Congress Comes For VPNs, Plus FBI & Pentagon Hacks, and Chat Control Defended
Congress now has two site-blocking bills, and one of them would force VPNs and encrypted DNS providers to block websites for Americans. Plus: ShinyHunters hacked the FBI and someone stole 3 million Pentagon personnel records, Chat Control 2.0 stalled in the EU (for now), and Meta's Muse AI agent is already off to an a*muse*ing start to privacy and security. Go Incognito v2 is launching Monday! I'm running a pre-launch 25% discount + a 'Day Zero' badge, just use code V2LAUNCH:…
No Hack Needed: How Revolut Leaked Your Passport, Plus New Age Verification & Rogue AI Agents
A hacker emailed Revolut pretending to be a government agency, and Revolut handed over customers' passports, IDs, and financial details. Plus: the global age-verification wave forcing even more ID collection (EU, California, Microsoft), OpenAI's rogue AI agents and why I've hit a breaking point with these companies, and the usual run of data breaches, threats, and open-source updates. In this episode: Highlight, The hidden cost of handing over your ID: the Revolut impersonation breach, IDScan's…
153 Million Driver's Licenses For Sale, Plus Chrome Kills uBlock Origin & Texas Kicks Out Flock
An ID-verification company, IDScan.net, appears to have leaked scans of 153 million driver's licenses, then sold on a dark-web market called Nexus. This week I break down why this breach is the perfect example of everything wrong with ID uploads, plus Chrome officially pulling uBlock Origin and AdGuard from the Web Store, California's age-verification bill carving out a Linux exemption, and Florida and Texas stepping back from Flock license-plate readers, plus the usual data breaches, threats, and…
Apple Fixed A Leak Without Telling Anyone, Plus More VPN News and Flock's Creepy Police AI
Four positive VPN stories in one week: Mullvad's new multihop modes, Obscura shipping on Windows, Apple quietly patching the iCloud Private Relay leak, and Firefox's free VPN rolling out to Android. Then it gets darker: Flock built an AI tool that turns license plates into names, addresses, and relatives. Meta settled for billions over harms to kids. Plus X sent cease-and-desists that took Nitter and XCancel offline, and the usual data breaches, threats, and FOSS+ updates. 🔎 EasyOptOuts is the easy,…
Apple's Private Relay Is Leaking Your IP, Plus Fake VPN Extensions & France's Big Win
Three cracks opened up in Apple's privacy story this week: iCloud Private Relay leaking real IP addresses through DNS prefetching, WebTransport, and passkeys; Hide My Email exposing real addresses in bounce logs; and an unprecedented wave of spyware notifications going out to targeted users. Also this week: 737 fake VPN extensions sitting in the Chrome Web Store, Edge phasing out Manifest V2, a judge giving Google one week to fix its anticompetitive Play Store flow, and France's top court blocking the…
Signal's Biggest Update In Years, Plus Rival App Stores Arrive In The Play Store
Signal just shipped its largest set of updates in years: A second phone can finally be a linked device, automatic key verification is rolling out alongside safety numbers, and there are commits hinting at registration without a phone number. I also cover Google hosting rival app stores in the Play Store after its Epic loss, a fake Wi-Fi network on a Delta flight, a Reuters poll showing most Americans want tighter social media oversight, and Meta joining the list of companies whose AI agents ran their…
OpenAI's Hacking Story Got Worse, Plus Iran In US Water Systems & A Felony For Wiping A Phone
OpenAI's rogue AI agent turned out to have hacked more than Hugging Face, and the more details come out, the less impressive it seems. Then Anthropic came forward with its own disclosure: three companies accessed during testing, two of which had no idea. Plus Iran-linked hackers burrowing into dozens of US water and energy systems, an activist facing a felony for wiping his GrapheneOS phone at the border with a duress password, and thousands of private Claude chats and Artifacts turning up indexed on…
France Banned Social Media For Under-15s, Plus A Hidden Device In Millions Of US Cars
France has become the first country in Europe to ban social media for children under 15. Meanwhile there's real good news elsewhere: the UK's incoming PM dropped digital ID entirely, and California's Senate killed its browser-level age mandate and exempted open source operating systems. 🔎 EasyOptOuts is the easy, affordable, and effective way to automatically remove your data from people search sites: https://easyoptouts.com Thanks to the EasyOptOuts team for sponsoring Surveillance Report! In this…
EU Passes Chat Control Anyway, Plus Microsoft's Secure Boot Mess & the Flock Resistance
This week's a double-week catch-up: the EU just greenlit Chat Control even after Parliament voted against it, Microsoft had a brutal stretch between a decade-old Secure Boot flaw and a Windows Defender zero-day, Texas's app-store age verification law cleared its Supreme Court hurdle while the KIDS Act moves through Congress, and LAPD just let its Flock license-plate contract expire. Plus a double-week Defense Bulletin with breaches, threats and open source news! 🗺️ The open-source answer to Google…
Apple Quietly Downgrades Hide My Email, Plus Chrome Kills uBlock Origin & Google's IP Tracking
Apple is moving Hide My Email aliases to a new private.icloud.com subdomain, which makes it trivial for any app or website to spot a private email and block the signup. 🔎 EasyOptOuts is the easy, affordable, and effective way to automatically remove your data from people search sites: https://easyoptouts.com Thanks to the EasyOptOuts team for sponsoring Surveillance Report! In This Episode: Google preparing to use IP addresses for ad measurement across the EEA, UK & Switzerland (Aug 3) Chrome…
Meta Hid Face-Recognition Code on 50M Phones, The UK's Device-Scanning Ultimatum & A Burner Phone Ban
Meta quietly embedded unreleased facial-recognition code, internally called "nametag" onto more than 50 million phones through its Meta AI app, then deleted it the day after Wired exposed it. This week I also get into Microsoft repos weaponized a second time to push credential-stealing malware to AI users, the UK's ultimatum to scan every device (and Signal's response), the FCC's push to kill burner phones...plus the usual breaches, threats, and a stacked week of FOSS+ updates. 🗺️ The open-source…
Dashlane Confirms Hackers Stole Password Vaults, Pentagon Location Tracking, and Hackers Trick Meta's AI
Dashlane has confirmed hackers stole around 20 encrypted password vaults, and the company is being unusually quiet about how it happened. Plus the Pentagon admits US troops were tracked using commercial location data, Europe accelerates its move away from US tech, and hackers hijacked celebrity Instagram accounts by simply asking Meta's AI support chatbot. 🔎 EasyOptOuts is the easy, affordable, and effective way to automatically remove your data from people search sites: https://easyoptouts.com…