evacide

Director of Cybersecurity
@EFF
/ Co-founder of
@stopstalkerware
/ These are my opinions, not my employers’ / I did a TED talk once

Public Key

npub18wn0jd3p7n6u3y7mc46p0hpx3cmtv9k3mu82rc0lhkg3rdyf590s3wshpx

NIP-05 Address

evacide@hachyderm-io.mostr.pub

Profile Code

nprofile1qqsrhfhexcslfawgj0du2aqhmsngud4kzmga7r4pu8lmmyg3kjy6zhcpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds62uuw4

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub18wn0jd3p7n6u3y7mc46p0hpx3cmtv9k3mu82rc0lhkg3rdyf590s3wshpx

Show more details

Last Notes

2026-04-09 16:49:06 UTC

EFF is finally leaving X and here is a blog post about why: https://www.eff.org/deeplinks/2026/04/eff-leaving-x

2026-04-01 01:54:42 UTC

Good news for people with older iPhones. Patch your stuff.
https://www.wired.com/story/apple-will-push-out-rare-backported-patches-to-protect-ios-18-users-from-darksword-hacking-tool/

2026-03-28 03:40:06 UTC

Yael's post demonstrates something about digital privacy/security that I think a lot of people miss: there is no right answer, just a series of trade-offs. And every person has to make their own decisions about which trade-offs are worthwhile. https://blog.yaelwrites.com/options-for-phones-at-protests/

2026-03-23 21:55:50 UTC

If you have an iPhone, today is a good day to make sure you are running the latest software. https://techcrunch.com/2026/03/23/someone-has-publicly-leaked-an-exploit-kit-that-can-hack-millions-of-iphones/

2026-03-22 19:15:56 UTC

For people who are concerned about having their devices seized at US airports starting Monday when ICE "assists" the TSA, EFF has this guide: https://www.eff.org/deeplinks/2025/06/journalist-security-checklist-preparing-devices-travel-through-us-border

2026-03-03 06:44:45 UTC

What a stupid time to have a degree in International Relations.

2026-03-02 07:03:36 UTC

I have come away from my last conference cautiously optimistic about how useful AI can be in reversing malware and extremely scared about all of the new attack surface being created in the use and deployment of AI tools.

2026-02-21 23:40:18 UTC

Hacktivists tried to find a workaround to Discord’s age-verification software, Persona. Instead, they found its frontend exposed to the open internet, and that was just the beginning.
https://www.therage.co/persona-age-verification/

2026-02-19 19:56:37 UTC

The most monstrous lie that I regularly tell myself is "I'll get that work done while I'm on the plane."

2026-02-02 04:10:16 UTC

Why do your organizing over Signal? So that you don't do your organizing on an app that hasn't been tested or reviewed, run by a guy who doesn't tell his users about data breaches and security problems.
https://www.ibtimes.co.uk/stopice-hacked-names-locations-over-100k-users-were-sent-fbi-ice-hsi-1775307

2026-01-29 22:45:16 UTC

This is your regular reminder that I do not owe you an argument defending a position that you have decided that I hold. Indeed, I do not owe you an argument about anything.

2026-01-16 00:59:32 UTC

If you are organizing folks in Minneapolis right now, you may find this guide to Signal for beginners by @nprofile…upkm useful: https://freedom.press/digisec/blog/signal-beginners/

2026-01-11 01:55:23 UTC

Sometimes I read the threads that experienced activists write about how to behave at protests because it reminds me that the kinds of replies I get when I give digital privacy/security advice aren't just for me.

2026-01-09 08:16:01 UTC

We are 9 days into 2026 and my New Years' Resolution to just let people be wrong on the internet is already is truly testing the limits of my willpower.

2026-01-09 07:55:21 UTC

- reply

There is no one-size-fits-all solution for digital safety at protests. You need to decide in advance what your goals are, what is important for you to protect, and what is likely to happen to you, and threat model accordingly.

2026-01-09 07:50:00 UTC

- reply

But if it is important to you to maintain your anonymity at a protest, consider leaving your phone at home, or at least turning it on/off only once you are well out of the neighborhood.

2026-01-09 07:47:47 UTC

- reply

There are other reasons you might want to take a cheap/disposable/burner phone to a protest, such as making sure that if you are arrested, the police don't seize/break/confiscate your main phone.

2026-01-09 07:45:32 UTC

If you don't want ICE to know you were at a protest, taking a burner phone is not going to help you stay anonymous if you go home afterwards. https://www.404media.co/inside-ices-tool-to-monitor-phones-in-entire-neighborhoods/

2026-01-04 23:29:20 UTC

This year, for my mental health, I'm going to practice just letting people be wrong on the internet.

2025-12-12 23:19:12 UTC

NYT reports that the TSA is giving ICE a list of every person who's to be taking a domestic flight inside the US so ICE can run it through their database looking for targets.
I'm not a lawyer, but I feel like the 4th Amendment has something to say about this.
https://www.nytimes.com/2025/12/12/us/politics/immigration-tsa-passenger-data.html?unlocked_article_code=1.8E8.lG_B.SvLF8g3CXiKG&smid=bs-share

2025-12-03 21:47:00 UTC

I don't dress for the male gaze. I dress for a women who are old enough to be my mother, wear oversized jewelry, and say things like "I'd dye my hair that color."

2025-11-16 22:00:30 UTC

I gave a talk about fascism at a conference and the first reply to the conference's post on X with a photo of me in front of my slides is a rando word-vomiting about how Hitler was working for the Zionists, in case you're wondering how that place is going.

2025-11-05 20:47:31 UTC

Cybersecurity professionals/ransomware negotiators turned out to be running a ransomware gang. https://breached.company/when-the-defenders-become-the-attackers-cybersecurity-experts-indicted-for-blackcat-ransomware-operations/

2025-10-23 05:22:46 UTC

If you think that Signal is an op and totally backdoored, my recommendation is that you should plan all of your crimes over Telegram group chat.

2025-10-17 18:44:21 UTC

If your protest privacy/security advice does not start with a discussion of threat models, it is probably not good advice.

2025-10-14 18:35:11 UTC

Truly, SS7 is the surveillance gift that keeps on giving: https://www.motherjones.com/politics/2025/10/firstwap-altamides-phone-tracking-surveillance-secrets-assad-erik-prince-jared-leto-anne-wojcicki/

2025-10-13 04:03:48 UTC

"A soldier knows what to do when they encounter another soldier. But an air-humping frog?"
@sarahjeong.bsky.social on the shitposting/aura farming era of American politics.
https://www.theverge.com/policy/798491/frog-portland-trump-national-guard

2025-10-06 18:06:58 UTC

I deleted my post about the Discord hack because the compromise was a third-party support service and not a third-party dedicated age verification system. Collecting user IDs is still bad and they are hard to protect, but being accurate in my posts is also important.

2025-10-06 17:03:11 UTC

As the prophecy foretold, a major platform's third-party age verification system has been hacked and hackers had access to the government ID images of Discord's users.
https://www.tomsguide.com/computing/online-security/discord-users-suffers-the-first-high-profile-age-verification-hack-and-its-unlikely-to-be-the-last

2025-09-10 00:43:19 UTC

Is ICE about to go buck wild using cell site simulators? Good thing EFF has a project to help you detect them:
https://www.eff.org/deeplinks/2025/03/meet-rayhunter-new-open-source-tool-eff-detect-cellular-spying
https://www.forbes.com/sites/the-wiretap/2025/09/09/how-ice-is-using-fake-cell-towers-to-spy-on-peoples-phones/

2025-09-06 17:32:03 UTC

Shout-out to the co-worker who, when discussing new EFF swag for the store says, "Give me your worst ideas. I want only your worst ideas." We are going to have so many thongs, guys.

2025-08-20 21:48:22 UTC

I take it all back, there ARE violent criminals on the streets of San Francisco. They're grabbing people off the street and pepper spraying journalists.
https://sf.gazetteer.co/i-reported-from-an-ice-action-on-sansome-and-all-i-got-was-a-face-full-of-pepper-spray

2025-08-20 18:25:26 UTC

You will sure be shocked to discover that I have some things to say about AI-powered "smart" glasses that give no indication that they are recording your every word.
https://techcrunch.com/2025/08/20/harvard-dropouts-to-launch-always-on-ai-smart-glasses-that-listen-and-record-every-conversation/

2025-08-19 17:14:56 UTC

The founders of the Tea app tried to recruit a female co-founder and face for the app, telling her "Tea has all the safety measures that Facebook lacked and more to ensure that only women are in the group."
https://www.404media.co/how-teas-founder-convinced-millions-of-women-to-spill-their-secrets-then-exposed-them-to-the-world/

2025-08-18 19:02:16 UTC

I talked to 404 Media about devices for tracking and spying on your partner being sold on TikTok: https://www.404media.co/why-404-media-needs-your-email-address/

2025-08-13 18:00:03 UTC

- reply

@nprofile…4dwe Trump will make an all-caps post of Truth Social. it will be devastating.

2025-08-12 21:38:22 UTC

It is sometimes necessary, in these difficult times, to spend an hour scrolling through clothing sites, hoping that one of these gowns is going to give you the strength to fight fascism.

2025-08-10 18:52:14 UTC

Even when I don't go to Vegas, the Vegas gossip comes to me.

2025-08-06 17:15:22 UTC

Ron Deibert is absolutely the voice that the infosec industry needs to be listening right now. We are in a moment where fascism is consolidating power and most of the infosec industry is either playing along or is busy bragging about how much AI they've shoved into their products.
https://techcrunch.com/2025/08/06/citizen-lab-director-warns-cyber-industry-about-us-authoritarian-descent/

2025-08-04 20:06:57 UTC

I'm sorry I will have to miss this meeting because the cat has fallen asleep with his head on my shoulder and is making little snoring sounds.

2025-08-04 19:22:46 UTC

Listen, we are in a terrible and difficult time where the horrors can often feel overwhelming. Lean into the things that bring you joy. If that means that sometimes you're wringing that last drop of dopamine out of watching bad people suffer as the result of their poor choices, you do you.

2025-07-29 06:18:54 UTC

I live in the middle of San Francisco. I walk and take public transportation everywhere daily, feeling perfectly safe. And every time someone starts ranting about how scary and dangerous cities are, I nod and smile because I do not want them to come here.

2025-07-23 03:05:35 UTC

When I was a kid, I couldn't wait to be an adult because I imagined that adulthood would be a time when no one would interrupt me when I was trying to read.
If I could go back in time, I would tell that little girl she has never been more wrong about anything in her life.

2025-07-21 18:27:20 UTC

Writing the first draft of my FTC comments and wondering how many times I am allowed to write "fuck no, you shitweasel." https://www.ftc.gov/news-events/news/press-releases/2025/07/ftc-seeks-comment-petition-vacate-2021-order-related-provider-stalkerware-apps

2025-07-17 23:31:46 UTC

This is just to let
you know
I have taken
the plums
out of the icebox
because fruit is better
at room temperature

2025-07-16 22:26:49 UTC

The horrors persist, but I have summer strawberries from the farmers' market.

2025-07-12 17:20:43 UTC

This is your regular reminder that if you are the smartest person in the room, go find another room. You are not going to run out of people or rooms.

2025-07-10 00:16:22 UTC

I've spent not-insignificant amount of time at protests in the US, looking for signs of IMSI catchers and never found anything, so when I saw this, my ears perked up:
https://san.com/cc/exclusive-evidence-of-cell-phone-surveillance-detected-at-anti-ice-protest/

2025-07-09 01:17:16 UTC

Google continues the industry-wide trend of jamming AI down users' throats, making it difficult or impossible to opt out, and potentially endangering the privacy of communications: https://www.neowin.net/guides/google-can-now-read-your-whatsapp-messages-heres-how-to-stop-it/

2025-07-05 21:30:40 UTC

I was feeling entirely too confident and capable, so I decided to train press-up to handstand and now I am going to be suffering through these drills and progressions for a good long time.

2025-07-03 18:28:54 UTC

Today I refrained from wearing my guillotine blade necklace while reporting for jury duty. Please clap.

2025-07-02 19:51:35 UTC

Every once in a while, someone tells me that an abusive partner left them alone because they were afraid of what I would do if they didn't, and I feel like I have done something right.

2025-06-27 18:52:13 UTC

Website/device age verification is a privacy and security nightmare and everyone who tells you that this is a solved problem is lying to you.
https://gizmodo.com/supreme-court-says-age-verification-laws-for-porn-sites-are-constitutional-2000621265

2025-06-25 03:28:23 UTC

Do I think that the national Democratic Party will learn anything from Mamdani's win? No. Do I think it is important to enjoy a goddamn victory once in a while? Yes.

2025-06-15 18:43:41 UTC

I would like to be Chrisjen Avasarala: impeccably-dressed, running things, swearing like a sailor.
But I am Camina Drummer: barely keeping it together, sort of in charge, with a lot of complicated relationships and a strong eyeliner game.

2025-06-13 21:03:38 UTC

Seriously, if you think that it is clever to respond to a guide with advice for journalists for protecting their devices when crossing the US border with "You just shouldn't ever go to the US!" please consider posting your response in your own timeline, where I will never have to see it.

2025-06-13 16:38:42 UTC

Are you a journalist who needs advice for how to prepare your electronic devices for travel across the US border?
EFF and Freedom of the Press have you covered: https://freedom.press/digisec/blog/border-security/

2025-06-13 00:09:36 UTC

If you have an iPhone, make sure you always have the latest security update.
If you are concerned that you might be targeted by government spyware, enable Lockdown Mode.
https://techcrunch.com/2025/06/12/apple-fixes-new-iphone-zero-day-bug-used-in-paragon-spyware-hacks/

2025-05-22 19:55:11 UTC

Me, looking at my work calendar: This is insane. No one can do this much work. I'm going to find the asshole that did this and give them a piece of my mind!
Me, looking in the mirror: Oh no.

2025-05-22 19:31:43 UTC

Did I mention that the data broker industry must be destroyed?
https://theintercept.com/2025/05/22/intel-agencies-buying-data-portal-privacy/

2025-05-18 16:21:31 UTC

I never realize how much cognitive load is taken up by smiling and making the right amount of eye contact until I land in Eastern Europe where my immaculate Resting Bitch Face is perfectly normal.

2025-05-14 04:07:50 UTC

Q&A from a talk I gave last week.
Q: "What do you think is the biggest threat in cybersecurity right now? Is it post-quantum computing? Is it AI?"
A: Fascism. It's fascism.

2025-04-30 19:14:29 UTC

The only way I can possibly touch enough grass to get through this day is to remove all of my clothes and roll around on a lawn.

2025-04-25 18:57:47 UTC

There is so much bad news out there right now that it is sometimes difficult to even see the wins.
https://www.nytimes.com/2025/04/25/us/politics/trump-student-visa-cancellations.html?unlocked_article_code=1.CU8.qevX.RyotrTomoS1e&smid=url-share

2025-04-24 18:48:01 UTC

For people who are looking to shield their identities in group chats: Signal does not store past handle IDs and 7 days after changing your handle, another Signal user can claim it.

2025-04-24 18:08:19 UTC

This is your regular reminder that end-to-end encrypted communications will not protect you against members of your group chat sending screenshots to NBC News: https://www.nbcnews.com/news/us-news/columbia-university-students-plan-build-tent-encampments-week-sources-rcna202549

2025-04-10 21:47:52 UTC

Big Law has failed to stand up to Trump and now infosec is following suit.
https://www.reuters.com/world/us/cybersecurity-industry-falls-silent-trump-turns-ire-sentinelone-2025-04-10/

2025-04-08 19:56:10 UTC

I can no longer tell if I'm holding up surprisingly well right now because I did all of my grieving for the future back in 2024 or if I have just reached a state of emergency dissociation so extreme that I will not be feeling my feelings until 2026.

2025-03-31 05:56:54 UTC

Today I replied to a journalist's request for a quote about US government officials doing something exceptionally insecure and stupid with: I'm going to need a minute to come up with something more printable than "fuck no."

2025-03-27 18:54:51 UTC

Weird how the jobs that AI-boosters say AI is going to replace never seems to include the management or executive class.

2025-03-25 19:30:03 UTC

I checked in on the Bad Place and discovered that a bunch of misogynists have spent a couple of weeks getting very worked up about a screenshot of a post I made about a decade ago and that locking my account last year has successfully deprived them of further ammo. Everything is cool and normal.

2025-03-25 00:00:54 UTC

Oh Mastodon, never change. There are people securitysplaining sensitive government communications to @nprofile…36ju, as foretold by prophecy.

2025-03-24 18:29:38 UTC

Today's OPSEC lesson is this: all of the encryption in the world is not going to save you if you add the editor of The Atlantic to your war-planning Signal group chat.
https://www.theatlantic.com/politics/archive/2025/03/trump-administration-accidentally-texted-me-its-war-plans/682151/?gift=fXb4ymsFcV2ntAzqIpmYvaCSBCGxAw0GA0n-mECa1x8&utm_source=copy-link&utm_medium=social&utm_campaign=share

2025-03-24 18:27:02 UTC

For people who are concerned about crossing the US border, The Verge and Wired both have useful discussion and advice:
https://www.theverge.com/policy/634264/customs-border-protection-search-phone-airport-rights
https://www.wired.com/2017/02/guide-getting-past-customs-digital-privacy-intact/

2025-03-24 02:32:45 UTC

I laughed when my handstands coach did an hour-long class just on foot/ankle strength and flexibility, but now it turns out that I need all of those drills.

2025-03-20 19:52:23 UTC

You can learn a lot of useful OPSEC lessons by examining the ways in which people get caught, so I'm just going to leave this right here.
https://www.404media.co/how-three-alleged-tesla-vandals-got-caught/

2025-03-19 19:46:33 UTC

If you're critical of the US government and you are planning to cross the US border any time soon, today is a good day to review EFF's border search pocket guide: https://www.eff.org/document/eff-border-search-pocket-guide

2025-03-17 19:09:42 UTC

I rarely tell people to throw their devices into the sea, but you should throw your Amazon Echo into the sea.
https://www.wired.com/story/everything-you-say-to-your-echo-will-be-sent-to-amazon-starting-march-28/

2025-03-17 17:53:46 UTC

It's Monday, which is a good day to remember that the data broker industry must be destroyed: https://gizmodo.com/data-broker-brags-about-having-highly-detailed-personal-information-on-nearly-all-internet-users-2000575762

2025-03-03 06:25:39 UTC

- reply

I cannot overemphasize how much of playing defense in US corporations, civil society, and government has been about trying to keep the Russians out of your shit.

2025-03-03 06:13:54 UTC

Listen, I'm not going to pretend that I'm even remotely surprised, but I will tell you that this is a slap in the face to every person in the infosec community that has worked to track and thwart Russian APTs for the last several decades.
https://www.theguardian.com/us-news/2025/feb/28/trump-russia-hacking-cyber-security

2025-03-02 20:02:08 UTC

Aerial coach: Do you remember this sequence from two weeks ago?
Me: Listen, a lot has happened in the last two weeks...

2025-02-24 20:53:17 UTC

I cannot overstate the value of being in community with other activists right now. It is what gives me the strength to get up in the morning and fight fascism.

2025-02-24 07:37:59 UTC

Let it be known that on this day in history, I made it to the end of Duolingo French. There are no worlds left to conquer.

2025-02-22 18:44:44 UTC

In response to the UK's demands for a backdoor, Apple has stopped offering users in the UK Advanced Data Protection, which provides end-to-end encryption for backups and files. https://www.eff.org/deeplinks/2025/02/cornered-uks-demand-encryption-backdoor-apple-turns-its-strongest-security-setting

2025-02-20 20:25:22 UTC

Stalkerware data leaks are one of the few ways in which we can get insight into the scope of stalkerware as a problem. 2.65 million unique email addresses were registered with Cocospy and Spyic. That's a lot of stalking.

2025-02-20 20:21:36 UTC

A bug in two closely-related stalkerware apps, Cocospy and Spyic, is exposing the personal data of millions of people who have the software unwittingly installed on their phones: https://techcrunch.com/2025/02/20/stalkerware-apps-cocospy-spyic-exposing-phone-data-of-millions-of-people/

2025-02-20 19:12:07 UTC

Wired with another story about why the data broker industry must be destroyed: https://www.wired.com/story/google-dv360-banned-audience-segments-national-security/

2025-02-19 19:51:31 UTC

If you use Signal and your threat model includes Russian state actors, make sure your version of Signal is up to date in order to harden your account against these attacks: https://cloud.google.com/blog/topics/threat-intelligence/russia-targeting-signal-messenger/

2025-02-19 18:55:24 UTC

Today I encountered my first AI-generated news article that included a manufactured quote from me on a topic I did not speak or post about, just in case you're wondering how AI is going.

2025-02-16 02:43:11 UTC

- reply

@nprofile…q5wq We're all mad and all of us are really angry too.

2025-02-16 02:39:36 UTC

If the US blocks access to HRT, ADHD drugs, and SSRIs, I cannot begin to describe to you how much all of the tech sector will screech to a halt. The internet is built and maintained by trans people, people with chronic depression, and the neurodivergent.
https://www.motherjones.com/politics/2025/02/kennedy-rfk-antidepressants-ssri-school-shootings/

2025-02-14 21:09:41 UTC

For most of my adult life, Valentine's Day has been the day that I sit down to do my taxes. I have never regretted this choice.

2025-02-13 19:33:25 UTC

I wish that journalists would stop uncritically buying into Musk's framing of what DOGE is doing as an audit. You can tell it is not an audit because it is being done by people with zero experience in auditing and the methodology is "poke around in files, looking for keywords without any context."

2025-02-11 23:57:47 UTC

My co-workers are badass and I am proud of them.
EFF is suing DOGE and OPM over their illegal sharing of federal employee data.
https://www.eff.org/deeplinks/2025/02/eff-sues-doge-and-office-personnel-management-halt-ransacking-federal-data

2025-02-07 20:00:50 UTC

Musk’s DOGE lackey Edward Coristine was fired by the cybersecurity firm for leaking company secrets and now he has access to sensitive government information because that's just where we are now.
The people carrying out Musk's order deserve public scrutiny and I'm glad to see journalists who are taking this seriously.
https://www.bloomberg.com/news/articles/2025-02-07/musk-s-doge-teen-was-fired-by-cybersecurity-firm-for-leaking-company-secrets?accessToken=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzb3VyY2UiOiJTdWJzY3JpYmVyR2lmdGVkQXJ0aWNsZSIsImlhdCI6MTczODk1NzQyNCwiZXhwIjoxNzM5NTYyMjI0LCJhcnRpY2xlSWQiOiJTUkJXMTlUMVVNMFcwMCIsImJjb25uZWN0SWQiOiIyQjE3NzFFOTlEODc0QzRDOTY1Njg1RTZBQkJGM0QwRCJ9.vxGv4ncXEbIrUGmUYpTUdxLmCVDwzmEWp-VRWV9otME&leadSource=uverify%20wall

2025-01-15 22:39:08 UTC

I spent most of a decade traveling to authoritarian countries and teaching people how to circumvent internet censorship. I am appalled that this is now something I have to do in the US.

2025-01-15 19:01:36 UTC

For people who are wondering what the TikTok ban is going to look like for US TikTok users if it goes into effect on Sunday, TikTok will be blocking US users, linking to info about the ban, and giving them the option of exporting their data. https://www.theverge.com/2025/1/15/24344299/tiktok-shutdown-us-ban-supreme-court

2025-01-12 20:09:41 UTC

Lots of folks in my mentions going "Haha, the US will just ban VPNs," possibly because they are not experts in internet censorship and they have not been watching this exact same dynamic play out in dozens of countries over the last 20 years.

2025-01-12 19:48:55 UTC

After all of the infosec chatter about how you probably don't need a VPN, age verification has made PornHub block access in most Southern states and TikTok's about to block US IPs. We are entering a new age of internet censorship and you might need a non-shady VPN.