Dan Goodin

Reporter covering security at Ars Technica. DM me on Signal: DanArs.82.

Site:: https://arstechnica.com/author/dan-goodin/

Public Key

npub1z3lwfekw80j4ngzg6ky3ks202xr6uwnd4jttxzsd4euc9l55euvq48qvzu

NIP-05 Address

dangoodin_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqspglhyum8rhe2e5pydtzgmg984rpaw8fk6e94npgx6u7vzl62v7xqprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmnt6au2ra

Publishing to

relay.momostr.pink

Author Public Key

npub1z3lwfekw80j4ngzg6ky3ks202xr6uwnd4jttxzsd4euc9l55euvq48qvzu

Show more details

Last Notes

2026-03-25 22:31:03 UTC

- reply

citation?

2026-03-25 21:40:38 UTC

- reply

Wait, so if a nation state decrypts millions of medical records, government files, and bank transaction histories, and yours are among them, that won't affect you personnally?

2026-03-25 16:21:10 UTC

Google is dramatically shortening its deadline readiness for the arrival of Q Day, the point at which existing quantum computers can break public-key cryptography algorithms that secure decades’ worth of secrets belonging to militaries, banks, governments, and nearly every individual on earth.
https://arstechnica.com/security/2026/03/google-bumps-up-q-day-estimate-to-2029-far-sooner-than-previously-thought/

2026-03-24 16:49:22 UTC

Wow, TeamPCP is hacking open-source developers faster than we can report on them. The latest (that I'm aware of, anyway) is LiteLLM. They worked with Trivy but didn't bother to change their credentials after Trivy was hacked, despite an ample amount of advice to do so.
Folks, if any of you used LiteLLM, now is the time to change your credentials, at an atomic level. Now, as in immediately.
https://news.ycombinator.com/item?id=47501729

2026-03-18 20:12:56 UTC

Does anybody with a STRONG BACKGROUND IN WEBSITE PRIVACY have time to vet this research? Are TikTok and Meta pixels REALLY doing the things claimed? I'm concerned it may be overstating things in an attempt to sell its tag monitoring tools.
https://jscrambler.com/blog/beyond-analytics-tiktok-meta-ad-pixels

2026-03-03 17:47:32 UTC

RIP burner accounts
https://arstechnica.com/security/2026/03/llms-can-unmask-pseudonymous-users-at-scale-with-surprising-accuracy/

2026-02-27 19:02:21 UTC

Google has devised a means for securing HTTPS certificates against quantum computing attacks without massive performance hits stemming from the considerably longer size of data required to be included.
Is anyone following this work?
https://security.googleblog.com/2026/02/cultivating-robust-and-efficient.html

2026-02-26 15:54:24 UTC

That guest SSID you set up for your neighbors may not be as secure as you think
https://arstechnica.com/security/2026/02/new-airsnitch-attack-breaks-wi-fi-encryption-in-homes-offices-and-enterprises/

2026-02-17 21:45:47 UTC

Contrary to what password managers say, a server compromise can mean game over.
https://arstechnica.com/security/2026/02/password-managers-promise-that-they-cant-see-your-vaults-isnt-always-true/

2026-02-11 22:52:04 UTC

I'm curious to know what people think about Anthropic's claim that Claude found 500 high-severity vulnerabilities in open-source packages. Has anyone confirmed that these vulns were indeed high-severity and hadn't been discovered before? Is this development as big a deal as Anthropic says? Any other critiques?
https://red.anthropic.com/2026/zero-days/

2026-02-07 00:48:53 UTC

anybody ever seen this bug in iOS lockdown before?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/026/593/806/642/396/original/acd53f4afaeeac24.jpeg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/026/594/432/047/242/original/1892fc6d5ed24a94.jpeg

2026-02-06 19:25:07 UTC

Microsoft's former Windows head, Steven Sinofsky, sent Epstein secret company documents and sought Epstein's counsel on his departure from Microsoft.
https://www.neowin.net/news/former-windows-chief-shared-internal-secrets-with-jeffrey-epstein-documents-reveal/

2026-01-28 19:10:35 UTC

- reply

I appreciate everyone who has taken time to respond. Unfortunately, some of the responses demonstrate how much many of us privacy-minded technologists live in ivory towers and have no idea how hard it is to get the rest of the world to take on the added friction of switching.

2026-01-28 18:09:48 UTC

Even people with the most to lose continue to support and rely heavily on:
-- Google
-- Slack
-- Meta
-- Microsoft
-- Apple
-- Too many others to list
These orgs cozy up to authoritarianism. They terminate your account for any reason or no reaso at all. They shove AI down your throat.
And yet, my workplace, union, and so many of the orgs I value and need keep using them and have no plans to ween themselves off. Yes, I realize current dynamics make all of this inevitable.
So I'm left feeling hopeless and helpless, which is a terrible place to be.

2026-01-23 17:34:49 UTC

A techbro desperate for cash is detained for 13 hours after leaving a non-functioning, vibe-coded anti-fraud device in a Swiss hotel lobby during the Davos conf
https://sfstandard.com/2026/01/22/tech-dude-davos-bomb-lookalike-device/

2026-01-08 18:21:06 UTC

Has anyone compiled the privacy policies of various LLM platforms, ideally in a comprehensive way? OpenAI said today that private health data and conversations shared by ChatGPT Health won't be used for training purposes. Does this mean OpenAI won't sell it either or give it to law enforcement when presented with a warrant? What about other AI chat services.
I'm looking for responses from experienced privacy professionals or advocates with empirical data. Please, no responses airing cynicism or grievances about AI privacy in general, no matter how valid.
https://openai.com/index/introducing-chatgpt-health/

2025-11-21 22:43:13 UTC

The International Association of Cryptologic Research has cancelled the results of its annual leadership election after an official lost an encryption key needed to unlock results stored in a "hyper-secure election system."
https://www.nytimes.com/2025/11/21/world/cryptography-group-lost-election-results.html?unlocked_article_code=1.208._aCi.O706MR3i3l3K&smid=url-share

2025-11-18 19:06:52 UTC

- reply

Good point!

2025-11-18 19:05:06 UTC

- reply

Microsoft says in the post (see toot above) that the agent isn't enabled by default and that only experienced users should enable it. What are these users to do to prevent the attacks Microsoft is warning of?

2025-11-18 18:54:33 UTC

Thoughts about this Microsoft advisory?
"Additionally, agentic AI applications introduce novel security risks, such as cross-prompt injection (XPIA), where malicious content embedded in UI elements or documents can override agent instructions, leading to unintended actions like data exfiltration or malware installation."
https://support.microsoft.com/en-us/windows/experimental-agentic-features-a25ede8a-e4c2-4841-85a8-44839191dfb3

2025-11-13 18:55:12 UTC

- reply

The WSJ link is in the OP. A non-paywalled link is: https://web.archive.org/web/https://www.wsj.com/tech/ai/china-hackers-ai-cyberattacks-anthropic-41d7ce76

2025-11-13 18:02:34 UTC

I could really benefit from experts' analysis of this WSJ article reporting that China-backed hackers used Anthropic’s Claude to automate 80% to 90% of a September hacking campaign targeting corporations and governments.
There aren't a lot of specifics, but among those provided:
> The eﬀort focused on dozens of targets and involved a level of automation that Anthropic’s cybersecurity investigators had not previously seen.
> In this instance 80% to 90% of the attack was automated, with humans only intervening in a handful of decision points.
> The hackers conducted their attacks “literally with the click of a button, and then with minimal human interaction."
> Anthropic disrupted the campaign and blocked the hackers’ accounts, but not before as many as four intrusions were successful.
> In one case, the hackers
> directed Claude tools to query internal databases and extract data independently.
> “The human was only involved in a few critical chokepoints, saying,
> doesn’t look right, Claude, are you sure?’”
> ‘Yes, continue,
> ’ ‘Don’t continue,
> ’ ‘Thank you for this information,
> ’ ‘Oh, that
> Stitching together hacking tasks into nearly autonomous attacks is a new step in a growing trend of automation that is giving hackers
> additional scale and speed.
We've seen so many exaggerated accounts of AI-assisted hacks. Is this another one? Are there reasons to take this report more seriously? Any other thoughts?
https://www.wsj.com/tech/ai/china-hackers-ai-cyberattacks-anthropic-41d7ce76

2025-11-12 22:16:28 UTC

- reply

Since I first tooted this, the article has. been taken down. It has been available for more than 5 weeks and suddenly it's gone, with no explanation from WGCU, the public radio station in Fort Meyers, Florida.
Here's an image showing the URL of the story. Accompanying that is an archive link.
https://web.archive.org/web/20250923164120/https://www.wgcu.org/science-tech/2025-09-23/detection-expert-says-hackers-likely-used-ai-to-penetrate-airport-system
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/539/029/745/040/009/original/506fd5b821839545.png

2025-11-12 20:33:39 UTC

- reply

I mean, just listen to him talk:
> Hackers aren’t just sitting in dark rooms typing away anymore. With AI, they can launch faster, smarter attacks that slip past traditional security systems. AI can be trained to find weaknesses in seconds, or even disguise itself to look like a human user, making it very hard to spot.
> In this sort of attack, AI can do the heavy lifting that used to take hackers weeks. It can scan for weaknesses across huge systems in minutes, and once it finds a way in, it can copy normal user behavior so it doesn’t raise any alarms. That makes it far easier for criminals to slip through the cracks without being noticed.
> That’s why this airport attack is so concerning. It shows how quickly the rules of cybersecurity are changing. If hackers are using AI to get in, we need AI detectors on the other side to keep them out.”

2025-11-12 20:26:53 UTC

Wow, the lack of ANY factual support for such a claim amounts to hyperbole. And from a CEO peddling a service to "guarantee content integrity." File this one under "Umbrella salesman predicts torrential rain."
https://www.wgcu.org/science-tech/2025-09-23/detection-expert-says-hackers-likely-used-ai-to-penetrate-airport-system

2025-11-12 19:24:41 UTC

ICYMI: 4 Conde Nast employees were illegally fired for exercising permitted speech in their workplace. Tonight, NY AG Letitia James will call out this union-busting move by Conde management. Please attend. Please also sign our petition to reinstate our fired colleagues. https://actionnetwork.org/petitions/tell-conde-bosses-to-reinstate-the-fired-four-reverse-the-suspensions-and-end-the-union-busting.
Please boost for reach.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/538/353/371/204/178/original/6f8993aeed3c4c01.jpg

2025-10-31 15:59:19 UTC

"The former executive of Trenchant who pleaded guilty this week to selling his company's software hacking tools to a zero-day broker in Russia, sold at least one of these tools to the Russian firm even after learning that a previous tool he sold the broker was being used by a South Korean broker – indicating that the stolen tools were being passed on to others downstream."
A reminder that if you're not following @npub1gxm…hhnu you should be.
https://www.zetter-zeroday.com/former-trenchant-exec-sold-stolen-code-to-russian-buyer-even-after-learning-that-other-code-he-sold-was-being-utilized-by-different-broker-in-south-korea/

2025-10-30 21:37:44 UTC

People working on post-quantum-proofing vulnerable encryption protocols (and curious onlookers) can find lots of value in this new post from Cloudflare. It discusses the herculean engineering challenges of revamping anonymous credentials that will be broken by a quantum computer. There's a growing need for this kind of privacy (for instance to make digital drivers licenses privacy preserving), which allows individuals to prove specific facts, like they have had a drivers license for more than 3 years, without divulging personal information like their birthday or place of birth. The long and short of of the challeng is that engineers can't simply drop quantum-resistant algorithms into AC protocols that currently use vulnerable ones. Instead, engineers will need to collaborate with standards bodies that build entirely new protocols, largely from scratch. The post goes on to name a few of the most promising approaches.
https://blog.cloudflare.com/pq-anonymous-credentials/

2025-10-29 23:02:18 UTC

AMD, Intel and Nvidia have poured untold resources into building on-chip trusted execution environments. These enclaves use encryption to protect data and execution from being viewed or modified. The companies proudly declare that these TEEs will protect data and code even when the OS kernel has been thoroughly compromised. The chipmakers are considerably less vocal about an exclusion that physical attacks, which are becoming increasingly cheap and easy, aren't covered by the threat model These physical attacks use off the shelf equipment and only intermediate admin skills to completely break all TEEs made from these three chipmakers.
This shifting Security landscape leaves me asking a bunch of questions. What's the true value of a TEE going forward?. Can governments ever get subpoena rulings ordering a host provider to run this attack on their own infrastructure? Why do the companies market their TEEs so heavily for edge servers when one of the top edge-server threats is
physical attacks?
People say, "well yes. just run the server in Amazon or another top tier cloud provider and you'll be reasonably safe." The thing is, TEEs can only guarantee to a relying party that the server on the other end isn't infected and couldn't give up data even even if it was. There's no way for the relying party to know if the service is in Amazon or in an attackers's basement. So once again aren't we back to just trusting the cloud, which is precisely the problem TEEs were supposed to solve?
https://arstechnica.com/security/2025/10/new-physical-attacks-are-quickly-diluting-secure-enclave-defenses-from-nvidia-amd-and-intel/

2025-10-23 21:30:54 UTC

- reply

As @npub1gxm…hhnu reported recently, a CISA official blamed democrats during a press call. very concerning that even securing the nations infrastructure isn't immune from politicization.

2025-10-22 17:13:50 UTC

> The affected US‑EAST‑1 is AWS’s oldest and most heavily used hub. Regional concentration means even global apps often anchor identity, state or metadata flows there. When a regional dependency fails as was the case in this event, impacts propagate worldwide because many “global” stacks route through Virginia at some point.
> Modern apps chain together managed services like storage, queues, and serverless functions. If DNS cannot reliably resolve a critical endpoint (for example, the DynamoDB API involved here), errors cascade through upstream APIs and cause visible failures in apps users do not associate with AWS. That is precisely what Downdetector recorded across Snapchat, Roblox, Signal, Ring, HMRC, and others.
(h/t @npub1un3…uqv2)
https://www.ookla.com/articles/aws-outage-q4-2025

2025-10-16 20:39:59 UTC

"Godfather of Silicon Valley" Ron Conway resigns from Salesforce board after its CEO revealed his authoritarian leanings by calling on Tump to send national guards to San Francisco. "“It saddens me immensely to say that with your recent comments, and failure to understand their impact, I now barely recognize the person I have so long admired,” Conway tells Marc Benioff in an email.
https://sfstandard.com/2025/10/16/ron-conway-resigns-salesforce-foundation-board-marc-benioff/

2025-10-16 20:24:15 UTC

My profound thanks to Susan Stamberg, probably the biggest single reason I gravitated to journalism in my late teens. She was also a trailblazer for women. She died today at the age of 87. My condolences to her family.
https://www.npr.org/2025/10/16/1184880448/susan-stamberg-obituary

2025-10-14 16:57:45 UTC

- reply

As the wave of authoritarianism has crested, I've been challenging myself and others to ween ourselves off of centralized platforms that leak our private data (through breaches or voluntarily) and deplatform us for any reason or no reason, leaving us high and dry with no warning. You know this is awful when labor unions, civil rights groups and other groups under threat continue to trust Slack, Gmail, Xitter and the rest now of the broligarch-owned gatekeepers more than ever.
Some of you (and in some cases I) have responded with criticism of those still using these platforms. Many of you say unions should use decentralized alternatives such as Zulip, PGP on top of Slack, Mattermost, Matrix. Besides victim blaming, this response is misguided because it expects groups divert resources from their core missions to making immature and hard-to-use platforms work inside their organization.
All of this reminds me of the struggles we had with our dependence on unencrypted email in the 2000s and early 2010s. Back then, the only alternative was PGP, which was unusable for 50% or more of email senders. Then @npub1rkw…5q62 came along and solved most of the sticking points, almost overnight.
The lesson: decentralized, privacy-preserving platforms don't happen by accident. And they can't be cobbled together in beta form. They require funding and smart engineering that prioritizes usability as much as security.
I'm still not sure how we ween ourselves off of centralized platforms, but I think the success of Signal may serve as a useful model. Maybe we don't try to replace all platforms at once, Maybe for now we focus on finding an alternative to, say, Slack and use the momentum of that to tackle other platforms afterward.
I obviously don't have answers yet. I don't think anyone does yet. But it's important we start asking questions and stop blaming non-technologists who just want a platform that works.

2025-10-13 17:11:48 UTC

- reply

The fact that my labor union, like probably the majority of unions around the world, trusts slack is horrifying.

2025-10-13 17:10:17 UTC

- reply

Now that Marc Benioff, owner of Slack and Salesforce, has confirmed he sides with authoritarianism, it's more incumbent on us than ever to move off central platforms, which can dump communications we presumed were private or cut us off for any reason or no reason at all.
https://sfstandard.com/2025/10/10/marc-benioff-national-guard-sf/

2025-10-01 17:30:54 UTC

- reply

Interesting. So what do you think is causing the results I and the Verge got?

2025-10-01 17:27:41 UTC

- reply

Here's another reminder that it's best to resist as much as possible the siren's call of relying on AI and other services from Big Tech. Gemini is blocking questions about Trump showing signs of dementia even as it answers the same question when applied to Biden. When we turn to AI we are abdicating our own judgement and research responsibilities to a broligarchy that bends to the whims of billionaires.
https://www.theverge.com/news/789152/google-ai-searches-blocking-trump-dementia-biden
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/300/061/864/400/127/original/e4f45a53e42d7c4d.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/300/072/991/347/661/original/66812af424a32782.png

2025-09-30 20:44:21 UTC

The chipmakers say physical attacks aren't in the threat model. Many users didn't get the memo.
https://arstechnica.com/security/2025/09/intel-and-amd-trusted-enclaves-the-backbone-of-network-security-fall-to-physical-attacks/

2025-09-25 16:28:05 UTC

Evergreen headline
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/265/873/905/403/244/original/a0de9bf0fdfced34.png

2025-09-18 17:35:15 UTC

I'm trying to decide if I should cancel my Disney+/Hulu subscription right away or if I first should find a way to contact the company and tell them I will if it doesn't restate Jimmy Kimmel

2025-09-17 19:02:02 UTC

Can you imagine the huge bonanza espionage and ransomware threat actors are going to have when every service you use forces you to provide them with your ID? This is a disaster that 100% will happen. I can hardly wait.

2025-09-05 16:32:20 UTC

- reply

As @npub1ksq…nkvf demonstrates in a new paper, these types of operations are easy and cheap to build at scale.
https://arxiv.org/abs/2508.20186

2025-09-03 18:50:09 UTC

People in Internet security circles are sounding the alarm over the issuance of three TLS certificates for 1.1.1.1, a widely used DNS service from Cloudflare. The three improperly issued certs escaped notice for 4 months.
https://arstechnica.com/security/2025/09/mis-issued-certificates-for-1-1-1-1-dns-service-pose-a-threat-to-the-internet/

2025-08-30 18:36:31 UTC

After more than a decade of receiving these sorts of messages, I still never know how to respond in a way that might be remotely helpful.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/119/156/406/510/317/original/ea591c6966351648.png

2025-08-29 21:35:42 UTC

- reply

Genuine question here; not trying to be argumentative: how does someone enrolling a passkey cause them to be locked out of their accounts? They can still access their account using their password, just as they did before. I don't understand how the passkey causes the lockout?

2025-08-28 16:21:58 UTC

There very well may be major vulnerabilities in Passkeys or the FIDO spec they're based on. This most definitely ain't one of them.
https://arstechnica.com/security/2025/08/new-research-claiming-passkeys-can-be-stolen-is-pure-nonsense/

2025-08-07 17:49:36 UTC

A reminder that software makers, hardware makers, cloud services, payment processors, and the like will throw their customers under the bus whenever it suits them. Your payment card, food delivery account, AWS instance, Gmail address -- all can be taken away on a whim for any reason or no reason. These providers are NOT your friend. Make plans now. Have backups in place. Practice self-reliance. Ween yourself off these one at a time.

2025-08-07 17:40:29 UTC

- reply

Motherf**kin' wind farms!
https://media.infosec.exchange/infosec.exchange/cache/media_attachments/files/114/985/976/072/307/954/original/13afd591a84d4d7b.mp4

2025-08-06 18:46:47 UTC

- reply

I haven't been to a HD or Lowes in years. In SF, we have Discount Home Builders Supply & Hardware, a locally-owned place that's been in business for decades. The workers there monitor the isles and actively ask if you need/want help. All cities should be so lucky.
https://www.discountbuilderssupplysf.com

2025-08-04 19:37:25 UTC

- reply

"In reality, all we’ve created is a bot which is almost perfect at mimicking human-like natural language use, and the rest is people just projecting other human qualities on to it. Quite simply, “LLMs are doing reasoning” is the “look, my dog is smiling” of technology. In exactly the same way that dogs don’t convey their emotions via human-like facial expressions, there’s no reason to believe that even if computer could think, it’d perfectly mirror what looks like human reasoning."

2025-08-04 19:36:50 UTC

Once again, @npub1uu7…gs7t nails it, this time calling out the "gluttony of myopic visionaries" shilling the wonders of AI.
https://malwaretech.com/2025/08/every-reason-why-i-hate-ai.html

2025-07-30 22:41:12 UTC

Is the activating of the Minnesota National Guard an over reaction to the ransomware attack on St. Paul? I have yet to hear an explanation of what exactly these folks are doing or what they can do that normal incident response people can't. Also, how many troops have been deployed? I haven't seen any of these questions answered let alone asked in the coverage I've read.

2025-07-24 16:02:09 UTC

- reply

My story from Monday is here:
https://arstechnica.com/security/2025/07/no-phishers-are-not-bypassing-fido-mfa-at-least-not-yet-heres-why/
In short, the attack as originally described simply would not work against a FIDO2-compliant authentication system. Whatever system the researchers analyzed used a non-FIDO2 fallback in the event the user was unable to provide FIDO2-MFA. Calling this a bypass is like saying a door lock is insecure because an intruder could enter through a window. Lots of publications continue even now to say this was a bypass. It wasn't.

2025-07-24 15:53:21 UTC

- reply

The company that reported (incorrectly) finding a way to bypass FIDO2-based MFA says it's "collaborating with the FIDO Alliance to review the attack." It goes on to say: "We are working together to review our findings and will publish a follow-up as soon as possible." So far no one outside the company (and possibly inside) has been able to reproduce the attack.
FIDO2 is the world's greatest hope yet in battling credential phishing. It's such a shame that this research got published before the findings could be confirmed.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/909/008/808/003/827/original/93ca2a6a34161a00.png

2025-07-18 16:28:38 UTC

Coming shortly. Researchers say they've uncovered an in-the-wild phishing operation that "effectively bypasses any protections that a FIDO key grants." As I will explain, this isn't the case. The research misunderstands what's occurring in the attacks. More to follow.

2025-07-03 16:34:31 UTC

Interesting article reporting that Android will soon give Gemini broadened access to phones and the apps they run, even when Gemini has not been turned on. Article gos on to say people who don't want this should "open the Gemini app from your Android device" and turn off each app extension. Sounds simple enough, but I'm not finding any Gemini app installed on my pixel. Can anyone help me figure out what precisely people must do too keep Gemini off of their android devices?
https://tuta.com/blog/how-to-disable-gemini-on-android#_

2025-06-24 22:44:06 UTC

- reply

Interesting. I thought speculative execution was only a thing for CPUs. I didn't know GPUs behave and can be exploited the same way. So just as Intel restricts some of the ways CPUs do speculative execution, so too does it create GPU speculative execution, restrictions, yes?

2025-06-24 22:27:20 UTC

- reply

Another question: if Spectre is a vulnerability affecting CPUs, why did Intel create mitigations for GPUs?

2025-06-24 19:29:22 UTC

- reply

Thanks for all your comments so far. Can any of you with Ubuntu familiarity tell me how the change will work? The mitigations will be disabled by default, yes? What if a user wants them on? Will that be easy to do?

2025-06-24 17:48:48 UTC

Ubuntu is now allowing users to disable security mitigations Intel has baked into its GPU components. People are claiming the setting provides up to a 20% boost in performance. I'm still trying to understand more about the mitigations, but they appear to involve defending against Spectre-based attacks. Is this wise? On the one hand, I'm not aware of a single Spectre-based attack in the wild. On the other hand, you're leaving yourself potentially exposed. Thoughts
https://www.phoronix.com/news/Disable-Intel-Gfx-Security-20p

2025-06-10 19:08:11 UTC

Found in the wild: 2 Secure Boot exploits. Microsoft is patching only 1 of them.
https://arstechnica.com/security/2025/06/unearthed-in-the-wild-2-secure-boot-exploits-microsoft-patches-only-1-of-them/

2025-06-03 14:19:36 UTC

Tracking code that Meta and Russia-based Yandex embed into millions of websites is de-anonymizing visitors by abusing legitimate Internet protocols, causing Chrome and other browsers to surreptitiously send unique identifiers to native apps installed on a device, researchers have discovered. Google says it's investigating the abuse, which allows Meta and Yandex to convert ephemeral web identifiers into persistent mobile app user identities.
https://arstechnica.com/security/2025/06/meta-and-yandex-are-de-anonymizing-android-users-web-browsing-identifiers/

2025-05-21 17:07:04 UTC

- reply

Signal writes:
"We hope that the AI teams building systems like Recall will think through these implications more carefully in the future. Apps like Signal shouldn’t have to implement “one weird trick” in order to maintain the privacy and integrity of their services without proper developer tools. People who care about privacy shouldn’t be forced to sacrifice accessibility upon the altar of AI aspirations either."

2025-05-21 17:06:22 UTC

Signal Messenger is warning that Recall, the AI tool rolling out in Windows 11 that will screenshot, index, and store everything a user does every three seconds, poses a risk to its users. Effective immediately, the Windows Desktop version will by default block the ability of Windows to screenshot the app. Of course, Microsoft provides no API to disable Recall from screenshotting specific apps, so Signal is getting creative. They are invoking a digital rights management API that blocks the screenshotting of copyrighted material.
https://signal.org/blog/signal-doesnt-recall/

2025-05-14 16:44:21 UTC

Folks, there is 0 evidence that Steam passwords have been breached. Unless and until credible evidence occurs, please do NOT urge people to change their login credentials and please do NOT boost other people's toots doing the same. Creating unjustified anxiety about a non event does a disservice to us all.
Please boost for visibility.

2025-05-02 17:32:51 UTC

Microsoft writes:
"For example, if you have a password and “one time code” set up on your account, we’ll prompt you to sign in with your one time code instead of your password. After you’re signed in, you’ll be prompted to enroll a passkey."
I don't understand this. Why would Microsoft remove the password requirement and rely solely on a 1-time code? And what happens if the user decides not to use a passkey?

2025-04-30 18:48:37 UTC

From the department of head scratches comes this counterintuitive news: Microsoft says it has no plans to change a remote login protocol in Windows that allows people to log in to machines using passwords that have been revoked.
https://arstechnica.com/security/2025/04/windows-rdp-lets-you-log-in-using-revoked-passwords-microsoft-is-ok-with-that/

2025-04-18 01:18:30 UTC

ICE officers in paramilitary gear appear to be inquiring about the citizenship status of passengers on a Amtrak Empire Builder train. As someone who rides Amtrak a lot, what should I say and do if I'm ever stopped like this?
https://www.havredailynews.com/story/2025/04/17/local/ice-questions-amtrak-passengers-in-havre-about-citizenship/547792.html#

2025-04-11 22:09:49 UTC

- reply

So, send an email or DM that even passes through a Windows machine with Recall turned on and it's screenshotted, swept into OCR, processed by Copilot and stashed away in perpetuity. Recall reminds me a lot of the backdoor the FBI wanted Apple to build. The FBI said it would be safe because only the FBI would have access to it. Apple rightly pointed out that no, something that powerful would inevitably get hacked and abused in ways no one could control. Now, Microsoft is trying to say that the guardrails it has put on Recall will curb any unintended consequences and we're supposed to take that at face value?

2025-04-11 22:01:39 UTC

- reply

People in comments keep saying, oh well, time to move to Linux, as if that somehow insulates them. They forget that even then every interaction their Linux box has with a Windows 11 installation will STILL be compiled into a database that can be abused.

2025-04-11 21:58:39 UTC

Snapshotting and AI processing a screen every 3 seconds. What could possibly go wrong?
https://arstechnica.com/security/2025/04/microsoft-is-putting-privacy-endangering-recall-back-into-windows-11/

2025-04-07 16:11:25 UTC

- reply

The problem is someone is using his current account to masqurade as him. Creating a new account from scratch won't stop that.

2025-04-07 15:57:21 UTC

- reply

Reupping this request for help from someone at Facebook to help restore a journalist's hijacked account. As mentioned before, he has sent Facebook a scan of his driver license on multiple occasions and received a reset links, but they always fail to work. Please boost for reach.

2025-04-04 21:10:30 UTC

No, I won't be going to RSA. In fact, I encourage everyone else to stay away. It's not fair to penalize people overseas for not traveling to the US because they don't want to jeopardize their safety. Besides, RSA is a really crappy conference with nearly zilch news value.

2025-04-02 22:56:42 UTC

I don't want to sound naive, but I'm still trying to understand all the criticism over Trump imposing "reciprocal tariffs." If reciprocal tariffs are so bad, isn't it at least as bad that countries are imposing tariffs on the US in the first place? Sorry if this question sounds dumb. I spent 15 minutes looking online and still don't get it.

2025-04-02 07:41:22 UTC

- reply

I dunno. I think they were going to provide some sort of explanation or account of what happened (likely whitewashy or handwavy).

2025-04-02 07:37:55 UTC

- reply

When I asked Oracle for comment, a PR person responded and offered a comment on the condition I not attribute it in any way to Oracle. When I said no, the PR person said Oracle was declining to comment.
#radicalopacity

2025-04-02 00:42:22 UTC

- reply

Here's the latest on XiaoFeng Wang, the a distinguished computer scientist who was summarily fired on Friday from his tenured position at Indiana University, where he had spent 20 years racking up accolades for his research in cryptography, privacy and cybersecurity. It comes from Alexander Tanford, president of the Bloomington chapter of the AAUP, the union representing IU professors, and colleagues of Wang's.
In February, an anonymous person filed a complaint alleging research misconduct against Wang. "The charge seemed trivial -- that he had failed to properly disclose who was principal investigator on a grant application and had not fully listed all his co-authors on an article," Tanford told me.
On March 13 or 14, IU temporarily suspended Wang, banned him from his office and denied access to his computer, research and data while the investigation continued. This is permitted under IU's research misconduct policy. The reasons, though, aren't publicly known.
On March 28, Provost Rahul Shrivastav informed Wang he was being terminated immediately. Shrivastav provided no reason (he mentioned Wang taking a job at a university in Singapore, but this is permitted and not grounds for dismissal). What's more, policy ACA-52, approved by the IU Board of Trustees, prohibits summarily firing a tenured professor.
Also on March 28, homes that Wang owns in Bloomington and Carmel, Indiana, were raided by the FBI. The FBI says the raids were court approved, but so far no one has seen a warrant. The US Attorney's Office for the Southern District of Indiana will neither confirm nor deny an investigation.
Indiana University has steadfastly refused to provide any reason for the termination or its failure to follow its own policy. Students and fellow faculty remain in the dark. His PhD students are frantically scrambling to find new advisors. One such student learned of Wang's firing only a few weeks before his PhD defense.
I reached out to Wang's attorneys 24 hours ago, and still haven't heard back.
We really need answers here. IU is tarnishing its reputation for academic independence. The lack of transparency here, both by IU and the FBI, truly sucks.
https://arstechnica.com/security/2025/03/computer-scientist-goes-silent-after-fbi-raid-and-purging-from-university-website/

2025-03-31 16:28:50 UTC

- reply

The American Association of University
Professors is reminding Indiana University's provost that as a tenured professor, XiaoFeng Wang is entitled to due process. The university, meanwhile, is maintaining radio silence, which isn't a good look to prospective students considering attending.
https://aaup.sitehost.iu.edu/reports/AAUP_March_31_Letter_Shrivastav.pdf

2025-03-30 20:05:14 UTC

A prominent computer scientist who has spent 20 years publishing academic papers on cryptography, privacy, and cybersecurity has gone incommunicado, had his professor profile, email account, and phone number removed by his employer Indiana University, and had his homes raided by the FBI. No one knows why.
#XiaofengWang Xiaofeng Wang
https://arstechnica.com/security/2025/03/computer-scientist-goes-silent-after-fbi-raid-and-purging-from-university-website/

2025-03-23 22:52:18 UTC

Can anyone help me help a friend recover his compromised Facebook account? He's not sure how it got hijacked, but someone is using it to reach out to people, make a friend request, and then ask them out on dates. He's an investigative reporter, so it's not clear if this is a targeted attack attempting to meddle with confidential sources or an opportunistic one doing something like pig butchering. In any event, the compromised account poses a threat to Facebook users. My friend has tried recovering his account by sending FB a scan of his driver license, but the recovery link he gets gives him an error when he clicks on it. Does anyone reading this work in security at FB, or know someone who does? I (and my friend) would be so grateful for any help. Please DM me, preferably by Signal (DanArs.82) or here on Mastodon.

2025-03-21 03:45:52 UTC

- reply

Customs also turned away members of the seminal UK punk band UK Subs at the airport as they were arriving to play at a festival.
https://dorseteye.com/im-so-proud-to-be-deported-from-the-usa/

2025-03-21 03:41:15 UTC

Seriously, if you're thinking of visiting the US anytime soon, just don't.
https://www.bbc.com/news/articles/cly67j35y99o

2025-03-20 07:07:34 UTC

People knowledgeable about EVs: what brand/model is far superior to a Tesla and why? I've been showing up to the local dealership and trying to talk people going inside to reconsider. I want to step up my elevator pitch by giving them useful, accurate info about better alternatives.

2025-03-17 02:56:41 UTC

Open-source software used by more than 23,000 organizations, some of them in large enterprises, was compromised with credential-stealing code after attackers gained unauthorized access to a maintainer account, in the latest open-source supply-chain attack to roil the Internet.
https://arstechnica.com/information-technology/2025/03/supply-chain-attack-exposing-credentials-affects-23k-users-of-tj-actions/

2025-03-13 17:23:53 UTC

Yeah, I get all that, but another measure of security is how hard is it to break it? Yes, BSD isn't completely secure, but it's probably more secure than most other OSes. How does Deepseek compare with other LLMs?

2025-03-04 19:37:31 UTC

- reply

So, an attacker who gets access to a hypervisor in, say, GM's network also gets access in Ford's network? I don't think that's what you mean, but that's how it sounds to me.

2025-03-04 19:34:04 UTC

- reply

OK, thanks, Kevin. Is it fair to compare accessing the hypervisor to gaining control over an Active Directory?

2025-03-04 19:26:54 UTC

- reply

I just came here to ask you why these vulnerabilities are rated so critical if they can't be remotely exploited. Looks like you partially answered my question, but can you say more, please? Isn't it pretty much always game over when a threat actor has unauthorized access to a VM connected to your network? What's the scenario you're envisioning that makes these CVEs such a threat?

2025-03-04 17:46:53 UTC

Elmo critics: don't gloat too much about the recent declines in Tesla stock. Shares of this company have always been volatile, so a 32% drop since the beginning of the year says little. Share prices as of today are still 24% higher than 6 months ago, 44% higher than this time last year, and more than 5-fold higher over 5 years. Shares could surge again. It's way too early to declare any sort of victory or comeuppance.

2025-02-26 18:35:27 UTC

- reply

There ain't no way my union or local will deploy Matrix in its current form.

2025-02-20 03:52:29 UTC

Can we devote some time to discussing Slack? As in, why are we all sending our every thought to a centralized server that can be hacked, and can can train AI with them? And why is Slack allowed to store transcripts but I can't?
My union uses Slack for organizing. How crazy is it that an organization in the cross hairs of a dangerous and emboldened government would do this? With everything going on right now, I'd love to be more active in the union, but must I really give up so much to this opaque platform?
Is anyone else struggling with these concerns? Do you know of viable Slack alternatives? Are there any hacks that make Slack less of a privacy invasion or make LLM training harder? Are there at least ways for me to save sessions the way I can with IRC? How do I resist Slack and not lose touch with groups that still use it?
Please boost for reach.

2025-02-14 16:33:29 UTC

If you're still tweeting on the hell site -- particularly those with blue checkmarks -- you're actively helping drive investors' renewed interest in the platform. Same thing for companies like Apple and Amazon that are once again advertising there.
https://www.nytimes.com/2025/02/13/technology/elon-musk-x-debt-sale.html

2025-02-11 23:05:29 UTC

The result of the attack is the planting of false long-term memories that will be present in all future sessions, opening the potential for the chatbot to act on false information or instructions in perpetuity.
https://arstechnica.com/security/2025/02/new-hack-uses-prompt-injection-to-corrupt-geminis-long-term-memory/

2025-02-05 18:32:41 UTC

- reply

Earnest question: do any of you stream? If so, how do you go about doing that? My understanding is that Roku is no less secure/private than smart TVs.

2025-02-04 19:36:12 UTC

For a couple years now I've been asking journos and privacy and civil liberties advocates still tweeting regularly: is there ANYTHING Musk could do to make you finally give up the platform? It looks like his Nazi salute was the red line for a good many of the people I was thinking of. And to them, kudos!
But even now a lot of these laggards are still supporting a platform hostile to a free press, privacy, and human rights. And to them, I ask the question once again.
Trust me, history isn't going to judge you kindly.

2025-02-03 19:15:15 UTC

- reply

It looks like the "major" AMD vulnerability that @npub1525…3vrv reported had leaked has now been disclosed.
The vulnerability, with a 7.2 severity rating, allows hackers to bypass Secure Encrypted Virtualization—a protection that provides the cryptographic means for certifying that a VM hasn’t been compromised by anyone who may have had access to the physical machine running the vulnerable AMD chip. The patch comes in the form of microcode that presumably will be provided by the device OEM.
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3019.html

2025-02-03 17:55:22 UTC

- reply

For starters, because PGP was a nightmare for non-techies to use. It was also only as strong as the mail client it ran on, and hence had a fairly big attack surface. Hell, even Phil Zimmermann wouldn't use it.

2025-02-03 17:47:15 UTC

- reply

Sounds scarily similar to PGP.