Hasty Briefsbeta

All tags

#privacy

903 stories total

Bilingual

Thomas Rattigan, short-lived Commodore CEO
a year ago
- Technologies like cookies are used to enhance user experiences by storing and accessing device information.
- Consent to these technologies enables data processing, including browsing behavior and unique IDs.
- Withdrawing consent may negatively impact certain site features and functions.
- Technical storage is necessary for legitimate purposes like enabling requested services or transmitting communications.
- Storage is also required for storing user preferences not explicitly requested.
- Technical storage for statistical purposes is anonymous and typically cannot identify users without additional records.
- User profiles created for advertising or tracking across websites require technical storage or access.
UK can't keep its encryption fight with Apple private, court rules
a year ago
- The UK government ordered Apple to provide a backdoor in iCloud for global surveillance, including content under Advanced Data Protection (ADP).
- Apple initially considered appealing the order but removed ADP access for UK users, leaving only Standard Data Protection (SDP).
- Apple formally appealed the directive, with rights groups pushing for a public hearing instead of closed-door proceedings.
- The Investigatory Powers Tribunal (IPT) rejected the UK government's request to keep case details private, dismissing national security concerns.
- Rights groups argued against secrecy, citing widespread reporting on the issue and Apple's removal of ADP for UK users as clear indicators of the case's nature.
- Apple has a history of resisting government demands to weaken encryption, notably refusing to unlock the iPhone of the San Bernardino shooter in 2016.
Waymo may use interior camera data to train generative AI models, sell ads
a year ago
- Waymo plans to use data from robotaxis, including video from interior cameras linked to rider identities, to train generative AI models.
- The draft privacy policy suggests Waymo may share this data for personalized ads, raising privacy concerns.
- Riders can opt out of sharing personal information, including interior camera data, for AI training.
- It's unclear what specific interior data is used for AI training or its intended applications.
- Waymo is the only U.S. robotaxi company generating revenue, with over 200,000 paid rides weekly.
- The company aims to expand into Atlanta, Miami, and Washington, D.C., within two years.
- Despite growth, Waymo remains unprofitable, prompting exploration of new revenue streams like in-vehicle ads and AI data sharing.
- Alphabet invested $5 billion in Waymo last year, with external funding raising its valuation to over $45 billion.
- Waymo continues heavy R&D spending and expansion costs, including fleet growth and infrastructure.
UK's demand for Apple backdoor should not be heard in secret, says court
a year ago
- The U.K. government lost its bid to keep details of a surveillance order against Apple secret.
- The Investigatory Powers Tribunal ruled parts of the case will be public, rejecting claims of national security risks.
- The case reportedly involves a U.K. demand for Apple to provide access to encrypted cloud data of any Apple customer globally.
- Apple stopped offering Advanced Data Protection in the U.K. following the legal demand.
- Apple appealed the order, while the U.K. government argued public disclosure would harm national security.
- Privacy advocates, media, U.S. lawmakers, and officials have called for transparency in the legal hearings.
- Apple maintains it has never built a backdoor into its products and never will.
IRS agrees to send immigrant tax data to ICE for enforcement
a year ago
- IRS acting commissioner Melanie Krause is resigning over a deal to share immigrants' tax data with ICE.
- The agreement allows ICE to verify tax records of immigrants in the U.S. illegally.
- The deal is part of President Trump's broader immigration crackdown, including deportations and workplace raids.
- Critics argue the data-sharing violates privacy laws and could discourage tax compliance among immigrants.
- The IRS-DHS agreement has raised concerns about potential violations of taxpayer privacy statutes.
- ICE claims the agreement will help identify individuals fraudulently collecting benefits.
- Tax law experts warn IRS officials could face legal consequences for sharing taxpayer data unlawfully.
How to Avoid US-Based Digital Services–and Why You Might Want To
a year ago
- Big Tech companies like Apple, Google, and Meta act as gatekeepers for user data, deciding government access to personal information.
- Collaboration between Big Tech and the Trump administration began before his inauguration, with significant financial contributions from major tech firms.
- Meta (Facebook, Instagram, Threads) made policy changes aligning with Trump administration values, permitting hate speech and removing fact-checkers.
- Google and Apple complied with Trump's executive orders, including renaming the Gulf of Mexico to the Gulf of America.
- Tech companies' alignment with the Trump administration raises concerns about privacy, surveillance, and data control.
- Law enforcement can compel tech companies to hand over user data via subpoenas, court orders, or National Security Letters (NSLs).
- The FBI's 2016 attempt to force Apple to backdoor an iPhone highlights tensions between tech companies and law enforcement over encryption.
- Countries relying on US-based digital services for government communications and public health are exploring alternatives due to safety concerns.
- Non-US alternatives like ProtonMail, MagicEarth, and Vivaldi are gaining popularity as secure options for digital services.
- The r/degoogle subreddit has over 250,000 members sharing tips on replacing Google and other US-based digital services.
Court document reveals locations of WhatsApp victims targeted by NSO spyware
a year ago
- NSO Group's Pegasus spyware targeted 1,223 WhatsApp users across 51 countries in 2019.
- Victims included over 100 human rights activists, journalists, and civil society members.
- Mexico had the highest number of victims (456), followed by India (100) and Bahrain (82).
- Western countries like Spain, the Netherlands, and the UK also had victims.
- The hacking campaign lasted only two months (April-May 2019).
- NSO Group's government customers may have spent millions on spyware licenses.
- WhatsApp's lawsuit revealed NSO Group disconnected 10 abusive government customers.
- A one-year license for NSO's WhatsApp hacking tool cost up to $6.8 million.
- NSO Group made at least $31 million in revenue in 2019 from spyware sales.
- A judge ruled NSO Group violated U.S. hacking laws; damages hearing pending.
Show HN: Temp.pw
a year ago
- temp.pw generates random passwords shareable via a link that expires after one use.
- Passwords are not stored in chat history, email, or elsewhere for security.
- Users can enter any text to share via a temporary link.
- The service is a project of introvert.com.
- Shared passwords can only be viewed once, with a confirmation prompt before viewing.
No-JavaScript Fingerprinting
a year ago
- Fingerprinting identifies browsers without cookies or data storage.
- Uses properties like language and installed fonts to create a unique identifier.
- Fingerprint remains the same even in incognito mode.
- Demo shows fingerprinting is possible without JavaScript and cookies.
- Disabling JavaScript and cookies does not change the fingerprint.
Show HN: Homerun Desktop: Self-hosting for professionals with deadlines
a year ago
- Self-host any app from your own device quickly.
- Migrate apps between devices seamlessly in case of disaster.
- Create a private cloud without data centers.
- Invited network hosts can take over services when offline.
- Now hosting Immich for self-hosted media management.
- Back up, organize, and manage photos on your own server.
- Safe, secure, and self-hosted password manager.
- Sovereign and secure communications platform for collaboration.
- Join Homerun Desktop channels for news and support.
Florida's New Social Media Bill Explicitly Demands an Encryption Backdoor
a year ago
- Florida's SB 868/HB 743 bill mandates social media platforms to decrypt end-to-end encryption for law enforcement with a subpoena.
- The bill openly seeks a backdoor into encrypted platforms for minors, potentially leading companies to remove encryption for minors altogether.
- Encryption is crucial for online safety, and removing it for minors undermines their privacy and security.
- The bill is impractical; creating a backdoor for 'good guys' or specific user groups (like minors) is impossible without compromising everyone's privacy.
- Similar attempts, like in Nevada, argue law enforcement needs access for investigations, but evidence shows content-oblivious methods (e.g., user reporting) are more effective.
- Law enforcement can already investigate encrypted messages by accessing devices; the bill's additional restrictions on ephemeral messaging features are unnecessary and harmful.
- The bill expands Florida's controversial HB 3 social media law, which is already facing constitutional challenges in court.
- Weakening encryption harms privacy for all users, including minors and their contacts. Florida should focus on improving privacy laws and digital literacy instead.
P2Panda: Building blocks for peer-to-peer applications
a year ago
- p2panda provides tools for building modern, privacy-respecting, local-first applications.
- Modular approach allows integration flexibility and promotes interoperability in the p2p ecosystem.
- Compatible with existing libraries and standards like BLAKE3, Ed25519, STUN, CBOR, TLS, QUIC, UCAN, and Double Ratchet.
- Supports offline-first operations and post-internet communication methods like shortwave, packet radio, Bluetooth Low Energy, LoRa, and USB.
- Maintains Rust crates, designs protocols, conducts research, and organizes community events.
- Libraries include p2panda-net, p2panda-discovery, p2panda-sync, p2panda-blobs, p2panda-core, p2panda-store, p2panda-stream, p2panda-node, p2panda-caps, and p2panda-group.
- Recent updates include Event Streams and Persistence (0.3.0), local-first group and message encryption, and offline-first networking support.
- Upcoming projects: Aardvark (local-first text editor), Toolkitty (coordination toolkit), Meli Bees App (collaborative bee species app), rhio (peer-to-peer message router), and aquadoggo (node implementation).
- Contact via GitHub, Fediverse, official Chat, or Email.
European Commission: DSS Demonstration WebApp
a year ago
- Files transmitted to the European Commission's infrastructure with user consent.
- Users advised not to use sensitive documents; transmitted files are not retained.
- Demonstration of DSS library features, not for actual signature services.
- Usage limited to testing; European Commission holds no liability.
- Legal notice provides additional information.
Understanding Aggregate Trends for Apple Intelligence Using Differential Privacy
a year ago
- Apple prioritizes privacy as a fundamental human right, using techniques like differential privacy to protect user data.
- Differential privacy helps Apple understand product usage trends without accessing individual user data.
- Apple Intelligence does not use personal data or user interactions for training foundation models.
- Genmoji improvements utilize differential privacy to identify popular prompts without revealing unique or rare prompts linked to individuals.
- Synthetic data is used to improve text generation features like summarization without collecting actual user emails or messages.
- Apple ensures privacy by only using aggregated insights and never accessing individual device data or IP addresses.
- Upcoming releases will extend differential privacy to features like Image Playground, Image Wand, Memories Creation, and Writing Tools.
- Synthetic data generation mimics real user data trends without containing actual content, aiding model improvements.
- Apple remains committed to advancing privacy-protecting techniques in AI and machine learning.
Apple's plan to train AI on your emails
a year ago
- Apple is shifting its AI strategy to analyze user data directly on devices, maintaining its privacy-first approach.
- The company will use real-world data snippets (like emails) alongside synthetic data to improve AI models.
- Apple's AI platform, Apple Intelligence, has lagged behind competitors due to reliance on less effective synthetic data.
- Internal tests revealed issues with Siri, writing tools, and summarization features, prompting leadership changes and delays.
- New updates in iOS 18.5, iPadOS 18.5, and macOS 15.5 aim to enhance AI performance by calibrating synthetic data with real user interactions.
- Features like Image Playground, Memories Creation, and Genmoji will also benefit from this improved data approach.
- Differential privacy is used for Genmoji to identify trends without exposing individual user behavior.
- Enhancements require users to opt into device analytics and product improvement settings.
Firefox starts testing "Link Previews"
a year ago
- Firefox Labs introduces a new experimental feature called Link Previews.
- Link Previews show a snapshot of a link's content before opening it, including an image, webpage title, and AI-generated key points.
- The AI runs locally on the device, prioritizing user privacy by not sharing or storing browsing data.
- Currently available on Firefox Beta 138, Nightly 138, and Nightly 139.
- Users are encouraged to provide feedback on UX, content quality, and workflow improvements.
Strip EXIF Data Out of Your Image Files Before Posting
a year ago
- A reader alerted the author about GPS data present in images on their Ponyhenge page.
- Cell phone cameras store metadata like GPS coordinates in the EXIF segment of image files.
- Posting images online with EXIF data can reveal personal locations, such as your home address.
- Social media platforms may remove EXIF data from public view but likely retain it for data collection.
- Apple devices offer an 'Include Location' option when exporting images, which should usually be turned off.
- The author's static site generator initially copied raw images, sometimes including GPS data, requiring manual removal.
- The author implemented an automatic GPS EXIF stripper for images uploaded to their site.
- Parsing JPEG files to remove EXIF data was more complex than expected, involving various challenges with the file format.
- The author ultimately decided to use a third-party EXIF parser due to the complexity of JPEG parsing.
Force Devices to use Pi-hole
a year ago
- Setting up Pi-hole on a Raspberry Pi or Docker is straightforward, but some devices refuse to use Pi-hole DNS due to hardcoded DNS or DNS over HTTPS/TLS.
- Redirect DNS queries on port 53/udp (and sometimes 53/tcp) to Pi-hole by setting up a Source NAT (SNAT) rule on a router like OPNSense or pfSense.
- Block DNS over TLS (DoT) by dropping traffic on port 853 TCP for non-private IP ranges.
- Blocking DNS over HTTPS (DoH) is challenging; use hagezi/dns-blocklist to block DoH services at the DNS level.
- Run your own recursive DNS resolver (e.g., Unbound) for privacy, avoiding reliance on ISP DNS servers.
GitHub Copilot auto enabled itself on all workspaces without my consent
a year ago
- User enables Copilot only for specific VSCode windows due to private client repos.
- Copilot auto-enabled itself in all VSCode windows without consent, risking exposure of sensitive data (keys, YAML secrets, certificates).
- Only 2 windows were approved for Copilot use; others were intentionally disabled.
- Expresses concern over potential unauthorized data sharing and demands a fix to prevent recurrence.
- Requests that VSCode workspaces with GitHub disabled remain unaffected by Copilot auto-enabling.
Encryption Is Not a Crime
a year ago
- Encryption is not a crime but a protective shield for digital privacy and security.
- End-to-end encryption ensures only intended recipients can access data, protecting against unauthorized surveillance.
- Authorities in various countries attempt to undermine encryption under the guise of crime prevention, despite expert warnings.
- Breaking encryption endangers everyone, including children, by exposing sensitive data to potential misuse.
- The concept of a 'magical backdoor' for encryption is flawed and would be exploited by criminals.
- Support for encryption rights includes using encrypted services, educating others, and advocating with policymakers.
- Organizations and individuals continue to fight against attempts to weaken encryption globally.

first prev1next

About|Login

#privacy

Thomas Rattigan, short-lived Commodore CEO

UK can't keep its encryption fight with Apple private, court rules

Waymo may use interior camera data to train generative AI models, sell ads

UK's demand for Apple backdoor should not be heard in secret, says court

IRS agrees to send immigrant tax data to ICE for enforcement

How to Avoid US-Based Digital Services–and Why You Might Want To

Court document reveals locations of WhatsApp victims targeted by NSO spyware

Show HN: Temp.pw

No-JavaScript Fingerprinting

Show HN: Homerun Desktop: Self-hosting for professionals with deadlines

Florida's New Social Media Bill Explicitly Demands an Encryption Backdoor

P2Panda: Building blocks for peer-to-peer applications

European Commission: DSS Demonstration WebApp

Understanding Aggregate Trends for Apple Intelligence Using Differential Privacy

Apple's plan to train AI on your emails

Firefox starts testing "Link Previews"

Strip EXIF Data Out of Your Image Files Before Posting

Force Devices to use Pi-hole

GitHub Copilot auto enabled itself on all workspaces without my consent

Encryption Is Not a Crime