Hasty Briefsbeta

All tags

privacy

130 stories total

Bilingual

KDE Itinerary
2 months ago
- KDE Itinerary is a privacy-focused digital travel assistant for Plasma Mobile and Android.
- It stores all travel information (QR-codes, times, delays, seat reservations, coach layout, etc.) in a single app.
- Supports reservations for trains, buses, flights, hotels, restaurants, events, rental cars, and multi-traveler bookings.
- Booking data is extracted locally on the device, ensuring no data is sent to remote servers.
- Integrates with KMail, KDE Connect, Nextcloud Mail, and DavDroid for automatic ticket extraction and sync.
- Users can manually add train trips, find alternative connections, and import trips from reservation numbers.
- Indoor maps powered by OpenStreetMap show platforms, shops, restaurants, elevators, toilets, exits, and real-time status.
- Provides real-time delay updates and onboard API support for live vehicle status on supported transport.
- Features include timeline view, trip map, per-trip statistics, health certificate manager, currency converter, and journey search.
Why does Mail app contact iCloud when sending a non-iCloud email?
2 months ago
- The author only uses iCloud for testing app sync features, not for email.
- Mail app triggers iCloud connections when sending emails from non-iCloud accounts.
- The cloudd and nsurlsessiond processes attempt to connect to gateway.icloud.com.
- Certificate pinning prevents analysis of the iCloud connections.
- The author creates Little Snitch rules to block these connections.
Apple engineer says he was fired after refusing to send cust. device IDs to AT&T
2 months ago
- Apple employee Toby Boardman alleged he was fired after objecting to data sharing practices involving AT&T and IMEI requests.
- Boardman reported that an Apple AT&T representative failed to require customer consent for IMEI data, which was transmitted through unsecured email.
- Boardman had a history of high performance but received negative reviews after refusing AT&T IMEI requests and reporting privacy concerns.
- Boardman's mental health disclosures, including OCD and anxiety, were met with alleged failure to accommodate and eventual termination.
- Apple denies all allegations, claiming termination was for just cause and business reasons, and that Boardman received requested accommodations.
- The lawsuit is ongoing with a trial set for 2027; key records like emails and internal policies are not yet public.
- The case raises questions about privacy in enterprise support, where decisions rely on employee discretion rather than automated controls.
- Boardman's allegations focus on a specific internal rule becoming optional for a major carrier, leading to his removal as a whistleblower.
Engineering behind the xPal private messaging app cross-device message deletion
2 months ago
- xPal offers four distinct deletion features: Terminate (ends a single conversation and blocks the contact), Total Wipeout (deletes all data via reverse PIN), Remote Wipeout (for lost or stolen devices), and Flicker (disappearing messages with per-message timers).
- Cross-device deletion is a request, not a guarantee; once a message reaches another device, the app cannot force the recipient to delete it.
- xPal uses Replace And Destruct to overwrite encrypted data before deletion, making recovery difficult.
- Offline-Lock ensures that offline devices must process pending deletion requests before allowing access to chats.
- xPal does not store messages long-term on servers and avoids showing message content in push notifications.
- The system is designed to reduce stored data reliably under normal operation, but cannot control external recordings or screenshots.
RSS is dead. Stop crying about Google Reader
2 months ago
- RSS is often nostalgically defended as a decentralized, anarchy-like web tool, but the average person does not care about algorithmic silencing, privacy, or paid reviews.
- Social feeds became profitable because they optimize for engagement with tracking and dark patterns, while RSS is 'too honest' for advertising with no tracking, profiling, or engagement optimization.
- Google Reader was killed in 2013 due to lack of profitability, not declining usage, as Feedly gained 3 million users after its announcement.
- Most people prefer easy doomscrolling over setting up RSS, but tools like yarr, rss-bridge, searxng, and AI integrations now make self-hosted RSS better and more private than ever.
Show HN: SmokeVPN – All-in-One WireGuard VPN Hub – Switch Exits in Realtime
2 months ago
- Centralized dashboard manages up to 10 devices with individual exit selection per device.
- Each device can have its own exit country, random, timed rotation, Tor, or custom pool; changes apply instantly without disconnection.
- Logless architecture: logs stored only in RAM and continuously scrubbed; no traffic or IP records kept.
- Private DNS resolver blocks ads, trackers, malware, and phishing by default; optional content blocking per device.
- SOCKS5 and HTTP proxies are always included and do not count toward device limit.
- Routing rules allow sending specific destinations through different exit countries by domain or IP.
- Authentication uses an account number only; no email or password required, and payment is via cryptocurrency.
- Free trial offers full network, both proxies, and multiple devices with no credit card needed.
'Antizuck' iOS app that claims to detect nearby smart glasses tops App Store
2 months ago
- A paid iPhone app called Antizuck Smart Glasses Scanner, designed to detect Meta AI glasses, is currently the #3 top paid app in the U.S. App Store.
- The app's popularity reflects growing public privacy concerns about AI smart glasses.
- Camera-equipped smart glasses are still fairly recognizable, making the app potentially unnecessary.
- This privacy sentiment could be a significant hurdle for Apple if it plans to enter the smart glasses market.
The Screen Act Threatens Privacy Far Beyond Adult Websites
2 months ago
- The SCREEN Act (S. 737) would require online services to verify users' ages before accessing sexually explicit content, affecting millions of adult users' privacy and anonymity.
- Unlike state laws, the bill applies broadly to any service hosting even a single piece of explicit content, including streaming platforms and social media, not just adult sites.
- Simple age attestation is insufficient; platforms must use identity-linked verification methods, which are more invasive than physical ID checks.
- The bill's data protection measures are weak, allowing third-party verification services to collect and retain personal information with minimal limits, posing privacy and security risks.
- The SCREEN Act restricts VPN usage by requiring age verification based on IP addresses, undermining legitimate privacy and security benefits for users.
- The bill would block adults from lawful speech, reduce anonymity, and jeopardize internet privacy and data security for all users.
Show HN: I built a cross-browser extension that controls fingerprinting surfaces
2 months ago
- Privacy Thing is a tool that reduces browser fingerprinting across the web.
- It covers 53 browser properties, methods, and constructors.
- These are grouped into 13 protection categories including geolocation, Canvas, WebGL, Audio, and more.
- A preview version is now available for Google Chrome and Mozilla Firefox.
Make Everything to Markdown
2 months ago
- Klartext converts documents (PDF, photos, Word, Excel, etc.) to clean Markdown locally, ensuring no data is sent to external AI services like OpenAI or Google.
- The service is permanently free with no paid tiers; it requires only a free account to enforce fair-use limits (25 MB per file, 5 files per upload, 100 pages per document, 100 conversions per day).
- It preserves numbers, names, tables, and original structure, but may lose comments, footnotes, text boxes, and complex layouts like multi-column or handwritten content.
- Uploaded files and results are automatically deleted after 24 hours (or manually immediately), and the conversion runs on a private server without external OCR or AI services.
- Output includes both a readable Markdown file and a detailed JSON file with full structure (pages, blocks, table cells) for integration into other programs.
Flock cameras are getting mobbed
2 months ago
- Flock Safety cameras are being vandalized across the US, with individuals using saws, paint, and trucks, and cities canceling contracts due to privacy concerns.
- The company's network of 120,000 cameras records license plates and vehicle data, used by police for crime-solving, but critics argue it invades privacy and enables surveillance.
- Opposition to Flock is bipartisan, uniting conservatives and progressives who see it as a threat to individual liberties and a step toward a police state.
- Police have misused Flock cameras to stalk ex-partners and track individuals, despite the company's claims of only logging vehicles.
- Flock retains data for 30 days by default, and its nationwide searchability raises concerns about mass surveillance, with false positives like the Joel Feder incident.
- Activists and commentators on both sides of the political spectrum, including Hasan Piker and Tucker Carlson, condemn the surveillance state fostered by Flock.
- Flock CEO Garrett Langley defends the technology, arguing safety and privacy can coexist, but critics point to misuse and the company's lack of foolproof systems.
1,741 "informed" consents with one click? GDPR complaint filed
2 months ago
- noyb has filed a complaint against dict.cc for violating the GDPR by using a consent banner that nudges users to consent to tracking by 1,741 partner companies with a single click.
- The GDPR requires that consent is freely given, informed, specific, and unambiguous, but dict.cc's practice makes it impossible for users to understand who accesses their data or how it is used.
- Reading all privacy policies of the 1,741 partners would take over 170 hours, rendering informed consent practically impossible.
- This widespread practice persists even 8 years after the GDPR came into force, affecting many websites and apps.
- The complaint requests the Austrian DPA to order deletion of unlawfully processed data, inform recipients of the deletion, and impose a fine to prevent future breaches.
Why the future is local app
2 months ago
- Cloud apps cause delays and frequent 'spinners' that break user focus and speed.
- Locally installed apps provide instant responses by writing to the hard drive first, syncing to cloud in background.
- Local-first software restores data ownership, preventing lockouts from cloud outages.
- Modern hardware (Apple Neural Engine, Qualcomm, Nvidia) enables powerful AI locally, eliminating the need for servers.
- On-device processing enhances privacy by keeping sensitive data off servers, reducing breach risks.
- getapps.cafe builds native apps that work offline, keep files as real files, and respect user time.
Show HN: Echologue – the private AI voice journal I built for myself
2 months ago
- Echologue turns voice notes and journal entries into structured, retrievable memory that users can ask questions about.
- It separates facts from feelings, extracts people and themes, enabling grounded recall from one's own history.
- Local-first privacy: journal data stays on the user's device; AI processing is ephemeral and user controls export/wipe.
- Users can capture moments via voice or text and later ask natural language questions (e.g., 'What were the highlights of my Barcelona trip?').
- Supports voice dictation in many languages and offers a free tier with premium upgrades for higher usage and advanced controls.
Proofs that age verification and e-voting do not require sacrificing any privacy
2 months ago
- Paper 1: Privacy-preserving attribute verification replaces ID+selfie age checks with unlinkable tokens attesting only the required predicate (e.g., over 18), issued by an M-of-N threshold committee to avoid single points of control, and eliminates vintage leakage through stable predicate keys or mixing.
- Paper 1 also uses on-device liveness gates to prevent replay and deepfake attacks, ensuring biometric data never leaves the device.
- Paper 2: Publishing group voting results (e.g., by demographic) without exposing individuals by using Fréchet bounds to measure per-cell privacy risk, adding random noise only when margins near extremes would reconstruct a voter's choice.
- Paper 3: A remote voting system that simultaneously achieves secret ballot, verifiable integrity (without trusting the operator), and continuous tally, using cryptographic building blocks and closing coercion via fake credentials.
- Paper 3 addresses device malware with a dual-root design (attested execution + biometric-gated device) and provides a deployability inequality: only safe when the value of outcome manipulation is less than the cost of subverting both roots.
- All three papers replace institutional trust (ID verifier, data collector, election authority) with verifiable proofs and provide a computable number that indicates where the substitution is safe.
Claude may have leaked your chats to the public
2 months ago
- Chatbots like Claude are designed to feel personal but are not private, with conversations visible to the company and potentially indexed by search engines.
- Claude share links were indexed by Google, exposing sensitive user chats including legal and personal discussions, though Anthropic quickly fixed the issue.
- The leak primarily affected shared chats, but some users who never shared their chats may also have been exposed.
- AI companies commonly use user chats for training and may have human reviewers, and data can be retained even after deletion.
- Users should never share personal or sensitive information with AI chatbots to protect their privacy.
An Interview with the Man Charged for Allegedly Wiping His GrapheneOS Phone
2 months ago
- Samuel Tunick was charged for allegedly entering a duress password that wiped his GrapheneOS phone, which he claims is an attempt by the U.S. government to intimidate activists from protecting their data.
- The case stems from Tunick's involvement in the Stop Cop City movement in Atlanta, and has drawn attention from privacy and civil liberties groups.
- Tunick was stopped at the airport by DHS agents who searched his bags and person without his consent, then demanded his phone; he gave a code that triggered the duress wipe feature.
- After the phone was wiped, Tunick was released but indicted a year later for destroying digital contents, facing up to five years in prison.
- Tunick argues the prosecution is part of a broader pattern of government repression against activists, citing RICO charges, the Prairieland case, and new surveillance policies.
- He experienced prior surveillance including a hidden camera, car tracker, and subpoenaed phone records, which he believes were meant to intimidate him and discourage activism.
Protesting Flock, Arizona Man Presents Plan to Surveil Government Officials
2 months ago
- Jacob Petrosky satirically proposed a surveillance program for city officials to highlight privacy concerns with Flock cameras.
- He revealed the proposal was satire to criticize the city's use of Flock cameras to monitor citizens without warrants.
- Petrosky has been opposing Casa Grande's 10-year, $10 million Flock contract since 2023, citing invasion of privacy.
- He launched a website and petition (DeFlockCG) with nearly 900 signatures demanding warrant requirements or removal of cameras.
- The city has installed 140 of 200 planned cameras, including license plate readers and pan-tilt-zoom cameras.
- Petrosky wants Flock data to require a warrant, reflecting broader national concerns about police surveillance abuse.
Spies in the sky: how worried should we be about AI-enabled smart lamp-posts?
2 months ago
- Smart lamp-posts (iLamps) can recognize number plates and faces, powered by solar panels and capable of acting as AI data centres.
- Concerns include potential for gait analysis, suspicious behavior detection, and the risk of a 'panopticon state' under a home secretary who supports hyper-surveillance.
- Experts question the technical feasibility of AI data centres in lamp-posts due to power and economic limitations, calling some claims 'hype'.
- Data ownership issues arise, as demonstrated by a case where a supplier retained garbage collection data, leaving councils without control.
- Public opinion is mixed: some accept facial recognition as normal, while others fear loss of privacy and jobs, and experts warn of misidentification and future misuse.
There are no fire alarms when it comes to privacy
2 months ago
- The bystander effect shows people are less likely to react to privacy intrusions when in groups.
- WhatsApp's forced privacy policy update allows Facebook to track purchases without user consent.
- Digital surveillance through apps mirrors physical stalking but is normalized due to lack of visibility.
- Privacy awareness is difficult because of varied expectations, ridicule, and toxic positivity surrounding the issue.
- Privacy should be treated the same as physical privacy: what is illegal offline should be illegal online.
- Basic steps to protect privacy include limiting app permissions, using adblockers, and switching to privacy-friendly software.

firstprev0next

privacy

KDE Itinerary

Why does Mail app contact iCloud when sending a non-iCloud email?

Apple engineer says he was fired after refusing to send cust. device IDs to AT&T

Engineering behind the xPal private messaging app cross-device message deletion

RSS is dead. Stop crying about Google Reader

Show HN: SmokeVPN – All-in-One WireGuard VPN Hub – Switch Exits in Realtime

'Antizuck' iOS app that claims to detect nearby smart glasses tops App Store

The Screen Act Threatens Privacy Far Beyond Adult Websites

Show HN: I built a cross-browser extension that controls fingerprinting surfaces

Make Everything to Markdown

Flock cameras are getting mobbed

1,741 "informed" consents with one click? GDPR complaint filed

Why the future is local app

Show HN: Echologue – the private AI voice journal I built for myself

Proofs that age verification and e-voting do not require sacrificing any privacy

Claude may have leaked your chats to the public

An Interview with the Man Charged for Allegedly Wiping His GrapheneOS Phone

Protesting Flock, Arizona Man Presents Plan to Surveil Government Officials

Spies in the sky: how worried should we be about AI-enabled smart lamp-posts?

There are no fire alarms when it comes to privacy