Hasty Briefsbeta

All tags

#privacy

903 stories total

Bilingual

Google Starts Scanning All Your Emails After Gmail Upgrade
a year ago
- Google is updating Gmail with AI features, raising concerns about privacy and security.
- New AI-driven 'Contextual Smart Replies' powered by Gemini analyze email threads to generate detailed responses.
- These features are available for Workspace Business and Enterprise editions, with options to enable or disable them.
- Google warns that Gemini's suggestions may be inaccurate and should not be considered professional advice.
- Privacy concerns arise as AI scrutinizes private and confidential information within emails.
- Google offers opt-outs and privacy guidance, leaving the decision to users and companies.
- End-to-end encryption in Gmail prevents AI from processing encrypted emails, highlighting the privacy debate.
Sam Altman Wants Your Eyeball
a year ago
- OpenAI's CEO Sam Altman announced the expansion of the World project (formerly Worldcoin), which involves scanning users' eyeballs for biometric verification.
- The World App offers a 'proof of personhood' via iris scans, storing unique identifiers on a blockchain, and includes features like cryptocurrency management, gaming, and social interactions.
- Critics highlight unethical practices, including exploiting vulnerable populations in developing countries by offering financial incentives for biometric data.
- Privacy concerns arise due to the irreversible nature of biometric data, potential for misuse, and lack of robust legal protections globally.
- Several countries, including Kenya, Brazil, and Indonesia, have banned or suspended Worldcoin's operations over privacy and security violations.
- The project's partnerships with major companies like Tinder and Visa raise fears of widespread mandatory biometric verification.
- The normalization of surveillance and the concentration of power in a single for-profit corporation pose significant risks to privacy and human rights.
Email Forwarding for Your Domain
a year ago
- 7-day free trial with easy cancellation.
- Paid subscription model ensures high service quality and quick customer support (30-minute response during U.S. business hours).
- No email storage unless explicitly requested; all data encrypted with Transparent Data Encryption.
- Unlimited email inbox creation with forwarding to preferred addresses.
- Multi-recipient forwarding for alias emails, similar to mailing groups.
- Catch-all addresses ensure no important emails are missed.
- Send emails via Mailwip SMTP server for a professional appearance (no 'via' tag in Gmail).
- Maillog feature enables direct replies from the web interface, functioning like webmail.
- Temporary email aliases for one-time use with untrusted services.
- Detailed incoming email history for debugging (disabled by default for privacy).
- Webhook integration for processing emails (e.g., POST request with email data as JSON).
- Slack integration for team email visibility without inbox checks.
- REST API for fetching emails and domain data.
- CLI tool for tailing emails and local webhook listening.
- Fast email delivery (under 5 seconds).
- Maillogs assist if emails are mistakenly flagged as spam.
- Only essential data stored for functionality.
- User-friendly UI/UX with guided onboarding.
- Expert support for MX records, SPF, and email delivery issues (docs, email, live chat).
Airlines Are Selling Your Data to ICE
a year ago
- Airlines Reporting Corporation (ARC) collects and sells passenger data to ICE and other federal agencies.
- ARC processes data for 12 billion flights annually, covering 54% of global flights.
- Data includes flight itineraries, passenger names, and financial details, accessible via the Travel Intelligence Program.
- ARC is jointly owned by nine major airlines, including Delta, United, and American Airlines.
- Privacy experts raise concerns over civil liberties due to unrestricted government access to vast passenger data.
- Federal agencies like ICE, DOD, and Treasury have contracts with ARC for travel data access.
- ARC's database holds over one billion records, spanning 39 months of past and future travel data.
- No alternative clearinghouse exists, making ARC's monopoly over airline passenger data a significant concern.
- Contracts with federal agencies have earned ARC over $1.3 million since 2024.
- Critics question privacy safeguards and potential misuse of data amid Trump's immigration crackdown.
I hacked a dating app (and how not to treat a security researcher)
a year ago
- Cerca Dating App had severe security vulnerabilities exposing private messages, passport information, and sexual preferences.
- The vulnerabilities included broken OTP authentication and open API endpoints, allowing unauthorized access to user data.
- A security researcher responsibly disclosed the issues to Cerca, but the company failed to respond or notify users despite patching the vulnerabilities.
- Exploits enabled access to over 6,000 user profiles, including sensitive ID documents and personal details.
- The lack of security measures could lead to identity theft, stalking, and blackmail, highlighting the need for better app security practices.
Build Your Own Siri. Locally. On-Device. No Cloud
a year ago
- The article discusses the potential of running AI models locally on devices for privacy and efficiency.
- It introduces a mini-course on building a local voice assistant that understands natural language and executes app functions offline.
- The course covers fine-tuning LLaMA 3.1 8B with LoRA, creating a function-calling dataset, and running inference locally.
- It emphasizes the importance of MLOps principles even for local-only AI systems to ensure reliability and avoid silent failures.
- The system overview includes dataset generation, instruction tuning for function calling, and testing the model in the MAC ecosystem.
- The article is aimed at developers building privacy-first mobile apps and teams deploying apps in sensitive environments.
- The mini-course is free and includes hands-on lessons with a GitHub repository for practical implementation.
"Google wanted that": Nextcloud decries Android permissions as "gatekeeping"
a year ago
- Nextcloud is a self-hosted cloud platform aiming to replace services like Google Workspace with features like video chat, file storage, and collaborative editing.
- Since mid-2024, Google has allegedly blocked Nextcloud's Android app from uploading non-media files, limiting its functionality.
- Nextcloud claims it had full file access since its first Android app but was suddenly denied in September 2024 without clear reasons.
- Google's responses to Nextcloud's appeals have been described as unhelpful, with repetitive or generic replies.
- The situation highlights concerns over user control and privacy in modern computing ecosystems.
Making my app worse because of macOS privacy protections
a year ago
- Apple introduced a new macOS feature that alerts users when an app programmatically reads the general pasteboard without user input.
- Developers can test this behavior using a Terminal command: `defaults write <your_app_bundle_id> EnablePasteboardPrivacyDeveloperPreview -bool yes`.
- Link Unshortener triggers an alert on launch because it checks the pasteboard for URLs to auto-fill in new windows.
- The new alert lacks options to always allow access, explain why access is needed, or avoid permission requests on first launch.
- The author decided to remove the auto-fill feature from Link Unshortener to avoid the negative user experience of the alert.
- A new System Settings section will allow users to manage pasteboard permissions, but the alert itself is minimal and unhelpful.
- Apple may introduce a new `Info.plist` key to specify reasons for pasteboard access, similar to other privacy-related keys.
- The alert's existence forces tradeoffs between security and usability, leading to reduced app functionality.
- Other apps may face worse issues if they rely heavily on pasteboard access as a core feature.
- Enabling the feature globally caused problems in apps like Google Chrome and Safari, leading to inconsistent behavior.
EU ruling: tracking-based advertising [...] across Europe has no legal basis
a year ago
- Belgian Court of Appeal ruled the 'Transparency & Consent Framework' (TCF) illegal, impacting 80% of the internet.
- TCF is used by major tech companies like Google, Microsoft, Amazon, and X for tracking-based advertising.
- The decision was prompted by complaints coordinated by Dr. Johnny Ryan and others, highlighting deceptive consent practices.
- Real-Time Bidding (RTB) system, which TCF legally covered, tracks and broadcasts user data without proper security or consent.
- The ruling confirms the Belgian Data Protection Authority's 2022 findings and applies immediately across Europe.
- Dr. Ryan emphasized the need for industry innovation away from tracking-based advertising, benefiting users and publishers.
Appeals court rules that tracking-based online advertising is illegal in Europe
a year ago
- Belgian Court of Appeal ruled the Transparency and Consent Framework (TCF) illegal under GDPR.
- TCF, used for online advertising, violates GDPR principles by tracking individuals' activities with cookies.
- The decision upholds a 2022 ruling by the Belgian Data Protection Authority.
- Real-time bidding (RTB) in advertising relies on tracking data deemed illegal.
- IAB Europe, which created TCF, is relieved it wasn't deemed a joint controller for data collected.
- IAB Europe has proposed changes to TCF to reflect 'limited controllership'.
- Privacy advocates see this as a win, but next steps for advertisers remain unclear.
- Consent pop-ups may persist as regulators oversee changes to TCF.
California sent residents' personal health data to LinkedIn
a year ago
- Covered California's health insurance website, coveredca.com, was found sending sensitive user data to LinkedIn via trackers.
- Data shared included health conditions like blindness, pregnancy, and transgender status, as well as prescription medication use and domestic abuse status.
- Trackers were removed after The Markup and CalMatters reported the issue, with Covered California citing a 'marketing agency transition'.
- LinkedIn's Insight Tag was used to collect visitor data for targeted advertising, despite LinkedIn's policies against tracking sensitive health data.
- Experts criticized the practice as invasive, highlighting the lack of consumer awareness and consent.
- Covered California has initiated a review of its privacy protocols to prevent future data sharing issues.
- LinkedIn faces multiple lawsuits over similar data collection practices, including medical appointment tracking.
- California's Confidentiality of Medical Information Act requires consumer consent for sharing medical data, but enforcement remains inconsistent.
- Advocates argue for stronger regulations to protect sensitive health information from unauthorized tracking.
Old and Small Technology
a year ago
- Old technology refers to outdated tech, while small technology has a minimal footprint and lacks bloat or spyware.
- Old tech is often small due to historical limitations, but some modern tech like embedded systems also qualifies as small.
- Small tech benefits include being easy to use, private, peer-to-peer, zero-knowledge, non-colonial, personal, share-alike, interoperable, non-commercial, and inclusive.
- Old and small technologies like UUCP, Gopher, and Usenet offer advantages such as lower resource consumption, affordability, and environmental friendliness.
- Small tech promotes sustainability by reducing planned obsolescence and enabling older hardware to remain functional.
- Older tech, especially Free Software, enhances user control and privacy by avoiding modern privacy-violating features.
- Modern adaptations of old tech (e.g., NNCP, Gemini) incorporate improvements like encryption while retaining small-tech benefits.
- New developments in small tech include Meshtastic and Yggdrasil, focusing on secure, decentralized communication.
- Examples of old and small tech include UUCP, Kermit, Usenet, Gopher, Raspberry Pi, and Linux (depending on usage).
- Projects like the Small Web aim to apply small-tech principles to the modern web, while alternatives like Gemini offer lightweight browsing.
- Operating systems like Linux Lite and Debian (with lightweight desktops) work well on older or low-power hardware.
- Organizations promoting small tech include the Small Technology Foundation, Low-Tech Magazine, and the Plain Text Project.
The Crypto Anarchist Manifesto (1988)
a year ago
- Crypto anarchy is emerging as a transformative force in modern society, enabling anonymous interactions and transactions.
- Advancements in computer technology, such as public-key encryption and zero-knowledge proofs, are making anonymous communication feasible.
- The state may attempt to curb crypto anarchy due to concerns over national security, crime, and societal impact, but its spread is inevitable.
- Crypto anarchy will fundamentally alter government regulation, taxation, and the nature of trust and reputation in economic dealings.
- The technology will create a liquid market for all forms of information, challenging traditional concepts of intellectual property.
Postman is logging all your secrets and environment variables
a year ago
- Postman logs all secrets and environment variables, making it unsuitable for healthcare applications due to privacy concerns.
- Charles Proxy was instrumental in uncovering Postman's logging practices, revealing extensive data collection.
- Postman sends unencrypted environment variables and secrets to its servers, regardless of whether they are marked as 'secret'.
- The tool's claim to protect sensitive data is contradicted by its logging practices.
- The article calls for ethical considerations in software development, highlighting the lack of a Hippocratic Oath for developers.
Google's Advanced Protection for Vulnerable Users Comes to Android
a year ago
- Tech giants like Apple, Google, and Microsoft are focusing on protecting high-risk users from targeted threats.
- Apple's iOS Lockdown Mode (2022) sacrifices functionality for security, targeting public figures, activists, and journalists.
- Google's Advanced Protection program adds extra security layers to vulnerable users' Google accounts.
- Google is extending Advanced Protection with new features for Android 16, including a dedicated mode for enhanced security.
- Advanced Protection on Android enforces strong security settings, silos data, and reduces interactions with unsecured services.
- Google uses on-device AI scanning for monitoring and alerts without removing features entirely.
- Mandatory restrictions include blocking 2G networks and disabling Chrome's JavaScript optimizer.
- Intrusion Logging, a new feature, uses end-to-end encryption to store tamper-proof logs in the cloud.
- Memory Tagging Extension (MTE) prevents memory-based attacks like buffer overflows by causing processes to fail.
- Advanced Protection features will roll out with Android 16, with Intrusion Logging and USB protections coming later.
- Google is providing an API for third-party apps to integrate Advanced Protection for deeper security.
Outlook stores email in Microsoft Cloud – what you need to know
a year ago
- Recent changes to Outlook involve Microsoft's cloud service acting as a middleman for email access, raising privacy concerns.
- Emails and authentication details are now stored on Microsoft's cloud servers, not just on the user's device.
- Microsoft claims the new system improves performance and integrates better with Microsoft 365 services.
- Privacy concerns include broad permissions, unclear data jurisdiction, and lack of control over data storage.
- Microsoft complies with GDPR but personal accounts may not be fully covered by the EU Data Boundary.
- Alternatives include using Runbox Webmail, different email clients like Thunderbird, or sticking to older Outlook versions.
O2 VoLTE: locating any customer with a phone call
a year ago
- VoLTE uses IP Multimedia Subsystem (IMS) for internet-based calls on mobile networks.
- IMS complexity has led to device incompatibility and security concerns.
- O2 UK's IMS implementation, '4G Calling', launched in 2017, exposes sensitive data in SIP messages.
- Headers in SIP messages reveal IMSIs, IMEIs, and Cell IDs of callers and recipients.
- Cell ID data can be used to geolocate users with high accuracy, even when roaming.
- O2 lacks a clear escalation route for reporting security vulnerabilities.
- No response from O2 after attempts to report the privacy risk in March 2025.
Wacom drawing tablets track the name of every application you open
a year ago
- Wacom drawing tablets track and send data about every application opened by the user to Google Analytics.
- The author discovered this tracking while installing Wacom drivers and reading the privacy policy, which vaguely mentions data collection.
- Using tools like Wireshark and Burp Suite, the author intercepted and analyzed the data being sent, revealing intrusive tracking of application usage.
- Wacom's privacy policy does not explicitly state the extent of data collection, raising concerns about transparency and user consent.
- The author argues that such tracking is unnecessary for a device like a drawing tablet and highlights potential privacy risks.
- A method to disable tracking was found by opting out of the 'Wacom Experience Program' in the Wacom Desktop Center.
- The tracking was temporarily disabled by Wacom, possibly due to a server error, but later resumed, confirming the ongoing data collection.
Mobile, Open Hardware, RISC-V System-on-Chip (SoC) Development Kit
a year ago
- Precursor is an open hardware development platform for secure, mobile computation and communication.
- Features a built-in display, physical keyboard, and internal battery, remaining smaller and lighter than a smartphone.
- Powered by an FPGA-hosted, soft-core System-on-Chip (SoC), allowing full customization and inspection.
- Includes the vault app for password management with features like U2F authenticator and auto-typing passwords.
- Supports Plausibly Deniable DataBase (PDDB) for encrypted data storage with secret overlays.
- Allows encrypted backup and restoration of the PDDB via USB.
- Designed for evidence-based trust, with open-source hardware and software for full transparency.
- Portable design with a slim, machined-aluminum case, efficient power usage, and long battery life.
- Targeted at security-critical applications like password managers, crypto wallets, and secure messaging.
- Comparison with other devices shows Precursor's unique position in trustability, hackability, and portability.
Show HN: TitleBridge - A FinalCut Workflow Plugin
a year ago
- Requires Mac with Apple Silicon (M1 or better) for optimal functionality, especially for audio transcription in Final Cut Pro.
- TitleBridge does not automatically collect or send user information, ensuring privacy.
- Support is available via public comments on the page, with private follow-up through GitHub for issue resolution.

first prev5next

About|Login

#privacy

Google Starts Scanning All Your Emails After Gmail Upgrade

Sam Altman Wants Your Eyeball

Email Forwarding for Your Domain

Airlines Are Selling Your Data to ICE

I hacked a dating app (and how not to treat a security researcher)

Build Your Own Siri. Locally. On-Device. No Cloud

"Google wanted that": Nextcloud decries Android permissions as "gatekeeping"

Making my app worse because of macOS privacy protections

EU ruling: tracking-based advertising [...] across Europe has no legal basis

Appeals court rules that tracking-based online advertising is illegal in Europe

California sent residents' personal health data to LinkedIn

Old and Small Technology

The Crypto Anarchist Manifesto (1988)

Postman is logging all your secrets and environment variables

Google's Advanced Protection for Vulnerable Users Comes to Android

Outlook stores email in Microsoft Cloud – what you need to know

O2 VoLTE: locating any customer with a phone call

Wacom drawing tablets track the name of every application you open

Mobile, Open Hardware, RISC-V System-on-Chip (SoC) Development Kit

Show HN: TitleBridge - A FinalCut Workflow Plugin