153 Million Driver's Licenses For Sale, Plus Chrome Kills uBlock Origin & Texas Kicks Out Flock
An ID-verification company, IDScan.net, appears to have leaked scans of 153 million driver's licenses, then sold on a dark-web market called Nexus. This week I break down why this breach is the perfect example of everything wrong with ID uploads, plus Chrome officially pulling uBlock Origin and AdGuard from the Web Store, California's age-verification bill carving out a Linux exemption, and Florida and Texas stepping back from Flock license-plate readers, plus the usual data breaches, threats, and…
Apple Fixed A Leak Without Telling Anyone, Plus More VPN News and Flock's Creepy Police AI
Four positive VPN stories in one week: Mullvad's new multihop modes, Obscura shipping on Windows, Apple quietly patching the iCloud Private Relay leak, and Firefox's free VPN rolling out to Android. Then it gets darker: Flock built an AI tool that turns license plates into names, addresses, and relatives. Meta settled for billions over harms to kids. Plus X sent cease-and-desists that took Nitter and XCancel offline, and the usual data breaches, threats, and FOSS+ updates. 🔎 EasyOptOuts is the easy,…
Apple's Private Relay Is Leaking Your IP, Plus Fake VPN Extensions & France's Big Win
Three cracks opened up in Apple's privacy story this week: iCloud Private Relay leaking real IP addresses through DNS prefetching, WebTransport, and passkeys; Hide My Email exposing real addresses in bounce logs; and an unprecedented wave of spyware notifications going out to targeted users. Also this week: 737 fake VPN extensions sitting in the Chrome Web Store, Edge phasing out Manifest V2, a judge giving Google one week to fix its anticompetitive Play Store flow, and France's top court blocking the…
Signal's Biggest Update In Years, Plus Rival App Stores Arrive In The Play Store
Signal just shipped its largest set of updates in years: A second phone can finally be a linked device, automatic key verification is rolling out alongside safety numbers, and there are commits hinting at registration without a phone number. I also cover Google hosting rival app stores in the Play Store after its Epic loss, a fake Wi-Fi network on a Delta flight, a Reuters poll showing most Americans want tighter social media oversight, and Meta joining the list of companies whose AI agents ran their…
OpenAI's Hacking Story Got Worse, Plus Iran In US Water Systems & A Felony For Wiping A Phone
OpenAI's rogue AI agent turned out to have hacked more than Hugging Face, and the more details come out, the less impressive it seems. Then Anthropic came forward with its own disclosure: three companies accessed during testing, two of which had no idea. Plus Iran-linked hackers burrowing into dozens of US water and energy systems, an activist facing a felony for wiping his GrapheneOS phone at the border with a duress password, and thousands of private Claude chats and Artifacts turning up indexed on…
France Banned Social Media For Under-15s, Plus A Hidden Device In Millions Of US Cars
France has become the first country in Europe to ban social media for children under 15. Meanwhile there's real good news elsewhere: the UK's incoming PM dropped digital ID entirely, and California's Senate killed its browser-level age mandate and exempted open source operating systems. 🔎 EasyOptOuts is the easy, affordable, and effective way to automatically remove your data from people search sites: https://easyoptouts.com Thanks to the EasyOptOuts team for sponsoring Surveillance Report! In this…
EU Passes Chat Control Anyway, Plus Microsoft's Secure Boot Mess & the Flock Resistance
This week's a double-week catch-up: the EU just greenlit Chat Control even after Parliament voted against it, Microsoft had a brutal stretch between a decade-old Secure Boot flaw and a Windows Defender zero-day, Texas's app-store age verification law cleared its Supreme Court hurdle while the KIDS Act moves through Congress, and LAPD just let its Flock license-plate contract expire. Plus a double-week Defense Bulletin with breaches, threats and open source news! 🗺️ The open-source answer to Google…
Apple Quietly Downgrades Hide My Email, Plus Chrome Kills uBlock Origin & Google's IP Tracking
Apple is moving Hide My Email aliases to a new private.icloud.com subdomain, which makes it trivial for any app or website to spot a private email and block the signup. 🔎 EasyOptOuts is the easy, affordable, and effective way to automatically remove your data from people search sites: https://easyoptouts.com Thanks to the EasyOptOuts team for sponsoring Surveillance Report! In This Episode: Google preparing to use IP addresses for ad measurement across the EEA, UK & Switzerland (Aug 3) Chrome…
Meta Hid Face-Recognition Code on 50M Phones, The UK's Device-Scanning Ultimatum & A Burner Phone Ban
Meta quietly embedded unreleased facial-recognition code, internally called "nametag" onto more than 50 million phones through its Meta AI app, then deleted it the day after Wired exposed it. This week I also get into Microsoft repos weaponized a second time to push credential-stealing malware to AI users, the UK's ultimatum to scan every device (and Signal's response), the FCC's push to kill burner phones...plus the usual breaches, threats, and a stacked week of FOSS+ updates. 🗺️ The open-source…
Dashlane Confirms Hackers Stole Password Vaults, Pentagon Location Tracking, and Hackers Trick Meta's AI
Dashlane has confirmed hackers stole around 20 encrypted password vaults, and the company is being unusually quiet about how it happened. Plus the Pentagon admits US troops were tracked using commercial location data, Europe accelerates its move away from US tech, and hackers hijacked celebrity Instagram accounts by simply asking Meta's AI support chatbot. 🔎 EasyOptOuts is the easy, affordable, and effective way to automatically remove your data from people search sites: https://easyoptouts.com…
A Rare Age Verification Win, AI Cameras On School Buses, And A License Plate Tracking Ban
A rare and genuine win against age verification with California following Colorado in exempting Linux and other open source operating systems from its Digital Age Assurance Act, directly because of community pressure. Plus AI cameras on tens of thousands of school buses being quietly repurposed for police access, a bipartisan amendment that could end nationwide automatic license plate reader programs, the open source supply chain under unprecedented attack, and a Trump Mobile data leak. In this…
A Brutal Week for Microsoft Security, Signal Threatens to Leave Canada, And Bitwarden Quietly Shifts
A brutal week for Microsoft with seven vulnerability stories, an actively exploited Exchange zero-day, the MiniPlasma exploit (rooted in a six-year-old Project Zero report Microsoft sat on), and Pwn2Own Berlin zero-days. Plus the Shai-Hulud npm supply chain attack hitting 600+ packages, Signal threatening to pull out of Canada over Bill C-22, Meta rolling out AI-powered age detection, and some quiet changes at Bitwarden that have long-time users uneasy. 🔎 EasyOptOuts is the easy, affordable, and…