Topics · privacy

153 Million Driver's Licenses Are for Sale, and This Is Why Centralized ID Verification Worries Me

Brian Krebs reports the FBI is investigating Nexus, a dark-web service selling scans of more than 153 million U.S. and Canadian driver's licenses—and centralized ID verification looks like a honeypot.

Inspired by krebsonsecurity.com · Brian Krebs

California Is Carving Linux Out of Its Age-Gating Law

California lawmakers unanimously passed an amendment exempting most open-source operating systems from the Digital Age Assurance Act—a needed correction to a law written for platforms, not forks.

Inspired by tomshardware.com · Tom's Hardware

Plugging In a Display Should Not Install Adware on My Computer

LG monitors can trigger Windows to install manufacturer software that later advertised McAfee—exposing a trust boundary between hardware identity and automatic app distribution.

Inspired by s-config.com · S-Config

Walmart Is Finally Adding Apple Pay After More Than a Decade of Holding Out

Walmart is adding tap-to-pay in U.S. stores after CurrentC, Walmart Pay, and years of refusing NFC—Apple Pay and Google Pay included, without killing QR checkout.

Inspired by corporate.walmart.com · Walmart

The GrapheneOS Duress Password Case Is Becoming a Test of Whether Privacy Can Be Treated as Obstruction

The New York Times and Slashdot on Samuel Tunick—GrapheneOS duress at CBP Atlanta, a § 2232(a) felony, and whether using a privacy tool during a disputed search can itself become the crime.

Inspired by m.slashdot.org · Slashdot

The Real homeOS Risk Is Not Homebridge. It Is What Apple Does With HAP.

homeOS does not look like a Homebridge kill-switch so much as another HomeKit consumer. The real risk is what Apple does with HAP as Matter takes over—and Homebridge 2.0's dual transport is the insurance policy.

homeOS Looks Like Apple Is Finally Treating the Home as a Platform

AppleInsider's homeOS overview reads less like a wall iPad and more like a room-scale operating system: proximity UI, face-aware profiles, and a growing home-hardware family—with Siri readiness as the delay.

Inspired by AppleInsider

AliExpress Was Silently Fingerprinting a Browser Through Its Audio System

Laserphile found that opening AliExpress could keep multipoint Bluetooth headphones from switching devices—because hidden Web Audio contexts were fingerprinting the browser while leaving the audio path occupied.

Inspired by blog.laserphile.com · Laserphile

GrapheneOS Is Finally Getting Hardware Designed for GrapheneOS

Motorola is changing future flagships so GrapheneOS can officially support them—memory tagging, verified boot, and Snapdragon work with Qualcomm instead of remaining Pixel-only.

Inspired by grapheneos.social · GrapheneOS

Camera-Equipped AirPods Could Turn Siri Into a Wearable AI

A leaked Apple demo of camera-equipped AirPods using Visual Intelligence raises two products at once: inconspicuous computer-vision sensors, and a potentially powerful assistive wearable—if the privacy model is designed before the hardware ships.

Inspired by macrumors.com · MacRumors

Reticulum Treats the Network Underneath It as Replaceable

Reticulum is a transport-agnostic networking stack for communications that should keep working when the Internet does not—compelling because the transport is replaceable, while metadata, radio physics, and a missing independent spec still matter.

Inspired by reticulum.network

Homomorphic Encryption Is Getting Practical Enough for AI

Google’s HEIR compiler aims to make encrypted AI inference a practical option—running recommendation, fraud, intrusion, and hotword models on ciphertext so the server never needs the plaintext.

Inspired by blog.google · Google

Flock Discovered Privacy After the Backlash Became Expensive

Flock Safety’s new privacy guardrails—seven-day default retention, mandatory Audit Assistance, case codes, and auto lockouts—arrive after years of abuse cases, contract suspensions, and ACLU skepticism that this is PR, not reform.

Inspired by flocksafety.com · Flock Safety

A Fake Airline Hotspot Picked the Worst Possible Flight

Ars Technica reports a rogue Wi-Fi hotspot impersonating Delta’s onboard network on a flight home from DEF CON—an evil-twin attack that looks especially foolish among security researchers primed to notice exactly this trick.

Inspired by arstechnica.com · Ars Technica

A Security Breach Is Bad. Ignoring the Person Who Reports It Is Worse.

BobDaHacker reports a simple tl;dv authorization failure exposing meeting metadata for tens of thousands of users, then months without a meaningful vendor response—security culture is what happens after the report lands.

Inspired by bobdahacker.com · BobDaHacker

Littleton Says Flock Reactivated Cameras the Town Had Shut Down

Littleton, Massachusetts says Flock Safety reactivated license plate cameras the town had deactivated for privacy review—without notice—raising whether municipalities actually control the surveillance systems they pay for.

Inspired by lowellsun.com · The Lowell Sun

Six More Employees Fired for Abusing Flock Camera Data

Savannah fired four officers and two civilians for personal Flock Safety searches—127 inappropriate queries among ~39,000 this year—showing audit logs catch abuse after the fact, not as access control for nationwide plate data.

Inspired by wtoc.com · WTOC

Malware Can Turn Synced Passkeys into Persistent Access

Unit 42’s three local malware attacks on Google Password Manager synced passkeys in Chrome on Windows with a TPM—showing stolen sessions are not the only risk when onboarding, UV flags, and a non-rotatable master secret leak.

Inspired by unit42.paloaltonetworks.com · Unit 42

WebKit Can Leak the IP Address Private Relay Is Supposed to Hide

Privacy researchers found three WebKit paths—DNS prefetch, WebAuthn related origins, and WebTransport—that can bypass browser proxy settings and iCloud Private Relay, revealing real IPs even when ordinary page loads are relayed.

Inspired by mysk.blog · Talal Haj Bakry and Tommy Mysk

The Website Is Often the More Private Version

Why the website is often the more private version of a service than a native app—browser sandbox boundaries limit device access in ways store apps do not, while still leaving room for tracking if third-party scripts load on the open web.

Inspired by nooneshappy.com · No One's Happy