An Interview With the Man Who Keeps Uploading My Feet to WikiFeet thecut.com · “We spoke for nearly an hour, almost entirely about feet.”
Apr 8
Et Tu, Signal? stephendiehl.com · “It’s an old scam with a new face.”
Apr 7
I Refused to Become an FBI Informant, and the Government Put Me on the No Fly List aclu.org · “But the government won’t even give me its reason for putting me on the No Fly List, any evidence it thinks might justify an indefinite flying ban, or a hearing to clear my name.”
Apr 6
533 million Facebook users' phone numbers and personal data have been leaked online businessinsider.com · “A Facebook spokesperson told Insider that the data had been scraped because of a vulnerability that the company patched in 2019.”
Apr 3

March 2021 13 posts

Google collects 20 times more telemetry from Android devices than Apple from iOS therecord.media · “Academic research published last week looked at the telemetry traffic sent by modern iOS and Android devices back to Apple and Google servers and found that Google collects around 20 times more telemetry data from Android devices than Apple from iOS.”
Mar 30
Addon Unavailable on Google Chrome github.com · “The mention of all the people who helped to develop and translate ClearURLs is against Google’s rules because it could “confuse” the user.”
Mar 24
Firefox 87 introduces SmartBlock for Private Browsing blog.mozilla.org · “SmartBlock ensures that strong privacy protections in Firefox are accompanied by a great web browsing experience.”
Mar 24
Backblaze submitting names and sizes of files in B2 buckets to Facebook twitter.com · “I even opted out of their tracking widget thing!”
Mar 22
Firefox 87 trims HTTP Referrers by default to protect user privacy blog.mozilla.org · “From now on, by default, Firefox will trim path and query string information from referrer headers to prevent sites from accidentally leaking sensitive user data.”
Mar 22
The S in IOT is for Security puri.sm · “You also have to agree to the terms of service to install and use the application.”
Mar 22
The FBI Should Stop Attacking Encryption and Tell Congress About All the Encrypted Phones It's Already Hacking Into eff.org · “Cellebrite can bypass lock screens on about 1,500 different devices.”
Mar 15
Minister hints at UK departure from GDPR lawgazette.co.uk · “Dowden said that under the regime ’too many businesses and organisations are reluctant to use data – either because they don’t understand the rules or are afraid of inadvertently breaking them’.”
Mar 12
Hackers breach thousands of security cameras, exposing Tesla, jails, hospitals bnnbloomberg.ca · “In addition, hackers were able to view video from inside women’s health clinics, psychiatric hospitals and the offices of Verkada itself.”
Mar 9
Digital identity scheme shot down by voters over data privacy concerns swissinfo.ch · “Final results show 64.4% of voters coming out against the planned law on Sunday.”
Mar 7
Google's FLoC Is a Terrible Idea eff.org · “FLoC is meant to be a new way to make your browser do the profiling that third-party trackers used to do themselves: in this case, boiling down your recent browsing activity into a behavioral label, and then sharing it with websites and advertisers.”
Mar 4
Brave buys a search engine, promises no tracking, no profiling – and may even offer a paid-for, no-ad version theregister.com · “The deal, terms undisclosed, makes Cliqz owner Hubert Burda Media a Brave shareholder.”
Mar 3
Are Xiaomi browsers spyware? Yes, they are… palant.info · “But they also transmit user’s Xiaomi account ID if they know it, which is directly linked to the user’s identity.”
Mar 1

February 2021 12 posts

Little League wants all your information honeypot.net · “In other words, you have to upload your most private information and agree to allow them to do as they like with it, including sharing it with whomever they like for any reason they choose.”
Feb 28
fake_contacts: Create fake phone contacts, to do data-poisoning github.com · “This feeds fake data to any apps or companies who are copying our private data to use or sell it.”
Feb 27
Judge in Google case disturbed that 'incognito' users are tracked bnnbloomberg.ca · “Broome’s attempt to downplay the privacy concerns by pointing out that the federal court system’s own website uses Google services ended up backfiring.”
Feb 26
Why Is Facebook Launching An All-Out War On Apple's Upcoming iPhone Update? npr.org · “In the coming weeks, Apple will update its iOS software for iPhones to require apps to get explicit consent to track what people are doing on their phones for the purposes of sharing it with third parties.”
Feb 26
Google Analytics: Stop feeding the beast casparwre.de · “Google is a giant advertising platform.”
Feb 25
Firefox 86 Introduces Total Cookie Protection blog.mozilla.org · “Total Cookie Protection confines cookies to the site where they were created, which prevents tracking companies from using these cookies to track your browsing from site to site.”
Feb 23
Apple redirects Google Safe Browsing traffic through its own proxy servers to prevent disclosing users' IP addresses to Google in iOS 14.5 the8-bit.com · “A perfect example is the new privacy feature in iOS 14.5 Beta 1 (V2) which redirects Google Safe Browsing traffic through Apple’s own proxy servers to enhance users’ privacy and to not let Google see your IP address.”
Feb 12
Supercookie: Browser Fingerprinting via Favicon github.com · “The tracking method works even in the browser’s incognito mode and is not cleared by flushing the cache, closing the browser or restarting the operating system, using a VPN or installing AdBlockers.”
Feb 7
Disqus, the dark commenting system web.archive.org · “Disqus makes 76 HTTP requests and fetches 2MB of data!”
Feb 5
Help users in Iran reconnect to Signal signal.org · “An inexpensive and tiny VPS can easily handle hundreds of concurrent users.”
Feb 4
Why Google's approach to replacing the cookie is drawing antitrust scrutiny digiday.com · “Google’s decision to kill off third-party cookies has already elicited multiple antitrust lawsuits and a U.S. congressional probe.”
Feb 3
Facebook testing notification to users about Apple privacy changes axios.com · “Developers forecast that only around 10-30% of users will actually opt-in to having their data collected, making it much harder for advertisers to target potential Apple customers without as much access to their data.”
Feb 1

January 2021 12 posts

Dark Patterns at Scale: Findings from a Crawl of 11K Shopping Websites webtransparency.cs.princeton.edu · “We identify 22 third-party entities that provide shopping websites with the ability to create dark patterns on their sites.”
Jan 30
The EU must protect the right to privacy and not attack end-to-end encryption protonmail.com · “We strongly oppose this resolution because it foreshadows an attack on encryption.”
Jan 28
Firefox 85 Cracks Down on Supercookies blog.mozilla.org · “In short, supercookies can be used in place of ordinary cookies to store user identifiers, but they are much more difficult to delete and block.”
Jan 26
WhatsApp loses millions of users after terms update theguardian.com · “By contrast, Signal wasn’t even in the top 1,000 apps in the UK on 6 January, yet by 9 January it was the most downloaded app in the country.”
Jan 25
I no longer trust The Great Suspender dafoster.net · “Notably the most recent version of the extension (v7.1.8) has added integrated analytics that can track all of your browsing activity across all sites.”
Jan 20
Tell HN: Dropbox now requires access to contacts for Google login news.ycombinator.com · “Interesting that they chose this route when users are getting more and more privacy-aware.”
Jan 15
WhatsApp delays privacy changes after backlash p.dw.com · “Under updated terms, the app would be allowed to share users’ data, including location and phone number, with its parent company Facebook and its units such as Instagram and Messenger.”
Jan 15
Facebook confirms data-sharing agreements with Chinese firms bbc.com · “Huawei has never collected or stored any Facebook user data.”
Jan 12
WhatsApp rival Signal reports growing pains after Elon Musk's tweet economictimes.indiatimes.com · “Encrypted messaging app Signal said it saw a “giant spike” in India after WhatsApp announced it would be sharing more user data with parent Facebook under an updated privacy policy and new terms of service.”
Jan 9
Apple's privacy labels reveals Whatsapp and Facebook Messenger's hunger for user data techradar.com · “The data from App Store indicates that Facebook Messenger leads in user data collection and is closely followed by Whatsapp.”
Jan 8
Telegram publishes users' locations online blog.ahmed.nyc · “If someone spoofs their latitude, longitude, they can triangulate a user and find their location.”
Jan 5
URL shorteners set ad tracking cookies ylukem.com · “TinyURL’s privacy policy, last updated in 2012, has no mention of either third party data-sharing nor the cookies they share from affiliates.”
Jan 3