Firewalls Don't Stop Dragons Podcast

It's rare these days to find a well-designed and useful application that was made to be private from the get-go. Too many apps today view your personal data as a cash cow to be mercilessly milked, claiming to value your privacy when they really value the extra revenue they can make off of your private data. When I find useful apps that are private by design, especially ones that can replace more popular apps that harvest our data, I like to call attention to them: in this case, Ente Photos. Today I'll ask the founder and CEO why privacy is important to him and how it influenced his design approach. Interview Notes Ente Photo: https://ente.io/ Ente Auth: https://ente.io/auth/  Ente’s Machine Learning: https://ente.io/ml/  Ken Thompon’s lecture on trust: https://dl.acm.org/doi/10.1145/358198.358210  Further Info My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support the mission: https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:00: Intro 0:04:08: interview terminology 0:06:44: Why did you start Ente and why do you care about privacy? 0:15:23: Why should we trust Ente with our private data? 0:20:14: What private information does Ente collect? 0:25:12: How hard is it for 3rd party apps to integrate with the OS? 0:29:39: Is Ente more private than Apple Photos with ADP enabled? 0:31:40: How hard is it to migrate from Google or Apple Photos to Ente? 0:34:30: Is facial recognition metadata in a standard, portable format? 0:35:51: How hard is it to export photos from Ente? 0:37:57: Does Ente Auth allow for easy export and backup? 0:39:28: How do you backup your Ente photos? 0:41:12: How much of Ente's AI photo processing is purely on-device? 0:45:51: How do you vet third party software libraries for privacy? 0:49:07: What data could Ente give, if required, to law enforcement? 0:52:43: How can we pass on our legacy of memories to our kids? 0:54:55: What's next for Ente? 0:59:43: Interview wrap-up 1:00:56: Patron podcast preview 1:01:36: Looking ahead

In our quest to clean up and secure our data, today I will give you several clever and useful techniques for uncovering old, forgotten online accounts. We'll scrape the bottom of the barrel to complete our list of accounts so that we can upgrade their security, see what data they have, and remove anything we no longer want floating around out there, waiting to be stolen or abused. In the news: Chat Control is up for a vote in the EU (time to contact your MEPs); Samsung to show ads on their smart refrigerators; new automated sextortion spyware; a third of UK firms spying on employees; airlines sells 5B flight records for warrantless searching; ICE signs $3M contract for phone hacking tool; ChatGPT to guess your age or require ID; Swiss government looks to enable mass surveillance; Google Pixel 10 adds C2PA support; Apple iPhone 17 includes killer hardware security feature. Article Links Chat Control: Can the EU Parliament save our encrypted chats? https://www.techradar.com/vpn/vpn-privacy-security/chat-control-can-the-eu-parliament-save-our-encrypted-chats Samsung confirms its $1,800+ fridges will start showing you ads https://www.androidauthority.com/samsung-confirms-smart-refrigerator-ads-are-coming-3598848/ Automated Sextortion Spyware Takes Webcam Pics of Victims Watching Porn https://www.wired.com/story/stealerium-infostealer-porn-sextortion/ A third of UK firms using 'bossware' to monitor workers' activity, survey reveals https://www.theguardian.com/world/2025/sep/14/uk-firms-bossware-monitor-workers-activity Airlines Sell 5 Billion Plane Ticket Records to the Government For Warrantless Searching https://www.404media.co/airlines-sell-5-billion-plane-ticket-records-to-the-government-for-warrantless-searching/ ICE unit signs new $3M contract for phone-hacking tech | TechCrunch https://techcrunch.com/2025/09/18/ice-unit-signs-new-3-million-contract-for-phone-hacking-tech/ ChatGPT Will Guess Your Age and Might Require ID for Age Verification https://www.404media.co/chatgpt-will-guess-your-age-and-might-require-id-for-age-verification/ Swiss government looks to undercut privacy tech, stoking fears of mass surveillance https://therecord.media/switzerland-digital-privacy-law-proton-privacy-surveillance Google Pixel 10 Adds C2PA Support to Verify AI-Generated Media Authenticity https://thehackernews.com/2025/09/google-pixel-10-adds-c2pa-support-to.html The iPhone 17 memory shield will give spyware developers a hard time https://appleinsider.com/articles/25/09/11/the-iphone-17-memory-shield-will-give-spyware-developers-a-hard-time Tip of the Week: https://firewallsdontstopdragons.com/find-old-accounts-part-2/  Further Info Fight Chat Control in EU: https://fightchatcontrol.eu/  ARC opt out: https://www2.arccorp.com/site-privacy-policy/#17  LinkedIn privacy settings to change: https://discuss.privacyguides.net/t/linkedin-change-of-tos-opt-out-before-november-3rd/31199  Privacy Guides: https://www.privacyguides.org/  Coalition for Content Provenance and Authenticity: https://c2pa.org/  My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support our mission! https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:00: Intro 0:00:23: Few PSA's 0:03:37: News preview 0:05:35: EU's Chat Control vote coming soon 0:10:46: Samsung smart fridges to start showing ads 0:16:17: New automated sextortion malware 0:21:24: A third of UK companies spy on employees 0:25:51: Airlines sell 5B records for warrantless searches 0:31:44: ICE signs $3M contract for phone hacking tool 0:34:08: ChatGPT to guess your age or require ID 0:38:11: New Swiss law would uncut user privacy 0:42:46: Google Pixel 10 Adds C2PA Support 0:45:50: iPhone 17 adds killer new security feature

Artificial Intelligence (AI) is the Big Tech buzzword of the day. Every company who wants investment (public or private) is scrambling to have an "AI story", adding chatbots and 'agentic' features in their products wherever possible. The AI companies themselves are constantly expanding their models, ingesting as much data (including highly personal information) as possible. In this AI gold rush, companies are making flawed and often harmful products. Companies are firing workers and trying to replace them with AI bots. And it's forcing us all to question what's real, what has actual value, and what the impacts could and should be on society as a whole. Discussing deep questions like this is the purview of philosophers - and today I'll be welcoming back someone uniquely and supremely qualified to address them, Carissa Véliz. Interview Notes Carissa Véliz: https://www.carissaveliz.com/  Privacy is Power: https://www.carissaveliz.com/books  Carissa’s research: https://www.carissaveliz.com/research  Moral Zombies: https://link.springer.com/article/10.1007/s00146-021-01189-x  ChatGPT suicide: https://www.nytimes.com/2025/08/26/technology/chatgpt-openai-suicide.html  TESCREAL: https://en.wikipedia.org/wiki/TESCREAL  John Oliver on AI Slop: https://www.youtube.com/watch?v=TWpg1RmzAbc  Proton Lumo: https://proton.me/blog/lumo-ai  EU’s “public good” LLM: https://ethz.ch/en/news-and-events/eth-news/news/2025/07/a-language-model-built-for-the-public-good.html  Further Info My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support the mission: https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:00: Intro 0:05:09: What does "artifical intelligence" really mean? 0:13:21: Should STEM degrees require ethics training? 0:17:20: Does anthropomorphising AI undermine our discourse? 0:22:35: What is the TESCREAL view of AI? 0:28:09: Can we infuse AI tools with human morality? 0:34:31: What are the dangers of training AI on copyrighted works? 0:42:16: What happens when AI starts ingesting it's own output? 0:44:27: Can we make AI systems that are truly private? 0:48:08: How should we assign liability for AI harms? 0:51:06: Is AI eroding our ability to trust anything? 0:54:06: What happens when AI obviates the need to work at all? 1:00:00: How do we maximize the benefits and minimize the harms of AI? 1:03:20: Interview wrap-up 1:06:06: Patron podcast preview 1:07:08: Looking ahead

The next step in reducing our digital footprint is to identify all of our online accounts, including the long forgotten and unused ones. The easiest place to start is by using the tool we should already have: our password manager. By its very nature, it contains a list of all our accounts. You may have used your browser to remember your passwords, or you may have some other method... but it's time to move to a real password manager. In other news: update your Android devices ASAP; Android malware spreading via Facebook ads; Google to make it harder to sideload Android apps; dashcam company cloud storage hacked; Anthropic to train model based on your chats; OpenAI sharing some GPT chats with law enforcement; ChatGPT getting parental controls after teen suicide; Microsoft Word will auto-save to OneDrive; Chrome VPN extension caught taking screenshots of sites you visit; US tells BigTech not to comply with DSA; and Flock pauses work with federal agencies. Article Links This Android Malware Is Spreading Through Facebook Ads https://lifehacker.com/tech/this-android-malware-is-spreading-using-meta-ads Android Is Making It More Difficult to Sideload Apps https://lifehacker.com/tech/android-is-making-it-more-difficult-to-sideload-apps This Company Turns Dashcams into ‘Virtual CCTV Cameras.’ Then Hackers Got In https://www.404media.co/this-company-turns-dashcams-into-virtual-cctv-cameras-then-hackers-got-in/ Anthropic will start training its AI models on chat transcripts https://www.theverge.com/anthropic/767507/anthropic-user-data-consumers-ai-models-training-privacy People Are Furious That OpenAI Is Reporting ChatGPT Conversations to Law Enforcement https://futurism.com/people-furious-openai-reporting-police OpenAI announces parental controls for ChatGPT after teen suicide lawsuit https://arstechnica.com/ai/2025/09/openai-announces-parental-controls-for-chatgpt-after-teen-suicide-lawsuit/ Microsoft Word now autosaves to OneDrive. Is your data safe? https://proton.me/blog/microsoft-word-autosave-onedrive-default Chrome VPN Extension With 100k Installs Screenshots All Sites Users Visit https://cyberinsider.com/chrome-vpn-extension-with-100k-installs-screenshots-all-sites-users-visit/ Big Tech Companies in the US Have Been Told Not to Apply the Digital Services Act https://www.wired.com/story/big-tech-companies-in-the-us-have-been-told-not-to-apply-the-digital-services-act/ License-plate reader company pauses work with federal agencies after backlash https://therecord.media/flock-license-plate-reader-pauses-federal-work Tip of the Week: https://firewallsdontstopdragons.com/find-old-accounts-part-1/  Further Info Nexar CityStream live: https://livefeed.getnexar.com  My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Become a patron! https://fdsd.me/patron/ Give the gift of privacy and security: https://fdsd.me/coupons  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:00: Intro 0:01:10: Update your Android devices 0:01:41: News preview 0:03:38: Android malware spread via Facebook ads 0:06:49: Android is making it harder to sideload apps 0:12:16: "Virtual CCTV" dashcam company is hacked 0:18:01: Anthropic to train AI based on your chats 0:22:33: OpenAI sharing some GPT chats with law enforcement 0:26:46: OpenAI accounces parental controls after teen suicide 0:33:41: Microsoft Word now autosaves to OneDrive 0:40:36: Chrome VPN extension screenshots sites you visit 0:45:18: US tells BigTech not to comply with DSA 0:51:08: Flock pauses work with federal agencies 0:53:38: Tip of the Week 1:01:22: Patron podcast preview 1:01:55: Looking ahead

We take our cell phones with us everywhere - which makes them the perfect tracking device. Just walking around with your device will give your location away in multiple ways. But even if you had no apps on your phone, the cellular chips in our devices will constantly be interacting with every cell tower that's in range, negotiating the best tower to talk to, whether to use 5G or something else, and authenticating to the network - even in Airplane Mode. Cell site simulators (aka Stingrays or IMSI catchers) can be used to trick your phone into give away your location. The Electronic Frontier Foundation (EFF) has developed a cheap, easy-to-setup device that can try to discover and report these devices. Today I interview an expert panel about the clever Rayhunter project: Cooper Quintin, The Gibson, and OopsBagel. Interview Notes Rayhunter announcement: https://www.eff.org/deeplinks/2025/03/meet-rayhunter-new-open-source-tool-eff-detect-cellular-spying  EFF’s Rayhunter project: https://efforg.github.io/rayhunter/  Submitting logs to EFF: https://efforg.github.io/rayhunter/support-feedback-community.html  DEF CON talk on Rayhunter: https://spectra.video/w/jt9rZHCU51Rh58cBD8oiP3  Buy yourself an Orbic hotspot: https://www.ebay.com/sch/i.html?_nkw=orbic+rc400l  Gotta Catch ‘Em All: https://www.eff.org/wp/gotta-catch-em-all-understanding-how-imsi-catchers-exploit-cell-networks  iPhone/Android fake cell site protections: https://www.eff.org/deeplinks/2023/09/apple-and-google-are-introducing-new-ways-defeat-cell-site-simulators-it-enough  Meshtastic: https://meshtastic.org/docs/getting-started/  Veilid: https://veilid.com/  Further Info My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support the mission: https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Table of Contents 0:00:00: Intro 0:02:26: Interview setup 0:06:18: How did you become in involved with Rayhunter? 0:12:08: What is a cell site simulator? 0:14:01: What does a CSS look like and how are they deployed? 0:16:55: How is a CSS used for surveillance? 0:20:31: Can cell site simulaters work with modern protocols like 5G? 0:24:09: What information can you sniff from the cellular network? 0:27:41: Is there any transparency around the use of CSS's? 0:30:02: How did Rayhunter evolve from previous work? 0:35:00: How do I make a Rayhunter device? 0:41:45: I've create a Rayhunter... now what? 0:46:10: How can I protect myself against CSS surveillance? 0:49:38: Does Airplane Mode really disable your cellular radio? 0:52:22: How else might I defeat mass surveillance tech? 0:54:46: What's next for everyone? 1:00:53: Interview wrap-up 1:03:36: Meshtastic 1:04:49: Patron podcast preview 1:05:26: Looking ahead

The world wide web, as we know it today, has been around for over 30 years. In that time, most of us have created many dozens, perhaps hundreds, of online accounts. How many of those accounts are still alive somewhere? What data do they hold? And how good are the passwords you used? Today we're going to start on the path to finding all those accounts which could drastically improve our privacy and security. In the news: millions of Dell laptops have critical security flaws you need to patch now; Facebook may be secretly scanning your phone's images; National Public Data is back and you should delete your data; data brokers are flouting privacy laws; Ionic 5 owners in the UK will have to pay for a security fix; Flipper Zero devices are being (wrongly) blamed for auto thefts; the US Supreme Court allows Mississippi social media law to go into effect; data brokers are hiding their opt-out pages; app TeaOnHer exposed users' data; UK backs down from Apple backdoor demand; and now is the time for EU residents to speak out against Chat Control. Article Links Millions of Dell laptops hit by ‘critical’ security vulnerability https://www.pcworld.com/article/2870014/millions-of-dell-laptops-hit-by-critical-security-vulnerability.html Meta might be secretly scanning your phone's camera roll - how to check and turn it off https://www.zdnet.com/article/meta-might-be-secretly-scanning-your-phones-camera-roll-how-to-check-and-turn-it-off/ You Should Remove Your Info From the Rebooted National Public Data Site https://lifehacker.com/tech/remove-your-info-from-rebooted-national-public-data-site Data Brokers Are Ignoring Privacy Law. We Deserve Better. https://www.eff.org/deeplinks/2025/08/data-brokers-are-ignoring-privacy-law-we-deserve-better Hyundai wants Ioniq 5 owners to pay to fix a keyless entry security hole https://www.theverge.com/news/757205/hyundai-ioniq-5-security-upgrade-fix-game-boy-device-attacks Can Flipper Zero really steal your car? (Spoiler: NO) https://blog.flipper.net/can-flipper-zero-steal-your-car/ Supreme Court allows Mississippi social media law to go into effect https://www.npr.org/2025/08/14/nx-s1-5482925/scotus-netchoice Data Brokers Are Hiding Their Opt-Out Pages From Google Search https://www.wired.com/story/data-brokers-hiding-opt-out-pages-google-search/ How we found TeaOnHer spilling users' driver's licenses in less than 10 minutes | TechCrunch https://techcrunch.com/2025/08/13/how-we-found-teaonher-spilling-users-drivers-licenses-in-less-than-10-minutes/ UK blinks, backs down from its Apple backdoor encryption demand https://appleinsider.com/articles/25/08/19/uk-blinks-backs-down-from-its-apple-backdoor-encryption-demand Worried about Chat Control? This website can help you get your say https://www.techradar.com/computing/cyber-security/worried-about-chat-control-this-website-can-help-you-get-your-say Tip of the Week: Data Diet Introduction: https://firewallsdontstopdragons.com/data-diet-introduction/  Further Info Cory Doctorow on age verification: https://pluralistic.net/2025/08/14/bellovin/#wont-someone-think-of-the-cryptographers  Fight EU’s Chat Control: https://fightchatcontrol.eu/  My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support our mission! https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:00: Intro 0:01:37: News preview 0:05:00: Millions of Dell laptops hit by ‘critical’ security vulnerability 0:06:44: Meta might be secretly scanning your phone's camera roll 0:12:00: You Should Remove Your Info From National Public Data 0:15:39: Data Brokers Are Ignoring Privacy Law 0:19:06: Hyundai wants Ioniq 5 owners to pay for security fix 0:22:43: Can Flipper Zero really steal your car? (No.) 0:30:38: Supreme Court allows Mississippi social media law ...

Why don't we have meaningful privacy laws in the US? While we haven't been able to pass federal privacy legislation, many states have managed to pass laws protecting our data and establishing some basic privacy rights. Vermont House Representative Monique Priestley led a Herculean effort to pass privacy legislation in her state last year. While managing to get a solid bill through the House and Senate, the bill was ultimately vetoed by the governor and the Senate failed to override it. But along the way, Monique learned valuable lessons about dealing with Big Tech lobbyists. Today we'll follow the journey of the Vermont Data Privacy Act of 2024 and what lessons we should learn for future attempts at privacy legislation. Interview Notes Monique Priestley: https://mepriestley.com/  Vermont State Representative site: https://priestleyvt.com/  Vermont Committee Zoom call: https://www.youtube.com/watch?v=RfvAteuwRCA  Age Appropriate Design Code: https://epic.org/epic-applauds-passage-of-vermont-age-appropriate-design-code/  Big Tech Tried to Kill My State’s Privacy Bill. Here’s What I Learned. https://www.techpolicy.press/big-tech-tried-to-kill-my-states-privacy-bill-heres-what-i-learned/  The man quietly rewriting American privacy law https://www.politico.com/news/2024/09/17/andrew-kingman-data-privacy-lobbying-00179630  Further Info My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support the mission: https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:00: Intro 0:01:36: Interview setup 0:05:45: How did you get into privacy politics? 0:08:44: Who drafts the initial bill? 0:12:25: How are initial bills modified during this process? 0:17:08: When and how do lobbyists get involved? 0:22:34: Are lobbyists transparent about who they represent? 0:30:42: What are the most controversial elements of a privacy bill? 0:34:16: How are privacy laws limited by scope? 0:39:11: Why is the privacy right of action so important? 0:43:37: How do lobbyists kill privacy bills? 0:49:05: Do legislators collaborate across states? 0:55:19: How did the Vermont privacy bill get killed? 0:57:55: What are your key takeaways from this experience? 1:02:12: What's the current status of privacy legislation? 1:04:57: How can we help? 1:06:57: Wrap-up 1:09:38: Patron podcast preview 1:10:18: Looking ahead

It's early August, which means it's time for BSides Las Vegas and DEF CON, part of the trio of conferences that make up "hacker summer camp" (the other being Black Hat, which I don't attend). It's been a crazy, chaotic week - as usual - but in almost completely good ways. After the regular news, I've got some mini interviews with Jake Braun (DEF CON Franklin), Stacey Higginbotham (Consumer Reports), Cooper Quitin (EFF) and The Gibson (Veilid and hackers.town). In other news: Tea app users file a class action lawsuit over massive breach; ChatGPT sessions may be searchable by anyone; US government launches initiative to centralize health data for use by tech companies; Australia rolls out age verification for search engines; Grok AI is now in Teslas; China-backed hackers exploit horrific Microsoft bug; Dropbox ends its password manager service. Article Links Tea User Files Class Action After Women’s Safety App Exposes Data https://www.404media.co/tea-user-files-class-action-after-womens-safety-app-exposes-data/ ChatGPT users shocked to learn their chats were in Google search results https://arstechnica.com/tech-policy/2025/08/chatgpt-users-shocked-to-learn-their-chats-were-in-google-search-results/ Trump administration is launching a new private health tracking system with Big Tech's help https://apnews.com/article/trump-ai-rfk-jr-health-tech-fa73703bd1fd557c787ef0b590e151f1 Australia is quietly rolling out age checks for search engines like Google https://www.abc.net.au/news/2025-07-11/age-verification-search-engines/105516256 Grok is now in Tesla cars, but not in the way you think https://mashable.com/article/grok-tesla China-backed hackers used Microsoft flaw in attacks https://www.washingtonpost.com/technology/2025/07/21/china-hackers-microsoft-sharepoint/ Users left scrambling for a plan B as Dropbox drops Dropbox Passwords https://www.theregister.com/2025/07/30/dropbox_drops_dropbox_passwords/ Tip of the Week: https://firewallsdontstopdragons.com/how-to-backup-cloud-data/  Further Info Top hacker interviews: https://fdsd.me/hackers   DEF CON Franklin: https://defconfranklin.com/ EFF: https://www.eff.org/ Veilid: https://veilid.com/ Consumer Reports: https://securityplanner.consumerreports.org/ My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support our mission! https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:00: Intro 0:02:24: News preview 0:03:31: Tea User Files Class Action Lawsuit 0:06:24: ChatGPT users shocked to learn their chats were in Google search results 0:11:11: Trump administration is launching a new private health tracking system 0:17:52: Australia is quietly rolling out age checks for search engines 0:22:56: Grok is now in Tesla cars, but not in the way you think 0:25:29: China-backed hackers used Microsoft flaw in attacks 0:29:50: Dropbox drops Dropbox Passwords 0:32:20: Tip of the Week 0:36:27: Hacker Summer Camp Extras! 0:42:53: SNIPPET: Stacey Higginbotham 0:47:03: SNIPPET: Jack Braun 0:50:18: SNIPPET: Cooper Quintin and Gibson 0:55:04: Wrapup

Cory Doctorow has garnered a lot of needed attention to the decline of modern online platforms, including Google Search, Facebook and Twitter. Much of this is a result of coining the now-viral term Enshittification. Today we'll talk about how the internet was broken and who's to blame. We'll also discuss the lack of privacy laws and the threats of AI to tech workers and copyrighted works. Finally, we'll discuss Cory's novel proposal for how countries could respond to US tariffs by ripping up intellectual property agreements, changing the power dynamic of the Big Tech industry and hopefully benefiting consumers in the process. Interview Notes Cory’s blog (Pluralistic): https://pluralistic.net/  Canada shouldn't retaliate with US tariffs: https://pluralistic.net/2025/01/15/beauty-eh/#its-the-only-war-the-yankees-lost-except-for-vietnam-and-also-the-alamo-and-the-bay-of-ham  Who Broke the Internet? https://www.cbc.ca/listen/cbc-podcasts/1353-the-naked-emperor  Enshittification book (coming Oct 2025): https://us.macmillan.com/books/9780374619329/enshittification/  Regex: https://en.wikipedia.org/wiki/Regular_expression  Copyright and AI: https://www.technologyreview.com/2025/07/01/1119486/ai-copyright-meta-anthropic/  Further Info Humble Bundle: https://www.humblebundle.com/books/security-apress-books  My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support the mission: https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:00: Intro 0:02:07: Humble Bundle! 0:03:09: Interview preview 0:06:52: Has coining the term Enshittification helped to raise awareness? 0:11:08: Who broke the internet? 0:20:15: Will AI reduce tech workers' power? 0:27:21: Why can we not get privacy laws? 0:35:21: How should countries respond to US tariffs? 0:39:57: Do DRM protections incentize creators? 0:44:37: What's your take on the Anthropic AI copyright decision? 0:55:03: What's next for you? 0:56:04: Interview wrap-up 0:57:27: Hacker summer camp 0:59:28: Patron podcast preview 1:00:24: Looking ahead

We take our phones with us everywhere. And they contain, or have cloud access to, pretty much all of our personal information and online accounts. While phone makers have made it difficult for thieves to resell a stolen phone, anyone with physical access to your device may be able to extract its data or access all your accounts. Thankfully, Apple (iOS) and Google (Android) have recently introduced several features that can significantly increase your device's physical security and privacy. We'll discuss some of them today. In the news: VPN signups in UK spike after age verification law kicks in; Tea app data breach includes IDs; Amazon buys Bee AI wearable; your power meter is a surveillance tool; Amazon's Ring returns to sharing video with police; startup sells hacked data to debt collectors; Gemini AI on Android to get third party app access; Brave blocks Windows Recall; UK backs down on Apple back door; Apple to make passkeys portable; two new AI chatbots that are truly open and private. Article Links Proton VPN Signups in UK Surge 1,400% After Online Safety Act Comes Into Force https://cyberinsider.com/proton-vpn-signups-in-uk-surge-1400-after-online-safety-act-comes-into-force/ I Knew the Viral 'Tea' App Was Trouble, but I Didn't Expect a Data Breach https://lifehacker.com/tech/i-knew-the-viral-tea-app-was-trouble-but-i-didnt-expect-a-data-breach  Amazon buys Bee AI wearable that listens to everything you say https://www.theverge.com/news/711621/amazon-bee-ai-wearable-acquisition When Your Power Meter Becomes a Tool of Mass Surveillance https://www.eff.org/deeplinks/2025/07/when-your-power-meter-becomes-tool-mass-surveillance Amazon's Ring goes full founder mode, taking the company back to its crime-fighting roots https://www.businessinsider.com/amazon-ring-founder-mode-jamie-siminoff-crime-fighting-roots-2025-7 A Startup is Selling Data Hacked from Peoples’ Computers to Debt Collectors https://www.404media.co/a-startup-is-selling-data-hacked-from-peoples-computers-to-debt-collectors/ Unless users take action, Android will let Gemini access third-party apps https://arstechnica.com/security/2025/07/unless-users-take-action-android-will-let-gemini-access-third-party-apps/ Brave blocks Windows Recall from screenshotting your browsing activity https://www.bleepingcomputer.com/news/security/brave-blocks-windows-recall-from-screenshotting-your-browsing-activity/ UK backing down on Apple encryption backdoor after pressure from US https://arstechnica.com/tech-policy/2025/07/uk-backing-down-on-apple-encryption-backdoor-after-pressure-from-us/ Passkey portability is finally here in iOS 26 and macOS Tahoe 26 https://9to5mac.com/2025/07/12/passkey-portability-is-finally-here-in-ios-26-and-macos-tahoe-26/ Introducing Lumo, the AI where every conversation is confidential https://proton.me/blog/lumo-ai A language model built for the public good https://ethz.ch/en/news-and-events/eth-news/news/2025/07/a-language-model-built-for-the-public-good.html Tip of the Week: https://firewallsdontstopdragons.com/physical-phone-security/  Further Info Hacker Plants Computer 'Wiping' Commands in Amazon's AI Coding Agent https://www.404media.co/hacker-plants-computer-wiping-commands-in-amazons-ai-coding-agent/  My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support our mission! https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch Table of Contents 0:00:00: Intro 0:00:47: DEF CON update 0:01:47: News preview 0:04:06: Proton VPN use surges in UK 0:08:13: Data breach at viral Tea app 0:19:36: Amazon buys Bee AI wearable 0:26:47: Using power meters for surveillance 0:30:48: Ring again sharing video with police 0:34:57: Startup selling hacked data to debt collectors 0:42:29: Android lets Gemini access 3rd party apps

We talk a lot about digital or online security. Today we're going to focus on physical security and the general ethos of "be prepared". There are many situations in life when you will find yourself wishing you had had the foresight to acquire certain things or establish certain professional relationships before you actually needed them. Deviant Ollam is a physical penetration specialist. His job is to find and fix weaknesses in physical things... buildings, locks, safes, etc. And along the way he has learned some important lessons for all of us. Today he will share his wisdom with us. Interview Notes Deviant’s website: https://deviating.net/  Lawyer,Passport, Locksmith, Gun talk: https://www.youtube.com/watch?v=6ihrGNGesfI  Attacking Classified Safes & Vaults: https://www.youtube.com/watch?v=-Z_Jv7vuiqg  Red Team Alliance: https://shop.redteamalliance.com/  Red Team Tools: https://www.redteamtools.com/  CackalackyCon: https://www.cackalackycon.org/  Shut the F**k Up PSA: https://www.youtube.com/watch?v=nWEpW6KOZDs  Home lock - Schlage Primus: https://commercial.schlage.com/en/products/key-systems/primus-security-upgrade.html  Padlock - Pacific Lock (PACLOCK): https://paclock.com/  Further Info My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support the mission: https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:00: Intro 0:04:27: What is a physical entry specialist? 0:08:47: How would you describe the prepper ethos? 0:12:21: What are common mistakes for disaster prep? 0:15:52: What should everyone have a passport? 0:20:32: Why should everyone have an established lawyer? 0:28:55: What other professionals should I have at the ready? 0:34:09: What locks should I use or avoid? 0:40:39: Do any movies and TV shows portray lock picking correctly? 0:43:36: What is 'responsible disclosure' like for physical vulnerabilities? 0:47:44: Do you tell companies when you stumble on physical vulnerabilities? 0:51:41: What documents should we have physical copies of? 0:55:27: If I'm politically active, how can I minimize my digital footprint? 0:59:10: Why should we use secure, private communications? 1:02:34: What's next for you? 1:06:05: Wrap-up 1:08:45: Patron podcast preview

Your cell phone number uniquely identifies you. Many companies rely on this 1-to-1 relationship to authenticate you to their systems. So if someone were to somehow manage to steal your mobile phone number - a hack called SIM swapping - they could use that to impersonate you and compromise any of your accounts that are validated via SMS or phone call. There's a new tool to combat this scam that's better than the old-style account PIN codes. I'll explain how it works. In the news: many Brother printers have serious cyber vulnerabilities; Belkin in abandoning Wemo smart devices next January; Xfinity's WiFi routers can detect motion in your entire home; Bluesky is rolling out age verification in the UK; California is using drones to catch the use of illegal fireworks; McDonald's AI hiring bot was hacked to expose millions of applicants' data; Mexican drug cartel hacked FBI phone to catch informants; US strikes blow against North Korean fake worker scams; Denmark is looking to ditch Microsoft products. Article Links New Vulnerabilities Expose Millions of Brother Printers to Hacking https://www.securityweek.com/new-vulnerabilities-expose-millions-of-brother-printers-to-hacking/  Belkin pulls the plug on Wemo smart home products which will stop working in 2026 https://9to5google.com/2025/07/10/belkin-wemo-smart-home-shutdown-list/  Using WiFi Motion in the Xfinity app https://www.xfinity.com/support/articles/wifi-motion  Bluesky is rolling out age verification in the UK https://www.theverge.com/news/704468/bluesky-age-verification-uk-online-safety-act  Huge fines coming for Californians caught by drone with illegal fireworks https://www.sfgate.com/bayarea/article/california-drones-illegal-fireworks-20629637.php  McDonald’s AI Hiring Bot Exposed Millions of Applicants’ Data https://www.wired.com/story/mcdonalds-ai-hiring-chat-bot-paradoxai/  Drug cartel hacked FBI official’s phone to track and kill informants https://arstechnica.com/security/2025/06/mexican-drug-cartel-hacked-fbi-officials-phone-to-track-informant-report-says/  Identities of More Than 80 Americans Stolen for North Korean IT Worker Scams https://www.wired.com/story/identities-of-80-plus-americans-stolen-for-north-korean-it-worker-scams/  Why Denmark is dumping Microsoft Office and Windows for LibreOffice and Linux https://www.zdnet.com/article/why-denmark-is-dumping-microsoft-office-and-windows-for-libreoffice-and-linux/  Tip of the Week: https://firewallsdontstopdragons.com/freezing-your-mobile-account/  Further Info Tom’s Hardware on WiFi Motion: https://www.tomshardware.com/networking/routers/new-xfinity-router-motion-detecting-feature-stokes-privacy-fears-feature-powered-by-wi-fi-signals  RockYou password list: https://cybernews.com/security/rockyou2024-largest-password-compilation-leak/  LibreOffice: https://www.libreoffice.org/discover/libreoffice/  Eurostack: https://eurostack.eu/  Running Linux in a VM on Windows: https://itsfoss.com/install-linux-mint-in-virtualbox/  Age verification: https://www.privacyguides.org/articles/2025/05/06/age-verification-wants-your-face/  My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support our mission! https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:00: Intro 0:00:17: DEF CON coming up fast 0:03:34: News preview 0:06:31: New Vulnerabilities Expose Millions of Brother Printers to Hacking 0:11:51: Belkin pulls the plug on Wemo smart home products 0:14:25: Using WiFi Motion in the Xfinity app 0:21:19: Bluesky is rolling out age verification in the UK 0:26:49: Huge fines coming for Californians caught by drone with illegal fireworks 0:29:36: McDonald’s AI Hiring Bot Exposed Millions of Applicants’ Data 0:35:31: Drug cartel hacked FBI official’s phone to track and k...

Privacy risks are bad enough for adults - but it's much worse for our kids, particularly as students. Who provides notice and obtains consent for minors at school? In many cases it's not the parents, let alone the students - it's the school system. Not only are they opting the students into invasive data collection by profit-driven third parties, but they often also bind them to mandatory arbitration clauses, neutering their ability to seek legal redress for the inevitable violations. Today I'll discuss this horrid state of affairs with someone who is on the front lines of this battle for our children's right to privacy: co-founder of the EdTech Law Center, Andy Liddell. Interview Notes EdTech Law Center: https://edtech.law/about-us/  EdTech current cases: https://edtech.law/cases/  Internet Safety Labs: https://internetsafetylabs.org/  The Right to Oblivion (book): https://www.hup.harvard.edu/books/9780674260528  ACLU, Digital Dystopia: https://www.aclu.org/publications/digital-dystopia-the-danger-in-buying-what-the-edtech-surveillance-industry-is-selling  The Markup, College Prep Software Naviance Is Selling Advertising Access to Millions of Students: https://themarkup.org/machine-learning/2022/01/13/college-prep-software-naviance-is-selling-advertising-access-to-millions-of-students  Proton blog on EdTech and privacy: https://proton.me/blog/ed-tech-trackers  Further Info My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support the mission: https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:00: Intro 0:02:48: What's your mission at the EdTech Law Center? 0:05:20: What are the unique privacy threats for students? 0:09:46: What privacy laws are there for minors? 0:12:05: How are these laws enforced and litigated? 0:18:21: How does notice and consent work for students? 0:27:05: What rights do the kids have in these situations? 0:29:38: How are these EdTech companies? 0:31:40: Which apps and tools are most problematic and why? 0:37:20: Should minors's data be deleted when they reach adulthood? 0:40:15: Are school systems equipped to understand these contracts? 0:42:35: What about privacy issues with EdTech hardware? 0:45:50: What have we already learned via discovery or reporting? 0:50:01: As a parent, who do I talk to about my child's privacy risks at school? 0:54:16: What are some red flags to look out for? 0:57:10: What responsibilities do school systems have here? 1:00:57: So what can we do? When should we reach out to you? 1:05:02: Interview follow-up 1:06:26: Patron podcast preview 1:07:19: Looking ahead

Do you realize that you're not always using your chosen mobile web browser or your network privacy features? Many mobile apps have their own in-app browser that can gather your data and even inject ads and trackers into any web links you click. I'll explain how this works and what you can do about it. In the news: 23andMe bankruptcy ombudsman argues for user consent to data; Meta AI app privacy nightmare; Amazon, Roku sharing users for ads; WhatsApp launches in-app ads; healthcare sites are sharing your data; ICE seeks powerful new surveillance tool; Austrian government wants your encrypted data; new US visa rules require social media posts; Scattered Spider targeting insurance info; VT governor signs child data privacy law; Flock blocks access to some US states; Microsoft offers 1-year security updates for Win10 users; new Android 16 security features; Denmark's answer to deepfakes; cleaner Google search results; ChatGPT user info reports. Article Links [therecord.media] 23andMe privacy ombudsman recommends company obtains consent for sale of customer data https://therecord.media/23andme-privacy-ombudsman-recommends-consent-sale [techcrunch.com] The Meta AI app is a privacy disaster https://techcrunch.com/2025/06/12/the-meta-ai-app-is-a-privacy-disaster/ [variety.com] Amazon, Roku Strike Deal to Pool Connected-TV Audiences for Advertisers https://variety.com/2025/tv/news/amazon-roku-pool-connected-tv-audiences-advertising-deal-1236432579/ [9to5mac.com] WhatsApp just launched ads for all users https://9to5mac.com/2025/06/16/whatsapp-just-launched-ads-for-all-users-here-are-the-details/ [The Markup] This Is How You Stop Data Trackers From Sucking up Your Health Data https://themarkup.org/the-breakdown/2025/06/17/this-is-how-you-stop-data-trackers-from-sucking-up-your-health-data [fedscoop.com] ICE seeks proprietary data and tech to monitor up to a million people  https://fedscoop.com/ice-seeks-proprietary-data-and-tech-to-monitor-up-to-a-million-people/ [reuters.com] Austrian government agrees on plan to allow monitoring of secure messaging https://www.reuters.com/world/austrian-government-agrees-plan-allow-monitoring-secure-messaging-2025-06-18/ [The Hacker News] New U.S. Visa Rule Requires Applicants to Set Social Media Account Privacy to Public https://thehackernews.com/2025/06/new-us-visa-rule-requires-applicants-to.html [therecord.media] Scattered Spider hackers targeting insurance industry following retail hits, Google warns https://therecord.media/scattered-spider-targeting-insurance-sector-following-retail-attacks [epic.org] EPIC Applauds Vermont Governor Phil Scott for Signing Age-Appropriate Design Code into Law https://epic.org/epic-applauds-vermont-governor-phil-scott-for-signing-age-appropriate-design-code-into-law/ [404media.co] Flock Removes States From National Lookup Tool After ICE and Abortion Searches Revealed https://www.404media.co/flock-removes-states-from-national-lookup-tool-after-ice-and-abortion-searches-revealed/ [techradar.com] Windows 10 users who don’t want to upgrade to Windows 11 get new lifeline from Microsoft https://www.techradar.com/computing/windows/windows-10-users-who-dont-want-to-upgrade-to-windows-11-get-new-lifeline-from-microsoft [androidauthority.com] Android 16 introduces Advanced Protection mode to fortify your phone against threats https://www.androidauthority.com/android-16-advanced-protection-mode-2-3566064/ [theguardian.com] Denmark to tackle deepfakes by giving people copyright to their own features https://www.theguardian.com/technology/2025/jun/27/deepfakes-denmark-copyright-law-artificial-intelligence [tedium.co] Does One Line Fix Google? https://tedium.co/2024/05/17/google-web-search-make-default/ [schneier.com] What LLMs Know About Their Users https://www.schneier.com/blog/archives/2025/06/what-llms-know-about-their-users.html Tip of the Week: https://firewallsdontstopdragons.com/the-in-app-switcheroo/

On January 12th, 2025, the ShmooCon hacker conference held it's 20th and final gathering. I was lucky enough to be able to not only attend the final show but also to interview the founders, Heidi and Bruce Potter. We talk about how it all got started, what made this hacker con so special and beloved, and hear some hilarious stories from the past twenty years of hacker shenanigans in Washington D.C. Interview Notes ShmooCon: https://www.shmoocon.org/  ShmooCon 2025 sessions: https://www.youtube.com/playlist?list=PLnKSfJ5rXw95HSPVl5L7dqhKpVAx3q_j0  Turngate: https://www.turngate.io/  HOPE conference: https://www.hope.net/  BSides: https://bsides.org/  Cackalackycon: https://cackalackycon.org/  Thotcon: https://www.thotcon.org/  SummerCon: https://www.summercon.org/  PancakesCon: https://pancakescon.com/  Further Info My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support the mission: https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Recommend news stories: send to news [at] firewallsdontstopdragons.com  Send me your questions! https://fdsd.me/qna  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:00: Intro 0:03:43: How and why did you start ShmooCon? 0:11:05: Why are hacker conferences so different from regular trade shows? 0:17:19: Why limit attendence and how did this give rise to LobbyCon? 0:21:52: What makes a good con? What's your post-con recovery like? 0:27:26: Why did you decide to end the con? 0:29:54: How have other cons influenced ShmooCon? 0:33:16: Why is it important to be so transparent about your con? 0:37:38: What are your favorite ShmooCon stories? 0:44:54: What's it like running a conference as a married couple? 0:49:39: What are you most proud of with ShmooCon? 0:52:13: Was there anything you wish you had done but didn't? 0:56:07: Did you ever consider handing ShmooCon off to someone else? 0:58:13: So what now? 1:00:58: What are some ShmooCon alternatives? 1:06:36: Wrap-up 1:08:07: Attend a hacker con! 1:09:35: Patron bonus preview 1:10:24: Looking ahead

Artificial Intelligence is taking over. But I don't mean that in a Skynet kinda way. It's simply becoming ubiquitous because companies are insisting on inserting the technology into all their products, even if it's not useful - or not even safe. Unfortunately, the breathless reporting on dangers of AI is also getting way out of hand, including stories of AI systems 'blackmailing' their designers. Today I'll try to bring us back to reality a bit. Also in the news: Billions of session login cookies up for grabs; Meta and Yandex cheat in order to track you around the web; Qualcomm fixes three zero-day bugs being actively exploited; Apple releases transparency report on push notification data requests; LAPD using Waymo for gathering video evidence; another massive AT&T user data leak includes SSNs; AI system appears to try to blackmail its owner; judge grants preliminary injunction on DOGE data grab; and we'll check in on your 2025 New Year's Resolutions! Article Links [theregister.com] Billions of cookies up for grabs as experts warn over session security https://www.theregister.com/2025/05/29/billions_of_cookies_available/ [arstechnica.com] Meta and Yandex are de-anonymizing Android users’ web browsing identifiers https://arstechnica.com/security/2025/06/meta-and-yandex-are-de-anonymizing-android-users-web-browsing-identifiers/ More info: https://www.zeropartydata.es/p/localhost-tracking-explained-it-could   [techcrunch.com] Phone chipmaker Qualcomm fixes three zero-days exploited by hackers https://techcrunch.com/2025/06/03/phone-chipmaker-qualcomm-fixes-three-zero-days-exploited-by-hackers/ [404media.co] Apple Gave Governments Data on Thousands of Push Notifications https://www.404media.co/apple-gave-governments-data-on-thousands-of-push-notifications/ [404media.co] LAPD Publishes Crime Footage It Got From a Waymo Driverless Car https://www.404media.co/lapd-publishes-crime-footage-it-got-from-a-waymo-driverless-car/ [cyberinsider.com] AT&T Investigating New Leak of 86 Million Customer Records with Decrypted SSNs https://cyberinsider.com/att-investigating-new-leak-of-86-million-customer-records-with-decrypted-ssns/ [bbc.com] AI system resorts to blackmail if told it will be removed https://www.bbc.com/news/articles/cpqeng9d20go [eff.org] Privacy Victory! Judge Grants Preliminary Injunction in OPM/DOGE Lawsuit https://www.eff.org/press/releases/privacy-victory-judge-grants-preliminary-injunction-opmdoge-lawsuit Tip of the Week: https://firewallsdontstopdragons.com/2025-resolutions-check-in/  Further Info 2025 New Year’s Resolutions: https://firewallsdontstopdragons.com/new-years-resolutions-2025/  Privacy Guides: https://www.privacyguides.org/articles/  EFF’s Rayhunter project: https://www.eff.org/deeplinks/2025/03/meet-rayhunter-new-open-source-tool-eff-detect-cellular-spying  My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support our mission! https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Send me your questions! https://fdsd.me/qna  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:00: Intro 0:00:50: A note on protest privacy 0:04:32: News preview 0:06:43: Billions of cookies up for grabs as experts warn over session security 0:18:27: Meta and Yandex are de-anonymizing Android users’ web browsing identifiers 0:25:59: Phone chipmaker Qualcomm fixes three zero-days exploited by hackers 0:27:51: Apple Gave Governments Data on Thousands of Push Notifications 0:33:25: LAPD Publishes Crime Footage It Got From a Waymo Driverless Car 0:37:39: AT&T Investigating New Leak of 86 Million Customer Records with Decrypted SSNs 0:41:51: AI system resorts to blackmail if told it will be removed 0:51:40: Privacy Victory! Judge Grants Preliminary Injunction in OPM/DOGE Lawsuit 0:56:04: Tip of the Week 0:58:13: Wrapup

Debbie Reynolds (aka, The Data Diva) has been working in the privacy realm for many years, as a privacy consultant, speaker, advisor and podcaster. She and I have been running in the same circles on LinkedIn for a while now, and we finally decided it was time to be a guest on each other's shows. Today Debbie and I will discuss the dangers of privacy in the realm of IoT devices (including her contributions on the US Department of Commerce's IoT Advisory Board), vehicles, and AI. I'll ask about her experiences advising corporations on privacy issues with emerging technologies and how she advocates for less data gathering and more transparency. Interview Notes Debbie Reynolds consulting: https://www.debbiereynoldsconsulting.com/  Data Diva podcast: https://www.debbiereynoldsconsulting.com/podcast  My interview on Debbie’s podcast: https://www.debbiereynoldsconsulting.com/podcast/e228-carey-parker  The Right to Privacy book (1995): https://www.amazon.com/Right-Privacy-Caroline-Kennedy/dp/0679419861  IoT Advisory Board report: https://www.debbiereynoldsconsulting.com/iot-advisory-board  Shodan search: https://www.shodan.io/  Further Info My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support the mission: https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Send me your questions! https://fdsd.me/qna  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:00: Intro 0:01:27: During your privacy career, how have privacy changed? 0:05:59: How do you define privacy? 0:08:51: What were your contributions on the IoT Advisory Board? 0:12:54: Who was the primary audience for that report? 0:15:49: Which IoT devices have the worst privacy? 0:19:33: How bad are modern cars in terms of privacy? 0:29:50: How does AI threaten our privacy today? 0:33:30: How can we mitigate AI privacy risks? 0:40:11: How can we convince companies to truly embrace user privacy? 0:45:36: What are some of the biggest privacy mistakes companies make? 0:49:34: Why can't we have a global tracking opt-out signal? 0:53:52: What can we learn from the EU's GDPR? 0:58:35: So what can we do to improve our privacy? 1:00:50: Patron preview 1:01:21: Looking ahead

Tracking our faces and whereabouts is getting out of control. It's a mass surveillance infrastructure that keeps growing in Borg-like fashion. Facial recognition and license plate readers are proliferating at a stupefying pace and companies like Flock are consolidating the collected data and packaging it up for sale to law enforcement agencies. Even if no human in these agencies were to abuse this data, it's creating an irresistible target for scheming hackers and nation states keen on espionage. The longer we let this go, the harder it will be to stop. In today's news: Asus routers are being hacked and you need to take action; 23andMe has been sold, along with its users' genetic data; AI-generated videos have just become way more realistic; US government taps surveillance company to centralize all its citizen data; CFPB regulation limiting data brokers is axed; Kroger is packaging and selling its customer loyalty data; automated license plate reader data use is expanding in scary ways; Android phones gain key new security feature; EU court rules that real-time bidding data gathering is illegal; Montana is first state to plug data broker loophole; and I relate my recent privacy experience at the US border. Article Links [LifeHacker.com] If You Have an Asus Router, You Need to Check If It's Been Hacked https://lifehacker.com/tech/asus-routers-hacked  [404media.co] 23andMe Sale Shows Your Genetic Data Is Worth $17 https://www.404media.co/23andme-sale-shows-your-genetic-data-is-worth-17/ [lifehacker.com] You Are Not Prepared for This Terrifying New Wave of AI-Generated Videos https://lifehacker.com/tech/you-are-not-prepared-for-this-new-wave-of-ai-generated-videos [nytimes.com] Trump Taps Palantir to Compile Data on Americans https://www.nytimes.com/2025/05/30/technology/trump-palantir-data-americans.html [techcrunch.com] White House scraps plan to block data brokers from selling Americans’ sensitive data https://techcrunch.com/2025/05/14/white-house-scraps-plan-to-block-data-brokers-from-selling-americans-sensitive-data/ [therecord.media] Consumer Reports: Kroger using loyalty program to package, sell customer data https://therecord.media/kroger-using-loyalty-program-to-sell-customer-data [404media.co] A Texas Cop Searched License Plate Cameras Nationwide for a Woman Who Got an Abortion https://www.404media.co/a-texas-cop-searched-license-plate-cameras-nationwide-for-a-woman-who-got-an-abortion/ [404media.co] License Plate Reader Company Flock Is Building a Massive People Lookup Tool, Leak Shows https://www.404media.co/license-plate-reader-company-flock-is-building-a-massive-people-lookup-tool-leak-shows/ [arstechnica.com] Android phones will soon reboot themselves after sitting unused for 3 days https://arstechnica.com/gadgets/2025/04/android-phones-will-soon-reboot-themselves-after-sitting-unused-for-3-days/ [signal.org] By Default, Signal Doesn't Recall https://signal.org/blog/signal-doesnt-recall/ [therecord.media] EU court rules that tracking-based online ads are illegal https://therecord.media/eu-court-rules-tracking-based-ads-illegal [eff.org] Montana Becomes First State to Close the Law Enforcement Data Broker Loophole https://www.eff.org/deeplinks/2025/05/montana-becomes-first-state-close-law-enforcement-data-broker-loophole Tip of the Week: https://firewallsdontstopdragons.com/border-insecurity-update/  The Atlantic: How to Disappear https://www.theatlantic.com/ideas/archive/2025/05/extreme-personal-data-privacy-protection/682867/  BADBOOL data removal service list: https://docs.google.com/spreadsheets/d/115L6LpQg_UX638IyUfdwGhRS7dIU3lKwz6fjAcDtE-0/edit?gid=0#gid=0  Further Info My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support our mission! https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Recommend news stories: send to news [at] firewallsdontstopdragons.com

VPNs were not invented for privacy, despite the name - they were invented for security. Nevertheless, in recent years, they have been touted as privacy tools to thwart rampant and fanatical data gathering. With a regular VPN, this really just means you're shifting your trust from your internet service provider to your VPN provider. But what if your encrypted data traffic was actually divided between two separate companies? The split trust model is a powerful way to protect your privacy and it's the key technology behind new services like Apple's Private Relay and Obscura VPN. Today we'll discuss the benefits of this approach with Obscura's founder, Carl Dong. Interview Notes Obscura VPN: https://obscura.net/ Wireguard: https://en.wikipedia.org/wiki/WireGuard  Obscura Wireguard configuration tool: https://obscura.net/#faq-wireguard-config  QUIC explainer video: https://www.youtube.com/watch?v=HnDsMehSSY4  Masque: https://datatracker.ietf.org/wg/masque/about/  Privacy Pass: https://privacypass.github.io/  Anubis: https://anubis.techaro.lol/docs/design/how-anubis-works/  How Onion Routing Works: https://firewallsdontstopdragons.com/how-onion-routing-works/  Further Info My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support the mission: https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Recommend news stories: send to news [at] firewallsdontstopdragons.com  Send me your questions! https://fdsd.me/qna  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:00: Intro 0:01:16: Interview setup 0:04:46: Lingo definitions 0:09:48: Why do we need yet another VPN? 0:15:00: How does Obscura differ from Apple Private Relay and Tor? 0:21:59: How little info can you give to set up an Obscura account? 0:25:33: What is the Bitcoin Lightning Network? 0:27:30: How can we know how much logging a VPN provider is doing? 0:35:04: Does Obscura have the same quirks as regular VPNs? 0:42:10: How vulnerable are you to being taken down by governments? 0:46:11: What are the core technologies in Obscura? 0:50:49: What do you think about Safing's IP-per-connection idea? 0:54:00: Are you planning to expand your partner VPNs? 0:56:41: How does Obscura handle the TunnelVision problem? 0:59:57: What is the roadmap for supporting other operating systems? 1:03:14: What's next for Obscura? 1:04:32: Interview wrap-up 1:09:19: Patron podcast preview 1:09:50: Looking ahead

There are way too many messenger apps today. It's a sad state of affairs and I don't see it getting better anytime soon. But the real problem (for me) is that almost all of the popular messenger apps aren't really that secure and private. Most do not have end-to-end encryption (E2EE) at all or it's not turned on by default. And frankly even the apps with E2EE are run by companies whose revenue model is based on monetizing your personal data. I'm going to suggest you try Signal. In other news: study finds Canadian's health data being sold to drug makers; DOGE worker's computer has been hacked; airlines are selling your data to ICE; a massive proxy botnet has been shut down; Google pays $1.4B to Texas over unauthorized tracking and data collection; Denver decides to stop using license plate readers of privacy concerns; jury orders NSO Group to pay hundreds of millions of dollars for hacking WhatsApp users. Article Links [cbc.ca] Millions of Canadians' health data available for sale to pharmaceutical industry, study shows https://www.cbc.ca/news/health/health-data-records-pharmaceutical-private-clinics-1.7529955 [micahflee.com] DOGE bro Kyle Schutt's computer infected by malware, credentials found in stealer logs https://micahflee.com/doge-bro-kyle-schutts-computer-infected-by-malware-credentials-found-in-stealer-logs/ [jacobin.com] Airlines Are Selling Your Data to ICE https://jacobin.com/2025/05/airlines-data-ice-trump-immigration/ [The Hacker News] BREAKING: 7,000-Device Proxy Botnet Using IoT, EoL Systems Dismantled in U.S. - Dutch Operation https://thehackernews.com/2025/05/breaking-7000-device-proxy-botnet-using.html [The Hacker News] Google Pays $1.375 Billion to Texas Over Unauthorized Tracking and Biometric Data Collection https://thehackernews.com/2025/05/google-pays-1375-billion-to-texas-over.html [9news.com] Denver will stop using license plate reader cameras amid privacy worries https://www.9news.com/article/news/local/local-politics/license-plate-reader-camera-data-security-concerns/73-9c570252-9d1c-4e5c-b042-c12392aa1081 [arstechnica.com] Jury orders NSO to pay $167 million for hacking WhatsApp users https://arstechnica.com/security/2025/05/jury-orders-nso-to-pay-167-million-for-hacking-whatsapp-users/ Tip of the Week: Slay Snoopers: https://firewallsdontstopdragons.com/dragon-hacks-slay-snoopers/  Further Info My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support our mission! https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Recommend news stories: send to news [at] firewallsdontstopdragons.com  Send me your questions! https://fdsd.me/qna  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:00: Intro 0:00:43: News preview 0:02:53: Millions of Canadians' health data available for sale to pharmaceutical industry 0:08:39: DOGE engineer's computer infected by malware 0:14:38: Airlines Are Selling Your Data to ICE 0:22:05: 7,000-Device Proxy Botnet Using IoT, EoL Systems Dismantled in US, Dutch Operation 0:28:04: Google Pays $1.375 Billion to Texas Over Unauthorized Tracking and Biometric Data Collection 0:30:21: Denver will stop using license plate reader cameras amid privacy worries 0:34:54: Jury orders NSO to pay $167 million for hacking WhatsApp users 0:39:17: Tip of the Week: Slay Snoopers 0:44:31: Wrap-up