Hasty Briefsbeta

All tags

#privacy

903 stories total

Bilingual

Data Brokers Are Selling Your Flight Information to CBP and ICE
10 months ago
- Data brokers exploit privacy law gaps to harvest and sell personal data without consent.
- Airlines Reporting Corporation (ARC) secretly sold passenger flight records to U.S. Customs and Border Protection (CBP).
- ARC's Travel Intelligence Program (TIP) contains over 1 billion records of past and future travel data.
- CBP uses this data for surveillance, raising concerns about unjustified searches and immigration enforcement.
- More than 200 airlines, including major U.S. and international carriers, contribute data to ARC.
- U.S. Immigration and Customs Enforcement (ICE) also purchased personal data from ARC, risking privacy and freedom.
- Data brokers sell sensitive location, internet, and utility data to law enforcement and intelligence agencies.
- Legislation like 'privacy first' laws and the 'Fourth Amendment is not for sale' act is urgently needed.
- Data broker registration laws must be enforced to protect personal privacy.
1.1.1.1 Is Down
10 months ago
- The Internet was originally designed for stationary computers, leading to outdated assumptions affecting speed and security today.
- 1.1.1.1 with WARP modernizes and optimizes the connection between devices and the Internet.
- Internet service providers can monitor and potentially sell user data, even if encrypted.
- WARP enhances privacy by encrypting more traffic, preventing snooping.
- Cloudflare commits to user privacy, promising never to sell data.
- WARP+ offers access to a broader network, reducing latency and improving speed by connecting to more Cloudflare data centers.
- Built on a fast and reliable network, WARP ensures quick connections globally.
- As of August 2024, millions use WARP to secure their phone Internet connections.
- WARP protection is now available on macOS and Windows.
- Businesses can integrate WARP with Gateway to protect remote workers from online threats.
Cloudflare 1.1.1.1 Is Down
10 months ago
- The Internet was originally designed for stationary computers, leading to outdated assumptions affecting speed and security today.
- 1.1.1.1 with WARP modernizes and optimizes the connection between devices and the Internet.
- Internet service providers can monitor and potentially sell user data, even if it's encrypted.
- WARP encrypts traffic to prevent snooping and ensures user privacy.
- Cloudflare commits to not selling user data, upholding privacy as a right.
- WARP+ subscribers benefit from a larger network, reducing latency and improving browsing speed.
- WARP leverages Cloudflare's fast and reliable global network.
- WARP is available for mobile, macOS, and Windows, with plans to protect businesses through integration with Gateway.
- Millions use WARP to secure their Internet connections, with extended protection for macOS and Windows users.
The IRS Is Building a System to Share Taxpayers' Data with ICE
10 months ago
- The IRS is developing a system to provide ICE with automated access to confidential taxpayer addresses, potentially enabling mass deportations.
- Acting IRS general counsel Andrew De Mello refused ICE's request for 7.3 million taxpayer addresses, citing legal deficiencies, and was subsequently forced out of his position.
- A memorandum of understanding between DHS and IRS includes legal safeguards, but ICE's request for millions of records allegedly does not meet these requirements.
- Privacy laws historically limit IRS data sharing with law enforcement, and unauthorized disclosure of taxpayer information is a felony.
- The new system could lead to incorrect addresses being provided to ICE, resulting in wrongful targeting of individuals.
- IRS engineers and lawyers have expressed concerns about legal risks and ethical implications of the new system.
- A federal judge ruled that the broader agreement between DHS and IRS complies with existing law, allowing the system's development to proceed.
- DHS has proposed expanding the agreement to include data on U.S. citizens or lawful permanent residents associated with criminal activities.
- Critics argue the system could be abused, allowing unprecedented access to IRS records for non-tax-related purposes.
- The Trump administration is integrating multiple government agencies into its deportation efforts, including the IRS and Social Security Administration.
Cookies Having Independent Partitioned State (Chips)
10 months ago
- CHIPS (Cookies Having Independent Partitioned State) allows developers to opt cookies into partitioned storage, preventing cross-site tracking while enabling legitimate third-party cookie uses.
- Partitioned cookies are double-keyed by the setting origin and the top-level page origin, restricting access to the context of the top-level site.
- CHIPS introduces a 'Partitioned' attribute for the Set-Cookie header, requiring cookies to be set with 'Secure' and optionally using the '__Host' prefix for domain binding.
- The mechanism uses two keys for storage: the host key and a partition key based on the top-level URL's scheme and eTLD+1, ensuring cookies are only accessible under matching partition keys.
- CHIPS supports legitimate uses like persisting state across subdomains (e.g., chat widgets) while blocking unauthorized cross-site tracking.
- It differs from Firefox's state partitioning by allowing opt-in to third-party cookies for non-tracking purposes.
- Compatibility and specifications are detailed, with references to further reading on the Privacy Sandbox.
Fully homomorphic encryption and the dawn of a private internet
10 months ago
- Fully Homomorphic Encryption (FHE) enables computations on encrypted data without decryption, ensuring privacy.
- FHE addresses the 'Achilles’ heel' of modern security by keeping data encrypted even during processing (in-use).
- Current FHE implementations are slow (1,000x to 10,000x overhead) and produce large ciphertexts (40x to 1,000x larger than plaintext).
- FHE performance is improving rapidly, with algorithms getting 8x faster each year, making it practical for more applications.
- Key applications of FHE include encrypted cloud computing, encrypted LLM inference, and confidential blockchain smart contracts.
- FHE uses lattice-based cryptography, which is believed to be quantum-resistant, making it future-proof against quantum computing threats.
- Noise management and bootstrapping are critical to FHE, allowing unlimited computations by periodically reducing noise in ciphertexts.
- FHE could revolutionize privacy on the internet, shifting from 'spy by default' to 'privacy by default' by keeping data encrypted at all times.
New VPN Service Can't Log Users by Design
10 months ago
- VP.net introduces a unique VPN approach using Intel SGX for hardware-enforced privacy, eliminating the need for user trust.
- Unlike traditional VPNs, VP.net's system separates user identity from web traffic within SGX enclaves, preventing even the provider from linking them.
- The service promises 'verified privacy' with open-source code and remote attestation to verify the integrity of the running software.
- VP.net's leadership includes VPN industry veterans and Bitcoin figures, emphasizing a zero-trust model where privacy is user-controlled.
- While innovative, VP.net acknowledges potential vulnerabilities in SGX hardware and commits to monitoring and updating its systems for security.
- The VPN's approach to privacy is novel but faces challenges in scalability and response to future SGX vulnerabilities.
NYPD Bypassed Facial Recognition Ban to ID Pro-Palestinian Student Protester
10 months ago
- FDNY used facial recognition software (Clearview AI) to help NYPD identify a pro-Palestinian protester at Columbia University, bypassing NYPD's restrictions on the technology.
- The protester, Zuhdi Ahmed, was charged with a felony but the case was dismissed by a judge who raised concerns about surveillance practices violating policies.
- Clearview AI matches uploaded photos with billions of images from social media and other websites, widely used by law enforcement but restricted by NYPD.
- FDNY accessed DMV records typically unavailable to NYPD, aiding in Ahmed's identification, which the judge ruled contravened NYPD policies.
- Ahmed's photos from social media, including high school events, were used to identify him, raising privacy and surveillance concerns.
- Legal Aid Society filed a lawsuit to uncover more about FDNY's use of facial recognition technology after FOIL requests were ignored.
- The case highlights potential loopholes in the POST Act, prompting calls for expanded oversight of surveillance technologies across city agencies.
- Council members are drafting new legislation to close loopholes, ensuring transparency and prohibiting agencies from using surveillance tech on behalf of law enforcement.
- Ahmed, now focused on his future, described the ordeal as emotionally taxing and felt the charges exploited laws meant to protect minorities.
ICE Is Getting Unprecedented Access to Medicaid Data
10 months ago
- ICE gains access to Medicaid data of nearly 80 million people to identify and locate immigrants.
- The agreement allows ICE to access sensitive information including home addresses, phone numbers, and social security numbers.
- The data-sharing initiative is part of the Trump administration's broader crackdown on immigration.
- Medicaid, a health care program for low-income individuals, includes some non-citizens like refugees and asylum seekers.
- Critics warn the move could deter immigrants from seeking medical care due to fear of deportation.
- The agreement is set to last two months, with potential for renewal.
- ICE will have direct access to the T-MSIS database, which contains detailed Medicaid and CHIP data.
- Privacy advocates argue the data-sharing violates the Privacy Act and undermines trust in government services.
- The agreement is not classified as a computer matching agreement, raising legal concerns.
- Similar data-sharing arrangements exist with other agencies, including the IRS and ORR.
Evolution Mail Users Easily Trackable Part 2
10 months ago
- Evolution Mail has a DNS prefetching bug that exposes users' open times and DNS resolver IPs.
- Another bug with 'link rel=preconnect' exposes the end user's IP address, which is worse.
- A new test has been added to the Email Privacy Tester for this issue.
- The Evolution Mail Project dismissed the issue, refusing to add a warning in the UI.
- The author criticizes the project for mishandling the bug and failing users' privacy expectations.
- The project locked the bug thread after feeling offended by the criticism.
Getting off US tech: a guide
10 months ago
- The article discusses the author's journey to reduce dependence on US tech services due to concerns over US corporate dominance and regulatory issues.
- Proton is highlighted as a comprehensive alternative suite for email, cloud storage, VPN, and more, despite some controversy around its CEO.
- Other non-US service suites mentioned include Zoho and Mailbox, with options like Framasoft and NextCloud for more tech-savvy users.
- For essential services, alternatives like ProtonMail for email, Ecosia and Qwant for search, and Vivaldi for browsing are recommended.
- Office software alternatives include OnlyOffice, Collabora Office, and LibreOffice, with challenges noted in escaping Google Docs due to widespread use.
- The article covers alternatives in social media (Mastodon, PeerTube), messaging (Signal, Wire), and maps (Here WeGo, OpenStreetMap).
- Entertainment alternatives focus on local streaming services over US-based ones, with mentions of Deezer for music and open-source podcast apps.
- Hardware alternatives include non-US brands like Sony, Asus, and FairPhone, though the author remains in the Apple ecosystem for now.
- The importance of digital sovereignty and reducing screen time is emphasized, alongside the need for government action to support alternatives.
- Additional resources are provided for finding non-US alternatives in various regions.
Frequently Asked Questions about FHE
10 months ago
- FHE allows operations on encrypted data without decryption, ensuring privacy.
- FHE schemes can implement operations like addition, multiplication, and even comparisons through polynomial approximations.
- FHE performance is improving, with applications like facial recognition possible in seconds on a GPU.
- FHE is secure against quantum computers, using similar hardness assumptions as NIST-standardized PQC methods.
- FHE is used in production for specific applications, with more in development.
- FHE does not require encrypting everything; interactions between plaintext and ciphertext data are possible.
- FHE is not suitable for training LLMs on encrypted data but can convert trained models to work on encrypted data.
- FHE's killer app is yet to be discovered, with potential in legal, insider risk, and new service scenarios.
- FHE is compared to local computation, TEEs, and other privacy-enhancing technologies, with trade-offs in security and performance.
- FHE's mathematical structure does not necessarily weaken security, with no successful attacks discovered yet.
My Ultimate Self-Hosting Setup
10 months ago
- The author shares their journey to a stable self-hosting setup after years of experimentation.
- Primary goals include data control, privacy, and usability for family and friends.
- Key requirements: minimize public internet exposure, reduce misconfiguration risks, ensure core component ownership, and maintain usability.
- Technologies used: NixOS for system configuration, ZFS for data protection, Tailscale for secure networking, and Authelia & LLDAP for authentication.
- Setup includes a public server for essential services and a private server for most applications.
- Specialized appliances handle critical functions like smart home management and chat services.
- Solutions for common problems include a service start page for easy access and combining Tailscale with other VPNs.
- Auth setup tips: prefer OpenID Connect, maintain separate admin accounts, and configure access controls carefully.
- Future plans include improving backups, enhancing security, and adding new services.
Simon Willison has a plan for the end of the world. It's a USB stick
10 months ago
- Running LLMs locally is now feasible on personal computers, even smartphones.
- Local LLMs offer privacy, independence from big tech, and customization.
- OpenAI, Google, and Anthropic train models on user data, raising privacy concerns.
- Local models provide consistency and control, unlike frequently updated online models.
- Smaller, local models can help users recognize and understand AI hallucinations.
- Tools like Ollama and LM Studio simplify running local LLMs for non-coders.
- Model performance depends on device RAM; smaller models can run on phones.
- Local LLMs are fun and educational, though not necessary for everyone.
Ring introducing new feature to allow police to live-stream access to cameras
10 months ago
- Jamie Siminoff returns as Ring's CEO, reinstating a surveillance-first approach.
- Ring reintroduces features allowing police to request footage and live-stream access from users.
- Rollback of reforms threatens civil liberties, with past misuse of footage by police.
- New 'AI first' direction raises concerns about video analytics and facial recognition.
- Employees must demonstrate AI use for promotions, indicating a shift in company priorities.
- Partnership with Axon to develop tools for direct police access to Ring footage.
- Previous reforms, like end-to-end encryption and ending police partnerships, are being reversed.
- Criticism arises as violent crime rates are historically low, questioning the motive behind increased surveillance.
- Ring's actions align with a trend of tech companies profiting from surveillance and techno-authoritarianism.
- FTC previously intervened to ensure Ring took user privacy seriously.
Hacking a Toniebox
9 months ago
- The Toniebox is a music box for kids that uses NFC figurines to play audio content.
- Audio files are stored in the cloud, not on the NFC tags, requiring an internet connection.
- Toniebox tracks user interactions, including playback progress, and sends data to two URLs: prod.de.tbs.toys and rtnl.bxcl.de.
- Privacy concerns exist as tracking data is linked to user accounts, but rtnl.bxcl.de can be blocked to limit tracking.
- The reliance on cloud services raises concerns about long-term access to purchased content.
- The Toniebox can be disassembled to access an SD card containing OPUS-encoded audio files, which can be backed up.
- Tools like teddyBench and teddyCloud allow for metadata reading, audio file splitting, and custom content management.
- Advanced hacking includes flashing custom firmware, replacing TLS certificates, and hardware modifications for accessibility.
- The Toniebox community has reverse-engineered the device extensively, enabling various customizations and hacks.
- Despite initial reservations, the author appreciates the Toniebox for its appeal to children and the creative hacks it enables.
Occasionally USPS sends me pictures of other people's mail
9 months ago
- The author has been using USPS Informed Delivery for over 5 years and generally likes it.
- Occasionally, the service shows scans of mail not addressed to the author, which is a privacy concern.
- The example provided includes two pieces of mail: one addressed to the author and another to an unknown neighbor.
- The author, being security-conscious, finds it interesting that USPS shares images of others' mail, implying their mail might also be seen by neighbors.
How to Firefox
9 months ago
- Chrome has limited uBlock Origin's functionality with Manifest V3, making Firefox a better alternative.
- Firefox is 100% open-source, allowing for customization and transparency.
- Firefox helps un-enshittify the web by supporting powerful ad-blockers like uBlock Origin.
- Android users benefit from Firefox's seamless sync and real browser extensions, including uBlock Origin.
- Firefox offers extensive customization options, including privacy tweaks and add-ons like Dark Reader and Stylus.
- Firefox's Total Cookie Protection and container technology enhance privacy and multi-account management.
- Hidden gems in Firefox include quick find features and bypassing right-click restrictions.
- Firefox's about:config allows for deep customization, such as controlling tab behavior.
Blip: Peer-to-Peer Massive File Sharing by Former Dropbox Engineers
9 months ago
- Blip allows sending files of any size directly from desktop without size limits.
- Transfers resume after interruptions like network issues or unplugged drives.
- Supports sending folders without zipping and maintains folder structures.
- Lightweight native apps ensure minimal battery drain.
- Enables sending to any device globally, similar to AirDrop but more versatile.
- Files are sent in full quality without compression.
- Features boosted speeds and in-transit TLS 1.3 encryption for privacy.
- Free for non-commercial use with plans available for commercial projects.
- LAN direct connect boosts speeds for devices on the same network.
- Blip is not a cloud storage but a fast file transfer tool.
- Compatible with various devices and operating systems.
- Secure, direct transfers without public links or uploads to websites.
A power utility is reporting suspected pot growers to cops. EFF says illegal
9 months ago
- Sacramento residents Alfonso Nguyen and Brian Decker were accused of illegal cannabis cultivation based on high electricity usage.
- Sacramento Municipal Utility District (SMUD) flagged over 33,000 customers to the Sheriff’s department for suspicious power usage patterns.
- SMUD analyzes electricity usage in 15-minute increments and reports suspected illegal grows to law enforcement.
- The Electronic Frontier Foundation (EFF) argues this practice violates privacy rights and seeks a court order to stop warrantless disclosures.
- EFF cites cases where SMUD’s suspicions were incorrect, including cryptocurrency mining and medical equipment usage.

first prev13next

About|Login

#privacy

Data Brokers Are Selling Your Flight Information to CBP and ICE

1.1.1.1 Is Down

Cloudflare 1.1.1.1 Is Down

The IRS Is Building a System to Share Taxpayers' Data with ICE

Cookies Having Independent Partitioned State (Chips)

Fully homomorphic encryption and the dawn of a private internet

New VPN Service Can't Log Users by Design

NYPD Bypassed Facial Recognition Ban to ID Pro-Palestinian Student Protester

ICE Is Getting Unprecedented Access to Medicaid Data

Evolution Mail Users Easily Trackable Part 2

Getting off US tech: a guide

Frequently Asked Questions about FHE

My Ultimate Self-Hosting Setup

Simon Willison has a plan for the end of the world. It's a USB stick

Ring introducing new feature to allow police to live-stream access to cameras

Hacking a Toniebox

Occasionally USPS sends me pictures of other people's mail

How to Firefox

Blip: Peer-to-Peer Massive File Sharing by Former Dropbox Engineers

A power utility is reporting suspected pot growers to cops. EFF says illegal