Search posts, papers, and topics
OpenAI’s ChatGPT sets a cross‑site cookie (__obi) that advertisers’ ad‑pixel scripts automatically send back to OpenAI, linking browsing activity on third‑party sites to a user’s ChatGPT account. The author reverse‑engineered the token exchange, captured traffic from hundreds of pixels, and quantified the data collected (emails, phone numbers, locations, page paths). The mechanism works for logge…
Flock ALPR cameras run on severely outdated Android 8.1 and Linux 3.18, missing years of security patches. Analysis of leaked firmware revealed hard-coded API keys and plaintext Auth0 credentials, allowing access to Flock's backend for any camera given its MAC address.
The author argues that the strong backlash against GDPR is evidence it’s working: it forces consent, reshapes global data‑privacy standards (the “Brussels Effect”), and has spurred legislation worldwide—including in Japan—while the US remains reluctant to regulate its own tech giants.
The piece warns that recommendation‑driven feeds hijack user attention, leading to doomscrolling and mental bias. It advocates returning to intentional browsing via bookmarks and RSS to reclaim agency.
ZuckOff is a free mobile app that scans for Bluetooth signatures of Meta smart glasses and notifies you when they are in range. It can’t detect recording activity, but it gives a simple way to spot nearby glasses.
ZCode (Zhipu’s AI coding desktop) silently archives your entire workspace—including full .git history, LFS cache, and config—encrypts it with a server‑supplied RSA public key, and uploads the ciphertext directly to Aliyun OSS. The upload runs unconditionally for any logged‑in user, cannot be disabled via UI, and the decryption key lives only on the server, giving Zhipu full read access to your co…
ZuckOff is a mobile app that passively scans for Bluetooth advertisements from camera‑glasses (Ray‑Ban Meta, Oakley Meta, Snap Spectacles, etc.) and notifies the user when such devices are nearby. It logs all BLE devices, lets users whitelist known glasses, offers iOS widgets and Live Activity alerts, and can export logs as CSV. The app is free, has no account, and is marketed alongside merch.
Hister is an open‑source self‑hosted search engine that indexes the full text of visited web pages and local files, offering both keyword and optional semantic search via a web UI, CLI, TUI, and MCP client. It runs locally with no telemetry and can be installed via binary, Homebrew, Docker, or Nix.
The article discusses techniques for exfiltrating machine learning model weights. It highlights the security implications for ML deployments.
Mistral and Mozilla announce that Firefox’s Smart Window beta will use Mistral’s open‑weight language models, fine‑tuned for regional languages, with a focus on privacy (zero data retention) and user control. The rollout starts in France and North America, with the UK and Germany later.
Firefox for iOS now ships an optional built‑in ad blocker that leverages Apple’s WebKit Content Blocker API and the EasyList filter list. It blocks many third‑party ads and ad‑related trackers before they load, but leaves first‑party ads, search‑result ads, and Firefox‑provided sponsored content untouched. The feature is off by default and can be toggled in Settings → Browsing → Ad Blocker, and i…
Apple provides a set of steps to disable its new Apple Intelligence features—Siri AI, message/email summaries, notification summaries, smart replies, and more—via System Settings, app preferences, or Screen Time. Disabling these reduces data collection and lets parents restrict AI features on child devices.
South Korea’s privacy regulator will fine companies up to 10 % of revenue for large‑scale data breaches, a jump from the previous 3 % cap. The rule applies to intentional or grossly negligent leaks affecting 10 M+ people, with reductions for proactive security investments and rapid breach response. Companies must also notify users within 72 hours of a high‑risk exposure.
Minimal Phone 2 is a compact smartphone with a physical keyboard, a minimalist OS, and optional de‑Googled firmware. The page is a marketing spec sheet with no engineering details or evaluation.
The Chaos Computer Club is announcing its 40th Congress (40C3) from Dec 27‑30 2026 in Hamburg, inviting speakers, artists, musicians, and punk performers via multiple calls for participation.
The 2nd U.S. Circuit Court upheld the border-search exception, allowing agents to seize and examine travelers’ phones without a warrant, rejecting amicus arguments that First and Fourth Amendment rights require a warrant.
Firefox is integrating Exa.ai’s retrieval engine into its Smart Window (desktop) and Quick Answers (iOS) features, delivering source‑backed answers with visible citations and a zero‑data‑retention policy. The move underscores Mozilla’s strategy of keeping the browser open while partnering for specialized AI capabilities.
404 Media asks citizens to request Axon ALPR activity and sharing logs from local police via public‑records requests, providing a template and examples of reports they’ve already obtained.
Databricks outlines a four‑layer BYOD mobile security model—MDM enrollment (account‑driven user enrollment), identity‑based access with contextual signals, continuous zero‑trust posture checks via per‑app VPN, and managed‑app controls—while emphasizing employee privacy and transparent communication to drive adoption.
The article proposes a rights‑respecting approach to age‑assurance, assigning actuation to services, using devices for privacy‑preserving signal creation, offering user choice of providers, and leveraging zero‑knowledge credentials. It argues that policy must enforce open standards and end‑to‑end risk assessment to avoid privacy, security, and competition harms.
Codename One adds a permission‑free `ContactPicker` API that uses the Android 17 system contact picker and iOS `CNContactPickerViewController` to let apps request only the specific fields (name, phone, etc.) they need. The picker returns a snapshot `Contact` object without granting broad address‑book access, and the API gracefully falls back on older platforms or unsupported cases.
Firefox made WebAudio output deterministic in v118, collapsing most variance to three CPU‑dependent buckets (x86 without FMA, x86/x64 with FMA, ARM NEON). Telemetry shows 99.24% of users fall into these buckets; a long tail of 23 distinct values affects <0.1% of users. Ongoing bugs aim to merge the remaining buckets. Alibaba’s fingerprint script was extracted (two SHA‑256 hashes) and shown to be…
CIAM in 2026 has moved from static login checks to a continuous trust layer that must handle AI agents, deep‑fake attacks, and zero‑friction authentication, requiring a split between an identity authority and a real‑time trust orchestration layer.
Microsoft announced the Windows Age API, a set of platform calls (GetUserAgeRangeAsync, GetAgeVerificationStatusAsync, CheckAgeStatusAsync) that expose age signals from a Microsoft account while preserving privacy. The APIs let Windows apps deliver consistent, age‑appropriate experiences and reuse verified age status, with parental controls now highlighted during device setup.
Firefox adds an AI Controls panel letting users toggle all current and future AI features, pick individual capabilities (translation, alt‑text, tab suggestions, link‑preview key points), and choose from multiple chatbot providers (Claude, ChatGPT, Gemini, Mistral) in a sidebar. The new Smart Window beta integrates an AI assistant that can read open tabs, browsing history, group related tabs, show…
Firefox adds a built‑in EasyList ad blocker for iOS using WebKit’s Content Blocker API, highlighting how Apple’s app‑store and engine restrictions limit independent browsers from offering full add‑on ecosystems, and arguing that true competition requires platform‑level policy change.
Microsoft announced a set of UI‑level tweaks to its Family Safety product: faster approval flows for screen‑time, app, and purchase requests; expanded app coverage in activity reports; and corrected balance display after top‑ups. The changes are shipped in the latest iOS/Android apps and the web portal, with a call for more feedback.
Firefox 154 now ships with Startpage pre‑installed as a selectable default search engine for several European countries, removing the need for extensions. The integration emphasizes privacy—no query logging or AI—while keeping existing search settings untouched.
