Nostr notes by jsr

If you're pissing off the powerful interests, watch this ...

2026-03-31T21:46:31Z

If you're pissing off the powerful interests, watch this video.

Follow along. Get safer.

They showed us cute missing dogs & we consented to opt into a ...

2026-02-09T21:08:11Z

They showed us cute missing dogs & we consented to opt into a mass human tracking system.

I think Ring's wants to be Flock. On steroids.

Because instead of just sketchy cameras in parking lots, Search Party will cover your own backyards & homes.

And if you & your neighbors want to challenge the loss of privacy? Well, how exactly would you do that effectively?

Because, instead of going to the city council, looking at the contracts, and calling out your mayor for speeding your city to dystopia, it's massive and distributed.

Will you even know which of your neighbors is now helping to feed the system?

If we had half competent privacy regulators & laws in the US this kind of thing would be a big, hard fight for Ring.

Instead? It's a Super Bowl commercial.

Oh, and yeah Ring has already partnered with Flock Safety to incorporate tools letting the government directly request footage

What are the rules around adding things like sodium metabisulfite ...

2026-02-06T19:10:37Z

In reply to nevent1q…g4en
_________________________

What are the rules around adding things like sodium metabisulfite et al?

I TRUST YOU BUT YOUR AI AGENT IS A SNITCH: Why We Need a New ...

2026-02-04T15:15:54Z

I TRUST YOU BUT YOUR AI AGENT IS A SNITCH: Why We Need a New Social Contract

We’re chatting on Signal, enjoying encryption, right? But your DIY productivity agent is piping the whole thing back to Anthropic.

Friend, you’ve just created a permanent subpoena-able record of my private thoughts held by a corporation that owes me zero privacy protections.

Even when folks use open-source agents like #openclaw in decentralized setups, the default /easy configuration is to plug in an API resulting in data getting backhauled to Anthropic, OpenAI, etc.

And so those providers get all the good stuff: intimate confessions, legal strategies, work gripes. Worse? Even if you’ve made peace with this, your friends absolutely haven’t consented to their secrets piped to a datacenter. Do they even know?

Governments are spending a lot of time trying to kill end-to-end encryption, but if we’re not careful, we’ll do the job for them.

The problem is big & growing:

Threat 1: proprietary AI agents. Helpers inside apps or system-wide stuff. Think: desktop productivity tools by a big company. Hello, Copilot. These companies already have tons of incentive to soak up your private stuff & are very unlikely to respect developer intent & privacy without big fights (Those fights need to keep happening)

Threat 2: DIY agents that are privacy leaky as hell, not through evil intent or misaligned ethics, but just because folks are excited and moving quickly. Or carelessly. And are using someone’s API.

I sincerely hope is that the DIY/ OpenSource ecosystem that is spinning up around AI agents has some privacy heroes in it. Because it should be possible to do some building & standards that use permission and privacy as the first principle.

Maybe we can show what’s possible for respecting privacy so that we can demand it from big companies?

Respecting your friends means respecting when they use encrypted messaging. It means keeping privacy-leaking agents out of private spaces without all-party consent.

Ideas to mull (there are probably better ones, but I want to be constructive):

Human only mode/ X-No-Agents flags
How about converging on some standards & app signals that AI agents must respect, absolutely. Like signals that an app/chat can emit & be opted out of exposure to an AI agent.

Agent Exclusion Zones
For example, starting with the premise that the correct way to respect developer (& user intent) with end to end encrypted apps is that they not be included, perhaps with the exception [risky tho!] of whitelisting specific chats etc. This is important right now since so many folks are getting excited about connecting their agents to encrypted messengers as a control channel, which is going to mean lots more integrations soon.

#NoSecretAgents Dev Pledge
Something like a developer pledge that agents will declare themselves in chat and not share data to a backend without all-party consent.

None of these ideas are remotely perfect, but unless we start experimenting with them now, we're not building our best future.

Next challenge? Local Only / Private Processing: local-First as a default.
Unless we move very quickly towards a world where the processing that agents do is truly private (e.g. not accessible to a third party) and/or local by default, even if agents are not shipping signal chats, they are creating an unbelievably detailed view into your personal world, held by others. And fundamentally breaking your own mental model of what on your device is & isn't under your control / private.

NEW: Microsoft turned over Bitlocker keys to FBI. ...

2026-01-23T11:49:22Z

NEW: Microsoft turned over Bitlocker keys to FBI.

When you key escrow your disk encryption with someone, they can be targeted with a warrant.

This case is a really good illustration that if you nudge users with a default to save their keys with you... they will do so & may not fully understand the implications.

Of course, once the requests start working... they are likely to accelerate.

Story: https://www.forbes.com/sites/thomasbrewster/2026/01/22/microsoft-gave-fbi-keys-to-unlock-bitlocker-encrypted-data/

Suddenly hearing about zcash everywhere. Feels inorganic. ...

2025-11-15T12:20:00Z

Suddenly hearing about zcash everywhere.

Feels inorganic.

What's up?

POV: you can't sleep because your bed can't talk to AWS. ...

2025-10-21T09:54:04Z

POV: you can't sleep because your bed can't talk to AWS.

Design thinking that inserts brittle dependence into our lives while extracting fees for life.

Don't be these guys.

NEW: 🇰🇵DPRK hackers have begun hiding malware on ...

2025-10-17T10:15:59Z

NEW: 🇰🇵DPRK hackers have begun hiding malware on blockchain.

Result, decentralized, immutable malware from a government crypto theft operation.

It only cost $1.37 USD in gas fees per malware change (e.g. to update the command & control server)

Blockchains as malware dead drops are a fascinating, predictable evolution for nation state attackers.

And Blockchain explorers are a natural target.

Nearly impossible to remove.

Experimentation with putting malware on blockchains is in infancy.

Ultimately there will be some efforts to try and implement social engineering protection around this, but combined with things like agentic AI & vibe coding by low-information people...whew boy this gold seam is going to be productive for a long time.

Still, where here they used social engineering, I expect attackers to also experiment with directly loading zero click exploits onto blockchains targeting things like blockchain explorers & other systems that process blockchains... especially if they are sometimes hosted on the same systems & networks that handle transactions / have wallets.

REPORT: https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding

NEW: breach of Discord age verification data. For some users this ...

2025-10-05T17:05:09Z

NEW: breach of Discord age verification data.

For some users this means their passports & drivers licenses.

Discord has only run age verification for 6 months.

Age verification is a badly implemented data grab wrapped in a moral panic.

Proponents say age verification = showing your ID at the door to a bar.

But the analogy is often wrong.

It's more like: bouncer photocopies some IDs, & keeps them in a shed around back.

There will be more breaches.

But it should bother you that the technology promised to make us all safer, is quickly making us less so.

STORIES:

https://www.forbes.com/sites/daveywinder/2025/10/05/discord-confirms-users-hacked---photos-and-messages-accessed/

https://www.theverge.com/news/792032/discord-customer-service-data-breach-hack

PAY ATTENTION: The UK again asked Apple to backdoor iCloud ...

2025-10-01T14:05:54Z

PAY ATTENTION: The UK again asked Apple to backdoor iCloud encryption.

Backdoors create a massive target for hackers & criminal groups.

Dictators will inevitably demand that Apple build the same access structure for them.

They insert vulnerable bad things right at the place where we need the strongest protections.

This latest attempt to demand access is *yet another* unreasonable, secret demand on Apple (a TCN) from the Home Office....

https://www.ft.com/content/d101fd62-14f9-4f51-beff-ea41e8794265

NEW: foreign mercenary spyware is coming to the US. ICE just ...

2025-09-02T10:07:45Z

NEW: foreign mercenary spyware is coming to the US.

ICE just quietly unsuspended contract with spyware maker #Paragon.

They got caught this year being used to hack journalists.

Friend, let me me bring you up to speed on why this is bad on multiple fronts.

YOUR BACKGROUND BRIEF:

#Paragon was co-founded in Israel in 2019 by ex head of Israel's NSA equivalent (Unit 8200) w/ major backing from former Israeli PM Ehud Barak.

Pitched themselves as stealthy & abuse-proof alternative to NSO Group's Pegasus.

The company has been trying to get into the US market for years.

For a long time all we knew about Paragon was their performance as a 'virtuous' spyware company with values.

All that came to a crashing halt in 2025 when they got very caught, helping customers hack targets across #WhatsApp.

WhatsApp did the right thing & notified users.

Almost immediately after the WhatsApp notifications, we started learning about the targets.

They weren't the supposed serious criminals... They were Journalists... human rights defenders...groups working on sea rescues.. etc

In other words, a very NSO-like scandal.

Ultimately Paragon & its Italian customer had a massive spyware scandal on their hands.

WhatsApp wasn't the only player tracking paragon & doing user notifications. Apple got in on the game.

Ultimately, we at the Citizen Lab had forensically analyzed cases from each notification round.

We testified to Italy's parliamentary intelligence oversight committee about our findings.

The conclusion? Deeply unsatisfactory.

Italy admitted hacking some targets, but denied hacking journalists.
Tons of loose ends with Paragon. And they haven't been honest about who used their tech to hack journalists in Europe.

BIG PICTURE:

After 14 years investigating countless spyware companies, I tell you with confidence:

Mercenary spyware is a power abuse machine incompatible with American constitutional rights and freedoms.

Our legal system isn't designed for it, oversight mechanisms are woefully inadequate to protect our rights...

Here's the thing. You probably know that mercenary spyware like #Pegasus gets sold to dictators.

Who, predictably, abuse it.

But We have a growing pile of cases where spyware is sold to democracies... and then gets abused.

HISTORY LESSONS

History shows: secret surveillance usually winds up abused.

The history of the US is littered with surveillance abuses.

Thing is, our phones offer an unprecedented window into our lives.

Making zero-click mercenary spyware an especially grave risk to all our freedoms.

If the government has wants access to your accounts for law enforcement...they have to prepare a judicially authorized request and send it to the company, which reviews it.

Mercenary spyware bypasses any external review.

And the whole industry behind it seeks maximum obscurity.

COUNTERINTELLIGENCE THREATS? YEAH THAT TOO

I'm concerned about the impact on our rights an dour privacy.

But there's something else that should worry everybody about the choice to work with the company: Paragon poses a potentially grave counterintelligence threat to the US. Let me explain.

When you use an integrated spyware package to conduct sensitive law enforcement / intelligence business, you have to place a lot of trust in them...

If the developers originate from a foreign intelligence service that aggressively collects against the US government, that should be a huge red flag.

America (or any country) should be maximally wary about using foreign-developed surveillance tech for the same reason that America shouldn't operate a Chinese-made stealth fighter.

So, have Paragon's spyware, people & ops been aggressively vetted for technical and human counterintelligence risks?

MERCENARY SPYWARE = FATE SHARING
Paragon's #Graphite mercenary spyware shares the same downsides as other products in their class:

❌They keep getting caught

We researchers aren't the only ones that have found techniques for tracking and identifying Paragon spyware... I'm sure hostile govs have too.

❌Customers fate share.

Since all customers roll the same tech, when one gets caught it impacts & potentially exposes everyones' activities.

Now, that fate sharing will include US law enforcement activity.

WHAT CAN YOU DO?

What can you do? Take 5 minutes and call your member of Congress.

Ask them to request a briefing on Paragon.

They should ask whether the company was properly vetted & reviewed.

What is the oversight mechanism for this maximally invasive technology?

What are the guardrails? How would abuses be handled? Etc.

PERSONAL SECURITY?

Paragon & this category of spyware is fiendishly hard to track & defend against.

And on a personal level? Apple's Lockdown Mode & Android Advanced Protection both offer some serious security benefits but neither is a silver bullet..

Unfortunately, as of right now I am pretty confident that no publicly available / commercially developed third party tool can reliably detect Paragon spyware either in realtime. Or retrospectively.

Beware a false sense of security.

If you got this far & found this post useful, let me know! Drop a comment.

SELECTED READING LIST

Exclusive: ICE reactivated its $2 million contract with Israeli spyware firm Paragon, following its acquisition by U.S. capital
https://jackpoulson.substack.com/p/exclusive-ice-has-reactivated-its

Virtue or Vice? A First Look at Paragon’s Proliferating Spyware Operations
https://citizenlab.ca/2025/03/a-first-look-at-paragons-proliferating-spyware-operations/

Graphite Caught
First Forensic Confirmation of Paragon’s iOS Mercenary Spyware Finds Journalists Targeted
https://citizenlab.ca/2025/06/first-forensic-confirmation-of-paragons-ios-mercenary-spyware-finds-journalists-targeted/

Government‑mandated KYC to read is coming fast. And the walls ...

2025-08-23T22:29:52Z

Government‑mandated KYC to read is coming fast.

And the walls of castle freedom are cracking.

Nostr event nevent1qqsy39gfl9g8ygupdupjeegz24dqme0efnnalagdjctgahstn33nz8szypsf7xrv5q3avkxqlcqe2uz89av4vhytu8wpvwc4g8avnkg25n527sf68uk

2025-08-23T16:09:40Z

Why haven't mosquitoes evolved silent flight?

"everybody who's out there thinking of using VPNs, let me ...

2025-08-21T14:41:38Z

"everybody who's out there thinking of using VPNs, let me just say to you directly, verifying your age keeps a child safe...So let's just not try and find a way around. Just prove your age."

- UK government.

Location tracking based on interior pictures. It will be abused ...

2025-08-12T17:58:41Z

Location tracking based on interior pictures.

It will be abused to target people.

Post the inside your place at your peril.

Earliest days of vibecoding-as-a-target. Without a radical ...

2025-08-12T17:35:29Z

Earliest days of vibecoding-as-a-target.

Without a radical increase in security, vibecoders will get wiped out & lose their savings.

And their companies will get hit with fat breaches.

Me? I'm waiting for attackers to figure out how to reliably slip backdoors into vibecoded outputs at scale.

Neuroticism? Ripping. Conscientiousness & agreeableness? ...

2025-08-08T20:56:05Z

Neuroticism? Ripping.

Conscientiousness & agreeableness? Dipping.

Via FT: https://www.ft.com/content/5cd77ef0-b546-4105-8946-36db3f84dc43

NEW: 🇩🇪Germany's top court says spyware severely ...

2025-08-08T19:15:21Z

NEW: 🇩🇪Germany's top court says spyware severely violates fundamental rights.

Bans spyware in cases with <3year sentences.

Enforces tough proportionality tests on all surveillance.

Restricts spyware to serious cases.

Interesting development.

Court says: capturing data at the source (i.e. on someone's phone) is maximally invasive.

Especially given how much of our lives happens online.

They also surface the security risks to systems from this kind of surveillance.

Watching Germany's highest court grapple with spyware's invasiveness & rights violations is instructive.

States wielding spyware without robust legal limitations and tight judicial oversight... are almost guaranteed to be violating their citizens' basic rights.

In so many jurisdictions, state secrecy & lack of effective legal challenges means spyware harms happening daily

Huge credit to German digital freedoms organization #digitalcourage
for bringing this case.

Court statement:
https://www.bundesverfassungsgericht.de/SharedDocs/Pressemitteilungen/EN/2025/bvg25-069.html

Internet-connected microphones in school bathrooms. What could go ...

2025-08-08T17:35:23Z

Internet-connected microphones in school bathrooms.

What could go wrong?

Mandated microphones in private spaces are a bad idea.

Throwing invasive sensors into private spaces rarely fixes socially scary problems.

But is almost guaranteed to have risky downsides.

Story: https://www.wired.com/story/school-bathroom-vape-detector-audio-bug/

Regular people know that age verification mandates won't ...

2025-08-07T21:25:59Z

Regular people know that age verification mandates won't work.

But they are worried about their children's safety, and they aren't being offered non-dystopian alternatives.

LLM chat exposures keep on coming. Why? My theory is that these ...

2025-08-07T16:08:11Z

LLM chat exposures keep on coming.

Why? My theory is that these platforms don't do a very good job explaining to users what their public/share features mean.

Result: users may think that while something is public that doesn't necessarily mean that anyone is indexing or caching.

Story:
https://www.404media.co/more-than-130-000-claude-grok-chatgpt-and-other-llm-chats-readable-on-archive-org/

Age verification laws are coming fast. And, from my perspective, ...

2025-08-04T15:29:05Z

Age verification laws are coming fast.

And, from my perspective, opponents are struggling to find impactful messaging to explain to the general public the damage they are about to do to freedom.

Or to propose alternate futures that address the underlying anxieties.

Sure, most folks that are here on #Nostr intuitively understand the dangers... And nod along when we gesture at the dangers of surveillance overreach.

But I worry that the common language for talking about these initiatives typically relies on some priors that are not universally shared outside people that live and breathe concerns about tech.

Saying that something is a surveillance dystopia works on me. But not the neighbors.

I'm guilty of being inside this language bubble too, and it's hard to escape.

Yet, when faced with politicians talking about protecting kids from bad things that parents feel they see right now... I worry that the communities doing pushback are struggling to:

1 -find framing that makes *enough sense* to the vast majority of people that they say 'ok this is net bad' and push back
2- find their own ways to productively connect with the anxieties that politicians are drawing on. E.g. worried parents.
3- offer things that are honest, well meaning alternative paths for the underlying problems

Anyone have thoughts on this? #AskNostr

It seems to me like a strong anti-AI view is becoming left / ...

2025-08-02T21:45:52Z

It seems to me like a strong anti-AI view is becoming left / progressive coded.

I'd love to understand this better.

Anyone have thoughts?

Nostr event nevent1qqsp40wtdxaffa0wmav0ummnkvgnrmng25kqm2tsuerzfne97u7jmrgzypsf7xrv5q3avkxqlcqe2uz89av4vhytu8wpvwc4g8avnkg25n5276fcvfc

2025-08-01T20:33:46Z

Rhisotope
Sauce: https://www.bbc.com/news/articles/cyvn3264q01o

It is a lot easier to celebrate a turn towards dictatorship when ...

2025-08-01T15:20:54Z

It is a lot easier to celebrate a turn towards dictatorship when you are untethered to historical knowledge.

No amount of centralized power delivers a society with true personal freedom in the long run.

History shows that even when dictatorships perform 'well' on some factors, especially in the short term, they send people into a freedom-robbing labyrinth.

Do you care about personal liberty?

Because in the long run with dictatorships you will lose on having a society that supports freedom, personal rights and liberties and decentralization of knowledge and innovation.

Because dictatorships concentrate power without balance.

Over time as inequalities & unfairness become severe... the rule gets more brittle.

And dictators have to give more favors to the people that help them stay in power. Like economic favors.

People with ambition then need to play into the system and help prop up the dictator if they want to keep their resources.

Even then they are vulnerable to having everything taken.

And for anyone that dares point out increasingly obvious flaws?

Well, most dictatorships invariably slide into repression.

People with new, better ideas that also happen to challenge the dictators entrenched interests? Or those of the dictators necessary economic allies? Family members? Point out corruption?

Co-opted or cut down.

Fueled by massive surveillance.

And the threat of violence.

Because self-censorship scales better than physical coercion on each person.

People see opportunity for personal advantage. Some become informers.

Some delight in the cruelty of seeing people they dislike arbitrarily punished.

And when the strong leader dies? The society can be incredibly unstable as it carries the weight of so many injustices, so many lies.

And for the system to persist? More repression needed.

Vibecoding is super interesting. And powerful. Coding syntax is ...

2025-07-31T19:41:20Z

Vibecoding is super interesting. And powerful.

Coding syntax is getting better. But secure coding isn't keeping pace.

In a test of 100 coding models, 45% of them introduced a serious vulnerability.

For example, in 86% of tests, code wasn't secured against Cross-Site Scripting.

NOW-TERM IMPLICATIONS
This has big implications. Sure, there are the YOLOcoders that ship whole vibecoded apps without thinking about security. Or code review.

Some percentage of their users will get rekt.

If those projects get near high risk users, they are sprinkling knives in the weeds with potential for harm.

BUT BIGGER MODELS = BETTER?
Interestingly, even big fat models aren't massively better with security.

S'EVERYWHERE
My other worry? Vibecoding without security check steps is happening in existing projects / platforms etc.

Even when people say they are coding. Sometimes they be vibecoding.

This sort of thing has already come to tools you use, including to handle your funds & privacy.

Sure secure code writing & review has never been anything near universal, but the scale and speed of new code creation that #vibecoding enables is new.

VULNERABILITY DISCOVERY...ALSO ACCELERATING
ICYMI, vulnerability DISCOVERY is also accelerating a lot faster than secure code creation...

Whole industries are spinning up, including lots of offensive projects.

ME? I #VIBECODE
I love the change in how I create with code. But I think we are in for some really rough times, and the least informed parties are gonna be users. As ever.

In the longer run this problem space also seems to offer paths for AI-driven improvement in secure code creation. But since not everything is accelerating at the same pace, the deltas = harm.

Sauce: https://www.veracode.com/blog/genai-code-security-report/

The EU's Digital Identity Wallet project has a lot of big ...

2025-07-28T18:52:41Z

The EU's Digital Identity Wallet project has a lot of big icks.

Looking at the GitHub for the android Age Verification application feels like chewing rocks.

Like the proprietary attestation baked into a must-use form of identification is absolutely the wrong path...

And while we're at it, recall the rule of thumb: Age Verification either by deliberate or convenient naïveté is almost always a surveillance trojan horse.

Source:
https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui

Proton #VPN signups spike1,400% as the UK Online Safety Act rolls ...

2025-07-26T15:03:31Z

Proton #VPN signups spike1,400% as the UK Online Safety Act rolls out.

Proton says spike is sustained & higher than when France blocked adult content.

Source: https://archive.ph/i2d9W

Tea enforced ID & selfie collection. And doxxed their own ...

2025-07-26T14:56:13Z

Tea enforced ID & selfie collection. And doxxed their own users.

In other news, the UK Online Safety Act is forcing websites to begin collecting IDs.

This will end, predictably in fresh breaches.

And more harm to users.

Your honor, in my defense I was being extremely productive at the ...

2025-07-24T17:52:24Z

Your honor, in my defense I was being extremely productive at the time of the crash.

You read dystopian sci-fi as a warning. These companies found ...

2025-07-01T12:05:48Z

You read dystopian sci-fi as a warning.

These companies found business plans..

Just as there are war hawks that delight in hard talk about military action, there are surveillance-yearners...

For reasons I'll never fully understand the UK politicians aren't just surveillance-permissive.

They delight in the idea.

Pre-crime preventative detention coming soon...

https://www.theguardian.com/society/2025/jul/01/tech-firms-suggested-placing-trackers-under-offenders-skin-at-meeting-with-justice-secretary

Mass biometric surveillance is a one-way ticket away from ...

2025-06-29T10:41:36Z

Mass biometric surveillance is a one-way ticket away from democracy.

The funny bit of this is that the whole thing was actually ...

2025-06-21T11:18:34Z

In reply to nevent1q…7wjg
_________________________

The funny bit of this is that the whole thing was actually structured around the deception of setting up a ...secure video meeting

You can patch software, but you can't patch people. This is ...

2025-06-20T19:14:32Z

You can patch software, but you can't patch people.

This is why social engineering will always work.

The human brain is loaded with forever-day vulnerabilities...and attackers are constantly probing.

Sometimes I think that they've developed a more applicable & empirically tested theory of human motivation and cognition than psychologists...

Sometimes tens of thousands of A/B tests a day...

Totally. You can patch software, but not the human brain. In this ...

2025-06-20T19:12:58Z

In reply to nevent1q…erap
_________________________

Totally. You can patch software, but not the human brain.

In this case I'd say there was no greed, he was just doing his job. Which often involves having this kind of meeting.

I think part of what worked here is that the attackers were *so slow* and really did things pitch-perfectly to what he'd expect.

🚨NEW REPORT from us: exposing a new social engineering/hacking ...

2025-06-20T13:40:33Z

🚨NEW REPORT from us: exposing a new social engineering/hacking tactic.

🇷🇺Russian state-backed hackers successfully compromised a prominent (& professionally paranoid) expert on Russian military operations.

Shocking, right? But the attack is solidly clever & worth understanding. I expect more like it.

ATTACK FLOW

Keir Giles gets a message purporting to be from
U.S. State Dept asking for a consultation.

The attackers send the message from a gmail, but CC'd a bunch of email addresses state.gov email addresses. Including one from with same name as the purported sender.

Strong credibility signal to have a bunch of gov ppl on the CC line right?

Well, what the attackers were counting on is that the State Dept mailserver just accepts all email addresses without emitting a bounce.

So they seem to have just created some fake State Dept staff names and addresses.

INTRODUCING THE DECEPTION

The attackers wait for the 2nd interaction to introduce the pivotal deception: getting him to 'connect to a secure platform.'

In the next days they patiently walk him through what they want him to do, even sending a very official looking (but fake) State Dept. document.

The attack works like this: the attackers try to deceive the target into creating and sharing an App-Specific Password (ASP) with them.

They do this by reframing ASPs as something that will let him access a secure resource (spoiler: not how this works)

REMINDER: WHAT IS AN ASP?

What's an ASP? Well, not every app that users want to use supports Multi-Factor Authentication.

Some older email clients for example don't. So providers like #Google let users create a special password just for those apps.

There were so many clever bits to this attack, it's easy to imagine a lot of people falling for it.

Everything was clean. Doc looked real. The language was right. Email addresses at the State Dept. seemed to be CC'd.. I could go on.

They even had Keir enter "ms.state. gov" into the ASP name...

SLOW FOOD SOCIAL ENGINEERING

This attack was like slow food. 10 email exchanges over several weeks! Very much not your run-of-the-mill phishing.

It's like they know what we all expect from them...and then did the opposite.

Ultimately, he realized something was wrong and got in touch with us at #citizenlab ... but not before the attackers got access.

He's said that he expects some sort of 'leak' constructed out of a mixture of his real messages & carefully added falsehoods. I tend to agree, this is a pretty common tactic.
Here's what that looks like, btw, from a report we did back in 2017 where we compared what was released after a hack by Russian hackers vs the original:

Coda: Hilariously (to me at least) the attackers called the fake platform it *MS DoS*

WHO DID IT?

Enter the Google Threat Intelligence Group w/analysis & attribution.

GTIG had been working on their own parallel investigation. Our friendly social engineers are: 🇷🇺 #UNC6293, a #Russian state-sponsored threat actor.

Google adds bonus additional low confidence association to #APT29 (that would be Russia's #SVR).

Nice people.

TAKEAWAYS?

Takeaway: some gov-backed groups are feeling pressure & experimenting.

Moving from smash & grab phishing... to subtler, slower & perhaps less detectable.

Targeting App-Specific Passwords is novel.

But it's just part of a trend of state-backed attackers innovating & moving beyond simple phishing that targets credentials (maybe multi-factor codes) towards other mechanisms of account access.

A lot of more sophisticated attackers are also spreading attacks across platforms.. for example starting the attack on Signal/Telegram, then later pivoting to email, etc. The folks at Volexity (above pic showing a similarly complex operation) have some good reporting on that (link below)

GET SAFER

Do you think you face increased risk because of who you are & what you do?

✅Use Google's free Advanced Protection Program.

Set it up now: https://landing.google.com/intl/en_in/advancedprotection/

✅Exercise extra skepticism when unsolicited interactions slide into suggesting you change account settings!

✅Talk to your IT/ Security team about ASPs. Share the report, we've made some suggestions for them..

READ THE REPORTS

Ours at Citizen Lab: https://citizenlab.ca/2025/06/russian-government-linked-social-engineering-targets-app-specific-passwords/

Google's Post: https://cloud.google.com/blog/topics/threat-intelligence/creative-phishing-academics-critics-of-russia

Other citations:

Our Tainted Leaks report where we walk through how materials got manipulated & leaked after a Russian gov hack: https://citizenlab.ca/2017/05/tainted-leaks-disinformation-phish/

Volexity's recent report:
https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/

Searching #Youtube, I ignore content less than 12 months old. To ...

2025-06-19T15:57:09Z

Searching #Youtube, I ignore content less than 12 months old.

To get past the #GenAI sloplayer.

Like a volcanic explosion.

Except instead of blanketing the world with ash, it's a smothering burden of low value, low-enjoyment, derivative, error-filled content.

“The Arab writer can be easily killed by their government under ...

2025-06-18T16:35:05Z

“The Arab writer can be easily killed by their government under the pretext of ‘national security’"

-Turki al-Jasser in 2014, unwittingly predicting how he'd die in 2025.

He was just executed by Saudi Arabia, probably by beheading.

For his posts critical of the government.

He was reportedly tortured while in prison.

Story: https://www.theguardian.com/world/2025/jun/18/saudi-arabia-turki-al-jasser-executed

New: WhatsApp announces that they are adding advertising. Ugh. ...

2025-06-16T19:21:36Z

New: WhatsApp announces that they are adding advertising.

Ugh.

As a researcher working on targeted / 0click attacks (including a few that have been done over WhatsApp..) it's hard to see how this works without opening up a fat new attack surface to be probed.

I'm also worried about the ways that these advertising signals get used for tracking people in new parts of their digital lives.

And it bugs me that it's going to be really hard if not impossible to use WhatsApp in a privacy-first way.

What are your thoughts?

Writeup: https://techcrunch.com/2025/06/16/whatsapp-is-adding-ads-to-the-status-screen/

Government surveillance powers are like a ziptie. Nobody has the ...

2025-06-14T11:29:20Z

Government surveillance powers are like a ziptie.

Nobody has the incentive to loosen them.

They only ratchet tighter.

Headline that I saw... ...

2025-06-13T20:52:42Z

Headline that I saw...

This is not something I was tracking.

Source: https://www.thefp.com/p/im-the-cto-of-palantir-today-i-join

Pentagon pizza place indicators are undefeated. Israel just ...

2025-06-13T00:47:17Z

Pentagon pizza place indicators are undefeated.

Israel just launched an air attack. Source: NYTimes.

quoting
nevent1q…vctq
Pizza places near Pentagon showing a *lot* of activity.

That favorite conflict indicator coupled with sudden cascade reports of US embassy evacuations & non essential personnel voluntary departures + rhetorical change in statements about talks with Iran... it's enough to make a lot of people start speculating about threats of strikes into Iran.

Disclaimer: Me? I'm not even an armchair geopolitical expert. And I'm certainly not smart enough to know if this is just signaling, or whether something happens soon. Or a bit later.

Pizza places near Pentagon showing a lot of activity. That ...

2025-06-11T23:07:08Z

Pizza places near Pentagon showing a *lot* of activity.

That favorite conflict indicator coupled with sudden cascade reports of US embassy evacuations & non essential personnel voluntary departures + rhetorical change in statements about talks with Iran... it's enough to make a lot of people start speculating about threats of strikes into Iran.

Disclaimer: Me? I'm not even an armchair geopolitical expert. And I'm certainly not smart enough to know if this is just signaling, or whether something happens soon. Or a bit later.

Disagree with the sentiment. The inflammation-depression axis is ...

2025-06-10T14:07:28Z

In reply to nevent1q…ghua
_________________________

Disagree with the sentiment. The inflammation-depression axis is incredibly interesting & new. It needs to be more widely understood outside of the cutting edge of research.

Review articles like this also serve a pretty important role, especially in the context of efforts to develop new diagnostic criteria. As such, important for general public to read them.

Understanding grows when scientific knowledge is shared. Yet in ...

2025-06-10T13:29:30Z

Understanding grows when scientific knowledge is shared.

Yet in 2025 some journals still gatekeep important research.

Like this review of links between depression & inflammation.

$35 if you aren't at an institution with a subscription.

Imagine if a library that charged $35 to read a book?

That's enough friction to keep the knowledge from most of the globe.

Every time I encounter knowledge gatekeeping in a health related journal I wince.

I wonder if the American Journal of Psychiatry has considered the costs to the field, and our global mental health, of staying closed?

The thing is, I can personally read these articles thanks to my institutional affiliation.

But the momentary friction as I cross through the paywall reminds me that most people can't.

The article: https://psychiatryonline.org/doi/10.1176/appi.ajp.20250289

I think there's a lot of value in using a more security & ...

2025-06-07T22:51:01Z

In reply to nevent1q…g2ec
_________________________

I think there's a lot of value in using a more security & privacy focused OS like #GrapheneOS. For those not interested in going that far, Lockdown Mode on iOS (& Advanced Protection Mode coming soon in Android 16) both look like interesting choices to raise the cost-to-hack.

That said, I'm not sure that any operating system is going to totally prevent this category of attack.

🎥FRESH TALK DROP: Your phone, the spy. In the fight against ...

2025-06-07T12:05:59Z

🎥FRESH TALK DROP: Your phone, the spy.

In the fight against spyware like Pegasus, your phone is the frontline.

Last week at the Oslo Freedom Forum

Topics:
❌The dictators repression toolkit
❌How mercenary spyware is used to spread fear around the globe
❌Zero click vs 1 click attacks
❌What works in the fight to pump the brakes on spyware proliferation

BONUS:

✅What you can do right now to make yourself harder to hack

Full talk:
https://youtu.be/qknOIafYODs?t=63

I keep getting asked for recommendations from journalists & ...

2025-06-05T19:29:31Z

I keep getting asked for recommendations from journalists & dissidents for the "most private #AI"

Their concerns about privacy aren't wrong. And are probably prescient. Prudent to avoid the big name platforms.

But that doesn't mean they shouldn't be wielding powerful tools as they do their important work.

The usual recommendation for someone with a bit of skill and a good machine is to get cooking on a locally run model.

But not everyone is that person...

So I've been looking for recommendations that don't require the above skills/bandwidth/machine & I keep hearing interesting things about Open Secret / Maple AI.

Anyone have experience? Know the specs & models? Are there other similar offerings around?

Their website: https://trymaple.ai/

NEW: accused mastermind of French crypto kidnappings arrested in ...

2025-06-04T21:01:29Z

NEW: accused mastermind of French crypto kidnappings arrested in Morocco.

24-yo Badiss Mohamed Amide Bajjou allegedly orchestrated the kidnappings & assaults from abroad.

Including severing Ledger founder David Balland's finger.

Authorities are probing possible links to additional cases.

This dynamic of remotely-masterminded attacks is terrifying. Nothing about these attacks requires super special skills, and the sheer ease of moving the assets once the wrench attack has happened is likely to attract more criminal groups.

I still think we're in the earliest days of these. Plenty of #OPSEC lessons and complexities to start thinking about here.

Also, almost certainly the case that post- #Coinbase breach we will see more of these attacks.

Read the news story: https://www.lemonde.fr/en/pixels/article/2025/06/04/suspected-mastermind-of-french-crypto-kidnappings-arrested-in-morocco_6742008_13.html

Do you know what the date is today? Today is the anniversary of ...

2025-06-04T10:41:23Z

Do you know what the date is today?

Today is the anniversary of the Tiananmen square massacre.

Take a moment to watch this video.

Dictators hope that if they make us afraid to speak the truth for long enough... we'll forget it.

And the next generation will never learn.

This is how history is erased.

A Day to Remember, 2005, by Liu Wei
Full: https://vimeo.com/44078865

Another reminder of why using mercenary spyware is such a big ...

2025-06-03T11:13:07Z

Another reminder of why using mercenary spyware is such a big risk for governments: they open themselves to retaliation & blackmail.

quoting
nevent1q…9k8t
Fun times ahead for Pegasus customers

Israeli ambassador to Spain threatens to use Pegasus data seized from NSO to attack Spanish government

"Mi Gobierno aún no ha respondido con revelaciones de Pegasus"

"My Government has not yet responded with Pegasus revelations"

https://www.elespanol.com/espana/politica/20250527/embajador-israel-funciones-advierte-gobierno-no-respondido-revelaciones-pegasus/1003743774464_0.html

VERY interesting research on how academic twitter migrated to ...

2025-06-03T10:10:13Z

VERY interesting research on how academic twitter migrated to #Bluesky.

Interesting topline takeaways for growing #nostr. No rocket science that's not been said before, but it's nice to have some data:

1- External shocks are key. Capitalize on them. >15% of transitions explained this way. Think geopolitical events, outages, Musk making a big disliked policy change etc.

2- Audiences move from incumbent platforms following influential voices that they follow. Focus on onboarding these influential voices. This is more impactful than just trying to bring the whole audience first.

This dynamic can build contagion. Find ways to more publicly highlight when influential accounts join.

And make it super easy for Nostr users to use clients to reconstruct followees & social graphs from incumbent platform. Trick will be to do this in a privacy respecting way.

(sidenote: that's way the follow packs were such a good idea. But we need much more of this)

(note: influential voices may experience a period of 'where's my audience?' So it's key to find ways to get the transitioning user from that to the reconstruction of their network. )

3- Multiple peers transitioning is key. Having local clusters develop is important (& probably helps with the dry period before an audience is rebuilt.)

Interesting nuance: transition rates to #bluesky were 25-30% in fields like arts/social sciences, but about half that in medical / physical sciences / engineering. Possible predictors include baseline political engagement & political values expressed.

This has an implication for Nostr: focus messaging on Nostr features that may align with people in incumbent platforms. There has to be desire.

Paper "Why Academics Are Leaving Twitter for Bluesky" https://arxiv.org/pdf/2505.24801

Now more than ever it is critical to recognize where you've ...

2025-06-02T17:11:35Z

Now more than ever it is critical to recognize where you've outsourced your cognition.

And whose hidden assumptions your mental economy is now running on.

NEW: #Google's #Android 16 to feature optional high security ...

2025-05-16T20:27:14Z

NEW: #Google's #Android 16 to feature optional high security mode. Cool.

Advanced Protection has a bunch of requested features that address the kinds of threats we worry about.

It's the kind of 'turn this one thing on if you face elevated risk' that we've been asking for from Google.

And likely reflects some learning after Google watched #Apple's Lockdown Mode play out.

Here are some thoughts:

SOME FEATURES IM EXCITED FOR:

The Intrusion Logging feature is interesting & is going to impose substantial cost on attackers trying to hide evidence of exploitation. Logs get e2ee encrypted into the cloud. This one is spicy.

The Offline Lock, Inactivity Reboot & USB protection will frustrate non-consensual attempts to physically grab device data.

Memory Tagging Extension is going to make a lot of attack & exploitation categories harder.

2G Network Protection & disabling Auto-connect to insecure networks are going to address categories of threat from things like IMSI catchers & hostile WiFi.

FEATURES IM ..MORE CAUTIOUSLY CURIOUS ABOUT

Spam & Scam detection: Google messages feature that suggests message content awareness and some kind of scanning.

Scam detection for Phone by Google is interesting & coming later. The way it is described suggests phone conversation awareness. This also addresses a different category of threat than the stuff above. I can see it addressing a whole category of bad things that regular users (& high risk ones too!) face. Will be curious how privacy is addressed or if this done purely locally.

FRICTION POINTS?

I see Google thinking some of thisC through, but I'm going to add a potential concern: what will users do when they encounter friction? Will they turn this off & forget to re-enable?

We've seen users turn off iOS Lockdown Mode when they run into friction for specific websites or, say, legacy WiFi.

They then forget to turn it back on. And stay vulnerable.

Bottom line: users disabling Apple's Lockdown Mode for a temporary thing & leaving it off because they forget to turn it on happens a lot. This is a serious % of users in my experience... And should be factored into design decisions for similar modes.

GIVE US A SNOOZE BUTTON
I feel like a good balance is a 'snooze button' or equivalent so that users can disable all/some features for a brief few minute period to do something they need to do, and then auto re-enable.

Yes, during that brief period there is vulnerability (and a potential social engineering target), but if the trade off is that the user likely just turns the whole thing off and forgets it..that is worse.

HIGH SECURITY & HIGH PARANOIA USERS
Some users, esp. those that migrated to security & privacy-focused Android distros because of because of the absence of such a feature are clear candidates for it...

But they may also voice privacy concerns around some of the screening features. And about the fact that the phone would need to be re-googled (think:Graphene which confers a lot of privacy by stripping out most google features)

Clear communication from the Google Security / Android team will be key here.

TAKEAWAYS

I'm excited to see how #Android Advanced Protection plays with high risk users' experiences.

I'm also super curious whether the spam/scam detection features may also be helpful to more vulnerable users (think: aging seniors)...

Google's blog: https://security.googleblog.com/2025/05/advanced-protection-mobile-devices.html

Terrible ad from a cynical man trying to steal your privacy. ...

2025-05-11T22:18:47Z

Terrible ad from a cynical man trying to steal your privacy.

I've talked about the Orb Mini before:

quoting
nevent1q…6758
Friends don't let friends get their eyeballs scanned to buy a coffee.

This portable dystopia machine is Tools for Humanity's latest effort to live up to their Orwellian name.

Connoisseurs of the AI-will-end-humanity marketing hype train of a few years ago should find plenty to appreciate in an eyeball scanner framed as as a 'helpful' tool to distinguish between AI agents & humans.

Or is it for that? Or maybe point of sale? Or nebulous 'verification?'

The only clear thing? This device starts from a point of biometric #privacy invasion.

It sure looks to me like another effort by the company Sam Altman founded to make a global data-grab.

Just say no.

https://techcrunch.com/2025/04/30/sam-altmans-world-unveils-a-mobile-verification-device/

BREAKING: jury awards massive $167 million in punitive damages ...

2025-05-06T23:19:43Z

BREAKING: jury awards massive $167 million in punitive damages against spyware company NSO Group.

It turns out that the regular people on a jury think it is evil when you help dictators hack dissidents.

After years of every trick & delay tactic it only took a California jury ONE DAY of deliberation to get this Monsanto-scale verdict. Precedent-setting win against notorious #Pegasus spyware maker.

BACKSTORY:
Rewind to 2019. About this time (April-May) #WhatsApp catches NSO Group hacking its users with #Pegasus.

They investigated.

We at Citizen Lab helped to investigate the targets & get in touch with the activists journalists & civil society members that were targeted

We identified at least 100. And got in touch. It was a tremendous push of sleepless days. But it made it so clear just how much harm was being done.

Then, In October 2019 WhatsApp sued.

Prior to the lawsuit, NSO had acted the playground bully.

Targeting victims that dared speak up & researchers like us.

Suddenly, the bully wasn't so surefooted. Like the scene in a high school movie where the cousin shows up in the beat up car & collars the bully.

You might not remember, but in 2019 no country had sanctioned NSO Group... No parliamentary hearings, no hearings in congress, no serious investigations.

For years, WhatsApp's lawsuit helped carry momentum & showed governments that their tech sectors were in the crosshairs from mercenary spyware too...

Credit due to Meta & WhatsApp leadership on this one, they stuck the fight out & carried it across the finish line.

NOTIFICATIONS MATTER

WhatsApp's choice to notify targets was also hugely consequential.

A lot of cases were first surfaced from these notifications.

With dissidents around the world suddenly learning that dictators were snooping in their phones...with NSO Group's help.

A SIDEBAR: HARASSING RESEARCHERS

One of NSO's many tactics was to leverage the case to badger me & us Citizen Lab researchers to try and extract information.

It never worked, but it laid bare the tactics that these firms prefer...instead of coming clean.

ROLE OF CIVIL SOCIETY
Ultimately, we wouldn't be here without civil society investigations of mercenary spyware... and alarm raising.

And victims choosing to come forwads.

Thankfully today there's a whole accountability ecosystem growing around this work.

Dozens of orgs engaging.

Numbers are growing.

IS THERE GONNA BE IMPACT? YES

NSO Group emerges from the trial severely damaged.

The damages ($167,254,000 punitive, $440K+ compensatory) is big enough to make your eyes water.

NSO'S BUSINESS IS NOW ALL OVER THE NET

The case is also a blow to NSO's secrecy, with their business splashed all over a courtroom.

WhatsApp just published NSO's depositions, exposing an unprecedented amount of info on a spyware company's operations:

✅https://about.fb.com/wp-content/uploads/2025/05/WhatsApp-v-NSO-Eshkar-Transcrips_Case-4-19-cv-07123-PJH.pdf
✅https://about.fb.com/wp-content/uploads/2025/05/WhatsApp-v-NSO-Gil-Transcrips_Case-4-19-cv-07123-PJH.pdf
✅https://about.fb.com/wp-content/uploads/2025/05/WhatsApp-v-NSO-Shohat-Transcrips_Case-4-19-cv-07123-PJH.pdf
✅https://about.fb.com/wp-content/uploads/2025/05/WhatsApp-v-NSO-Gazneli-Transcrips_Case-4-19-cv-07123-PJH.pdf

This will scare customers. And investors. And other companies that do the same thing. Good.

MY VIEW:
Watching a jury of regular citizens see right through NSO's mendacity & hypocrisy...and to the need to protect privacy is amazing.

Gives me hope.

Despite all the fancy lawyering & lobbying, people know that this kind of privacy invasion is wrong.

Read more:
They Exposed an Israeli Spyware Firm. Now the Company Is Badgering Them in Court. https://theintercept.com/2024/05/06/pegasus-nso-group-israeli-spyware-citizen-lab/

Spyware maker NSO ordered to pay $167 million for hacking WhatsApp
https://www.washingtonpost.com/technology/2025/05/06/nso-pegasus-whatsapp-damages/

NSO Group must pay more than $167 million in damages to WhatsApp for spyware campaign https://techcrunch.com/2025/05/06/nso-group-must-pay-more-than-167-million-in-damages-to-whatsapp-for-spyware-campaign/

AI friends consoling me because my cat bonded to the robot vacuum ...

2025-05-02T16:06:11Z

AI friends consoling me because my cat bonded to the robot vacuum & ignores me.

Friends don't let friends get their eyeballs scanned to buy a ...

2025-05-01T11:49:15Z

Friends don't let friends get their eyeballs scanned to buy a coffee.

This portable dystopia machine is Tools for Humanity's latest effort to live up to their Orwellian name.

Connoisseurs of the AI-will-end-humanity marketing hype train of a few years ago should find plenty to appreciate in an eyeball scanner framed as as a 'helpful' tool to distinguish between AI agents & humans.

Or is it for that? Or maybe point of sale? Or nebulous 'verification?'

The only clear thing? This device starts from a point of biometric #privacy invasion.

It sure looks to me like another effort by the company Sam Altman founded to make a global data-grab.

Just say no.

https://techcrunch.com/2025/04/30/sam-altmans-world-unveils-a-mobile-verification-device/

That's super interesting. I had no idea. Absolutely love this ...

2025-04-28T18:22:26Z

In reply to nevent1q…e7jk
_________________________

That's super interesting. I had no idea. Absolutely love this kind of history.

2027: we can't wait to show our advertising partners how we ...

2025-04-25T12:51:46Z

2027: we can't wait to show our advertising partners how we deliver behavior shaping across whole lives.

this is a surprisingly great feature, imo.

They Criticized Musk on X. Then Their Reach Collapsed. ...

2025-04-23T16:17:39Z

They Criticized Musk on X. Then Their Reach Collapsed.

Graphs from this story are stark.

Link: https://www.nytimes.com/interactive/2025/04/23/business/elon-musk-x-suppression-laura-loomer.html

Constant algorithmic improvements have empirically reverse ...

2025-04-20T10:52:40Z

Constant algorithmic improvements have empirically reverse engineered the human psyche.

I suspect that explicit research neuroscience hasn't caught up to the insights about how to induce behavioral dependence that are embodied in these systems.

The user experience of most platforms now mirrors maladaptive behavior-maintaining effects you could *only* achieve with most addictive drugs up to about a decade ago.

We need to avoid the moral panic, but it's impossible to overstate how novel this is for our brains.

One thing we know from behavioral addiction research (my old field) is that the brain is plastic.

When you induce one category of addiction, it changes the motivational substrate of the brain in sticky ways.

And coss-sensitizes / potentiates other forms of addiction and behavioral dependence.

This will only accelerate & become less scrutable with improvements in AI.

We are in the earliest, earliest days of trying to understand what this means for the next decades of human life.

Painting: The Opium Den, Edward Burra,1933

NEW: 🇪🇺EU issuing burner phones to staff traveling to ...

2025-04-14T13:10:55Z

NEW: 🇪🇺EU issuing burner phones to staff traveling to 🇺🇸US.

Anecdotal: matches what I'm seeing, which is orgs retooling what was once the high security "China travel policy" into a US travel policy.

Burner phones, dedicated travel devices & border wipes are the new normal.

Story: https://www.ft.com/content/20d0678a-41b2-468d-ac10-14ce1eae357b

https://m.primal.net/QDHd.png Anyone come across good analyses of ...

2025-04-03T18:25:46Z

Anyone come across good analyses of new US #tariffs .

Longer term projections a bonus. #AskNostr

https://m.primal.net/PyiS.jpg I've spent my adult life ...

2025-03-30T21:00:50Z

I've spent my adult life thinking about defending digital privacy.

Yet until a few years ago, financial freedom & privacy was barely on my radar.

This would have probably continued but for a handful of good humans that took the time to talk me through things.

Thanks to thinking they kicked off for me, I now think that individual access to aspects of financial freedom & privacy are necessary to a healthy society.

Why did it take so long? Well, there was a failure of adversarial imagination on my part.

And partly because if you aren't actively asking hard questions, this state of affairs will be hidden from you.

The financial system & how it is taught is set up to hide structural privacy violations & disempowerment.

I'm pretty sure my ignorance was closer to the norm than the exception.

But when you completely restrict financial privacy & freedom, you disempower people...constantly.

And it will keep eroding & blocking the exercise of other core rights.

Until this changes & awareness grows, we're stuck paying the price for it in a thousand ways.

Shoutout to gladstein (nprofile…xncl) for getting & keeping the intellectual ball rolling for me. And to all the good humans that have helped me along the way since. Thank you. You know who you are.

Painting : Egon Schiele, Four Trees, 1917.

I hear what you are saying, and agree that this kind of advanced ...

2025-03-30T00:58:15Z

In reply to nevent1q…99gq
_________________________

I hear what you are saying, and agree that this kind of advanced data collection probably is not necessary.

My view is: don't underestimate the power of these industries.

Consider that there's a difference between what kind of invasiveness might be needed.... and what will be instantly sought & probably granted.

Getting concrete. The cheaper bids on contracts will probably be because they rely heavily on more automated approaches... And to make that work, they are going to want data.

I hear you. I worry that a goldrush of some of the shadiest ...

2025-03-30T00:53:36Z

In reply to nevent1q…4vxj
_________________________

I hear you. I worry that a goldrush of some of the shadiest companies will happen in a blink.

Surveillance-oriented-companies love nothing more than areas where people *have to hand over data*.

And the "we need this data to keep ppl safe" fear thing is going to be a godsend.

If we aren't demanding that concerns about safeguards, limits & accountability are included in every step of the conversation now...it will be 100x harder to get them in place once big companies & lobbyists have set the terms of the game.

Most folks don't love security theater & everyone has had ...

2025-03-29T21:56:02Z

Most folks don't love security theater & everyone has had a bad time at a screening checkpoint.

So, let's think for a second about hypothetical private-#TSA companies.

I'd expect them to gravitate towards AI-assigned individual risk ratings to minimize the cost of hiring & training people to interact with travelers.

To create ratings, I'd expect them to demand & consolidate invasive pools of our biometrics, web browsing, commenting, purchasing, movements & private lives.

Just don't call it a "social credit score"

You can bet they'll pivot to trying to monetize their data.

2026: We're a terminal security company
2029: We're a person rating company

Would these ratings make their way into other parts of our lives & things we want to visit?

And who exactly would stand up for us when the ratings are wrong? Or our data is shipped to foreign buyers.

Who holds #PrivateTSA companies accountable? The US doesn't have strong #privacy protections...

I'm also not optimistic about private sector security companies' ability to stop breaches. History backs me up here.

But I do expect that private-TSA companies could use lobbying to limit oversight & accountability.

That's been the history of other privacy-invasive tech companies.

So, as an airline security privatization conversation kicks off, remember that it can't just be "current thing is bad" but needs to consider what kind of future we're inviting in.

NEW: Italian gov reportedly admits it targeted activists with ...

2025-03-28T03:28:28Z

NEW: Italian gov reportedly admits it targeted activists with #Paragon mercenary spyware.

After ~2 months that began with denials & slid into evasions, some clarity finally came. But only some...

The spyware targeting of journalist Francesco Cancellato, the first case to come forwards after he got notified by #WhatsApp at the end of January is still unexplained.

We at #Citizenlab have been investigating the case & working with targets. We published a forensic investigation last week. Lots of unanswered questions.

Company Background:
Company frames themselves as the anti-NSO Group (the notorious Israeli spyware company that makes Pegasus spyware). More stealthy. More ethical. Well, they got caught & they now have a big scandal.

Like NSO, Paragon also originates out of alumni from the Israeli intelligence community but was recently acquired by a US defense contractor.

Up Next?
As long as clarity is incomplete... the #Paragon scandal isn't going away for #Italy ... and Italy is going to remain a major pain for the mercenary spyware company.

Report: https://www.euractiv.com/section/politics/news/spyware-scandal-italian-government-reportedly-admits-targeting-activists/

https://primal.net/e/nevent1qqs8us77wawnjryeacpq0cup22pvwdnhyv6k69fmkadf5r34rppp7usyhlr4e

So, more journalists were just targeted with #Pegasus spyware. ...

2025-03-27T17:58:44Z

So, more journalists were just targeted with #Pegasus spyware.

This time journalists in #Serbia that were investigating corruption.

“In Serbia, you can hire a hitman for a half of the money...what else would they be prepared to pay for?!” - a spyware-targeted reporter.

Indeed.

Notice that the targeting is happening over a messenger program with a link, not a zero-click?

The why is unclear. Maybe Pegasus didn't have a working exploit against those phones. Or maybe the customer didn't get the platinum zero click package and so had to do some social engineering. Interesting.

BACKGROUND:
This is the THIRD report of Pegasus abuses in Serbia in 2 years.

And nearly a decade after the first Pegasus abuses got reported, NSO Group is still fueling attacks against freedom of speech.

We're here because spyware companies still don't feel meaningful consequences.

And DC is home to a seemingly-infinite number of lobbyists that are willing to help them try to get off sanctions lists...

READ THE REPORT by Amnesty Tech & BIRN. https://securitylab.amnesty.org/latest/2025/03/journalists-targeted-with-pegasus-spyware/

Datapoint: this administration uses Signal. Like every other ...

2025-03-24T18:47:40Z

Datapoint: this administration uses Signal. Like every other administration.

Because encrypted messaging is critical infrastructure.

Remember this the next time a government demands an encryption backdoor.

How did a reporter get added? Well, the use of encrypted chat is ubiquitous but not explicitly accepted, supported or discussed in most institutions.

Which means users are left to fend for themselves in how they use & understand these tools.

And are usually about 1 mistake away from self-doxxing group contents.

This also left me wondering: is anyone screening these devices for mercenary spyware like Pegasus?

Experience tells me the answer is: maybe not.

Article: https://www.theatlantic.com/politics/archive/2025/03/trump-administration-accidentally-texted-me-its-war-plans/682151/

🚨NEW REPORT: first forensic confirmation of #Paragon mercenary ...

2025-03-19T19:26:45Z

🚨NEW REPORT: first forensic confirmation of #Paragon mercenary spyware infections in #Italy...

Known targets: Activists & journalists.

We also found deployments around the world. Including ...Canada?

So #Paragon makes zero-click spyware marketed as better than NSO's Pegasus...

Harder to find...

...And more ethical too!

This caught our attention at #Citizenlab. And we were skeptical.

So.. it was time to start digging.

We got a tip about a single bit of #Paragon infrastructure & my brilliant colleague Bill Marczak developed a technique to fingerprint some of the mercenary spyware infrastructure (both victim-facing & customer side) globally.
So much for invisibility.

What we found startled us.

We found a bunch of apparent deployments of Paragon's mercenary spyware in places like #Australia, #Denmark, #Israel, #Cyprus #Singapore and... #Canada.

Fun.

We also found interesting stuff at a datacenter in #Germany

Caveats: the methodology we use only surfaces a subset of customers at a particular time.

So ...about #Canada.

My colleagues on the legal side began digging. The more they pulled, the more questions surfaced about whether the Ontario Provincial Police is rolling mercenary spyware.

While investigating, we found signs #WhatsApp was being used as a vector for infections.

We shared our analysis with Meta which had an ongoing investigation into Paragon.

They shared findings with WhatsApp which discovered & mitigated a zero-click attack.

They went public, and notified ~90 users that they believed were targeted.

WhatsApp's notifications to targets turbocharged what we all knew about #Paragon.

Cases began coming out: an investigative journalist in #Italy and sea rescue activists were among the first. Francesco Cancellato. Editor in Chief of Fanpage.it, & Luca Casarini and Dr. Giuseppe “Beppe” Caccia of Mediterranea Saving Humans

They consented to us doing a forensic analysis...

Sure enough, we found traces of infection on several Androids.

We call the indicator #BIGPRETZEL & #WhatsApp confirms that they believe BIGPRETZEL is associated with #Paragon's spyware.

In the weeds a bit: Android log forensics are tricky. Logs get overwritten fast, are captured sporadically & may not go back very far. So, not finding BIGPRETZEL on a targeted phone wouldn't be enough to say it wasn't infected. In such a case, the only safe course of action for a notified Paragon target would be to presume they had been infected.

Our analysis is ongoing.

.... but There's more!

There's more! We'd been analyzing the iPhone of human rights activist David Yambio, who is focused on abuses against migrants in Libya (they are often victims of torture, trafficking, and killings) who works closely with the other targets.

Last year he got notified by Apple that he was targeted with sophisticated spyware.

We've forensically confirmed the infection & shared details with Apple.

Apple confirms they fixed the vectors used to target him as of iOS 18.

We're not doing a full technical attribution of this novel spyware to a particular company yet. But it's not like anything we've seen.

Troublingly, timeline of David's spyware targeting lines up with when he was providing information to the International Criminal Court about torture by human traffickers in #Libya.

But there's even more spying afoot against this cluster of activists!

Luca also got a notification last February about targeting with a different kind of surveillance tech.

He wasn't alone. Father Mattia Ferrari, chaplain of Luca's lifesaving organization' also got a notification.

#Italy's response to the unfolding #Paragon scandal has been exceptionally chaotic. So we included a little timeline.

Denials, then admissions, then refusals to say more citing secrecy.

Honestly, deja vu of how Pegasus-abusing governments have handled PR...

TAKEAWAYS:

TAKEAWAY 1: you can't abuse-proof mercenary spyware. Selling just democracies won't prevent abuses. Most democracies have plenty of historic examples of surveillance abuses. Why should spyware be different?

TAKEAWAY 2: #Paragon's technical tradeoffs to be less detectable didn't prevent them getting discovered.

Just made it harder.

TAKEAWAY 3: I think we're only looking at the tip the #Paragon hackberg

For example, the ~90 notification number from #WhatsApp
only represents 1 infection vector that got caught & notified.

There may be non-notified spyware victims walking around right now who were infected via a different mechanism.

In #Italy, too we also need to better understand the other surveillance technologies pointed at this cluster of people.

Finally, we gave #Paragon room to respond to a summary of our key findings.

Their US Executive Chairman, a 30+ year #CIA veteran, responded in a way that sounded very familiar to how NSO Group did PR.

1 - Say there are inaccuracies..
2- ..But refuse to specify them
3-Cite customer confidentiality as a reason to not say more.

We welcome any clarifications they have now that they've read our full report.

FINAL NOTES: our #citizenlab investigations are usually big, collaborative team productions. Smart co-authors, awesome collaborators.

The key to nearly all our research into spyware is targets' brave choice to speak out.

And work with us to forensically analyze their devices... We are very grateful to them.

This is how we collectively get a better understanding of mercenary spyware abuses.

And journey towards accountability.

Thanks for reading! Drop questions in the replies!

READ THE FULL REPORT https://citizenlab.ca/2025/03/a-first-look-at-paragons-proliferating-spyware-operations/

Hey Hey! Update your iPhone today! Apple just blocked an attack ...

2025-02-10T19:07:46Z

Hey Hey! Update your iPhone today!

Apple just blocked an attack discovered by my Citizen Lab teammate Bill Marczak.

Allowed a bypass of Apple's USB Restricted Mode on locked devices.

Actively used by a sophisticated attacker.

Stay safe out there.

And avoid leaving your phones unattended.

https://support.apple.com/en-us/122174

Full biometric KYC for a sandwich. Absolutely not, Jeff. ...

2025-02-10T18:43:38Z

Full biometric KYC for a sandwich.

Absolutely not, Jeff.

NEW: UK secretly demanded Apple build a backdoor into ALL ...

2025-02-07T16:14:43Z

NEW: UK secretly demanded Apple build a backdoor into ALL encrypted iCloud accounts.

You haven't heard about this before because these orders are secret & there are typically bans on talking about them.

SHORT TERM IMPACT:
Apple will probably stop offering encrypted iCloud storage in the UK.

DETAILS:
the UK Home Secretary sent #Apple a so-called "Technical Capability Notice" which is a demand for access.

These flow from the 2016 Investigatory Powers Act (aka "Snooper's Charter") and is a mechanism for the government to *compel* companies to provide access.

ENFORCED SILENCE:
Among the more pernicious parts of this secret demand: Apple would be *FORBIDDEN* from telling users that the backdoor had been introduced into iCloud's Advanced Data Protection.

BIG PICTURE:
The public really doesn't realize it, but cloud backups of phones are constantly used for surveillance. Huge #privacy & #encryption gap.

By introducing optional Advanced Data Protection, Apple extended similar protections of device encryption to users' clouds.

So, since ADP was introduced in 2022, governments have been scheming to undermine it.

LOOKING INTO THE FUTURE:
It's only a matter of time before governments try to target Private Cloud Compute. And do so with the same secret legal tools.

REPORT:
https://www.washingtonpost.com/technology/2025/02/07/apple-encryption-backdoor-uk/

No notes. #deepseek #openai https://m.primal.net/OGSV.png

2025-01-29T17:34:19Z

No notes.

#deepseek #openai

Monday edition of Car privacy is an absolute nightmare: ...

2025-01-28T04:59:24Z

Monday edition of *Car privacy is an absolute nightmare*:

Subaru's employee portal holds a year's worth of location data for all internet-connected cars.

We know this because it was vulnerable (now fixed). You could pull a year's worth of driving just with a license plate.

Props to Sam Curry & Shubham Shah for exposing it. Pic is a years' worth of Sam's mom's #Subaru locations.

I seriously doubt any owner has a clear idea that this data is being collected on them.

But the same thing is replicated for almost every car mfr (see the #Mozilla foundation report on car privacy link)

Literally no car owner has asked for their whip to be turned into a surveillance portal.

And yet..

Car companies feel basically no pressure to do right by customers, but experience a lot of incentives to mine their movements for money.

Sidenote: same (now closed) vulnerability also enabled remote unlocks & starts and a bunch of other highly undesirable things.

Reading list:

The Subaru research: https://samcurry.net/hacking-subaru

News report on it: https://www.wired.com/story/subaru-location-tracking-vulnerabilities/

Mozilla Foundation's key investigation into car privacy: https://foundation.mozilla.org/en/privacynotincluded/articles/its-official-cars-are-the-worst-product-category-we-have-ever-reviewed-for-privacy/

Wait, people can support me in real value, not just magic ...

2025-01-23T16:28:06Z

Wait, people can support me in real value, not just magic internet points that are revokable without notice?

Zaps just blew my mind.

We need #encryption backdoors to 'enforce' democracy says ...

2025-01-22T18:45:56Z

We need #encryption backdoors to 'enforce' democracy says Europol chief.

Says anonymity "not a fundamental right"

I disagree.

#Anonymity is part of the bedrock of protecting healthy dissent.

Forcing total government access to private communications lays the technical groundwork for undermining democracy.

But here we are. It's a new year, so cops & governments are taking fresh swings at encryption.

Only the scare tactics change.

Welcome to a new, cynical chapter in the fight to protect privacy.

Demanding them... when the worst recent national security breaches in the US happened... when #China hacked government-mandated backdoors... is also absurd.

There's every reason to believe something similar may have happened in #Europe , we just don't know it yet.

Shortsighted and cynical stuff.

Story: https://www.ft.com/content/1e6a600d-8620-4ed6-a4cd-5c454d6247ba

Heard about a big breach over at Volkswagen? ...

2025-01-05T03:17:08Z

Heard about a big breach over at Volkswagen?

Here's whats going on. Every major car company collects your driving data. And everything I've learned about this subject makes me want to go into the dash and start pulling wires out.

100% of car companies collect unnecessary data
84% share/sell it
92% provide insufficient control over data.

(Data: Mozilla Foundation investigation)

Most pour it into the shady data-broker ecosystem.

Where it goes to god-knows who. And represents a really exciting stream of surveillance data for governments and everybody else.

Most also turn it over to governments.

And insurance companies.

We got here because, in search of new revenue streams, these car mfrs turned to mining owners for movement data.

Their disrespect for your #privacy is a through-line, and is reflected in just how sloppy they can be about protecting it.

Unsecured AWS? Ugh. But this is just the tip of the iceberg.

This massive data exposure happens to be Volkswagen, but the story tracks for every major car company.

When companies do offer some sort of opt-out... your car might break. Or so they warn you.

We are still in earliest days of people investigating and pointing this out, but things are bound to get worse with electronic vehicles.

Reading list:

Mozilla Foundation's key investigation: https://foundation.mozilla.org/en/privacynotincluded/articles/its-official-cars-are-the-worst-product-category-we-have-ever-reviewed-for-privacy/

CSO Oline report on VW:
https://www.csoonline.com/article/3631055/volkswagen-massive-data-leak-caused-by-a-failure-to-secure-aws-credentials.html

Nissan breach report:
https://www.industryweek.com/technology-and-iiot/article/21258350/nissan-north-america-reports-consumer-data-breach

Nostr event nevent1qqsdw25g9k6n2p03amlazvauwqq62nle5rr8s90j530r6wzrt3m68yczypsf7xrv5q3avkxqlcqe2uz89av4vhytu8wpvwc4g8avnkg25n52706a0wj

2023-02-21T20:08:58Z

Hello, world.