The Ledger Wallet Hack is Not Just a Crypto Problem

What physically compromised crypto wallets

mean for everyone,

the French fridge hacks making headlines,

and the first confirmed case of zero-click

spyware spread through ads.

All this and more coming up on This

Week in Privacy, so stay tuned.

Welcome back to This Week in Privacy,

our weekly series where we discuss the

latest updates with what we're working on

in the Privacy Guides community and this

week's top stories in data privacy and

cybersecurity while answering viewer

questions.

I am Nate and with me this week

is Jordan.

How was your week, Jordan?

Great.

Just really good finishing up a big video

that should be out soon.

But yeah,

really excited to dive into some of the

top stories this week.

Alrighty.

Yeah.

I'm definitely excited for that video,

but we'll talk about that a little bit

later in the site updates.

And first we will dive into our first

story,

which is about the ledger hack that, uh,

many of you have probably heard of kind

of made the rounds, pretty crazy story.

The headline says ledger confirms spy chip

implant behind crypto wallet thefts.

So, uh,

for anyone who doesn't know ledgers are

physical devices for your cryptocurrency

wallets.

Um,

There's a lot of different ways to store

cryptocurrency.

Most people, unfortunately,

kind of use an exchange like crypto.com or

Coinbase or whatever.

Does crypto.com still exist or did they go

bankrupt yet?

Anyways, so most people use that,

but that's not really cool because then if

the exchange gets hacked,

all your money goes away.

The other alternatives are non-custodial

software wallets.

So things like CakeWallet is really

popular in our community for Monero and

Bitcoin.

But then there's also these little

hardware tokens that are kind of like USB

sticks that store your private keys.

And they're supposed to be like super,

super secure.

Nothing in the world is unhackable,

but these are supposed to be some of

the most unhackable devices,

especially when it comes to storing your

crypto.

And Ledger is one such manufacturer.

So Ledger has confirmed that some of its

devices distributed through a Southeast

Asian reseller called CryptoBillis were

compromised with a hardware implant that

drained users' crypto wallets.

Let's see.

They say here that researchers have shown

the implant in the Ledger X since at

least September, September,

saying tampered devices were available for

nearly half the price of the original

hardware.

Um, I should clarify.

I said, since at least September,

I don't know if it's, uh,

at least it just says since September,

so I don't know if they've guaranteed it's

not before that or anything like that.

Um,

So I'm gonna move down here a little

bit.

For those of you watching visually,

you can see a photo here.

This comes from, what's his name?

Mark Karpeles,

who used to be the CEO of Mt.

Gox,

which was one of the earliest crypto

exchanges, I think,

or a very early one for sure.

They said the implant was concealed behind

the screen,

but its antenna cable would have been an

indicator that something was wrong.

The malicious hardware captured the

device's display output and button presses

to identify the seed phrase and then

transmitted it to the attacker over an LTE

connection using an eSIM.

which is pretty wild.

And they say that it was like modified,

like the battery was a little bit smaller,

but the battery powered both the screen

and the SIM card.

We'll come back to that in a minute.

So to Bain Labs here,

they said that they obtained two variants.

One was in a leisure device bought from

Amazon in Japan and from China-based

seller shipped from Malaysia and the other

was purchased on Yahoo Auctions in Japan.

Let's see here.

And then...

Yeah, I mean, basically they both,

they say in both cases,

the telltale was the antenna wire.

The tell, yeah,

the tell was the antenna wire,

which ran along the top edge in the

case of the second implant.

In the first implant,

the antenna is taped across the top of

the battery and the shielded LTE module.

So we'll touch on this in a minute,

but from what I can tell,

it sounds like

It sounds like the only way to know

is if you actually cracked it open.

It doesn't sound like there was any visual

indicator without opening it.

Even then, I got to be honest,

like me,

I wouldn't know what I'm looking at.

Like, obviously, that's a circuit board.

There's some chips.

There's some cables.

There's a little soldering point.

But like,

that looks like a clean solder to me.

All this looks clean to me.

Like, I don't even know, actually.

This is supposed to be, again,

for visual watchers.

It says the hardware implant inside the

Ledger X device.

Which one's the hardware implant?

I honestly don't know.

But anyways,

we'll talk about that more in a minute.

Yeah,

so Ledger is advising users to avoid

purchasing from unauthorized resellers as

they run an increased risk of getting

counterfeit or modified devices.

The company is also reminding its

authorized resellers and distributors to

get the products only through authorized

channels and to avoid restocking returned

products.

And then Ledger provides a genuine check

mechanism to determine the authenticity of

the device.

However,

it explicitly warns that it cannot detect

added implants when the device's original

secure element remains intact.

uh which it seems like they would have

been it doesn't say they tampered with any

software stuff they just said that um you

know this is like a hard it basically

took screenshots of your screen so it

could see the seed phrase and then sent

it back i mean that's an

oversimplification but that's basically

what it did at this time there's no

indication that any other ledger resellers

are shipping compromised wallets however

the community's trust has been compromised

with many now calling for the reseller

network to be dismantled so yeah um

Pretty crazy stuff.

Let me check my notes here and make

sure I didn't.

Oh, yes.

In our Q&A thread on the forum,

some people actually shared a link saying

that Trezor also appears to be

compromised.

That comes from,

let me throw it up here real quick.

Share this tab.

So yeah,

this comes from an outlet called Zeroday,

zeterzeroday.com.

So yeah,

apparently Trezor has also been

compromised, according to this person.

Super unfortunate.

Yeah,

I'm going to double check my notes here

to make sure I didn't miss anything.

But while I'm checking that, Jordan,

do you...

I mentioned that hardware wallets are

supposed to be kind of unhackable,

but there's also software wallets.

Do you think that people even need

hardware wallets?

Or is this kind of like an overrated

thing, in your opinion?

I mean,

it definitely offers an additional layer

of security.

And, you know, I think...

The small cost of something like this

where, you know,

you have something that is actually air

gapped separately from all your devices

where the crypto is stored is definitely a

benefit, I think.

Especially, you know,

if you've got ten thousand dollars worth

of Bitcoin or something and you just have

to spend, you know,

three hundred bucks on one of these

hardware wallets,

it makes it definitely makes a lot more

sense to do it that way.

But I do think, you know.

it is one of those things where if

you're not regularly using crypto or you

don't have a large amount,

then that's where I think you can

definitely use software based wallets.

And I think probably the most interesting

development in this field that I've seen

is I believe it's Cake Wallet.

They've made this app called Cupcake,

and you can just install it on an

old phone and disconnect it from the

Internet and everything.

And it basically turns your phone into a

hardware wallet.

So like you could, you know,

if you want to have kind of like

a middle ground between having to use a

hardware wallet and like a software

wallet, you can maybe check that out.

But I think...

uh it's kind of unfortunate that this

happened uh i think you always take a

risk when you're selling when you're

buying something from a reseller right

like every time you increase another

introduce another party into any equation

this like this matters in security this

matters in privacy obviously um as soon as

you enter another person into the into the

mix then i think that's when you start

um increasing the risk that this sort of

thing could happen um

But yeah, I mean, that's kind of it.

Like it really sucks for the people that

were compromised by this.

It's not something that's super easy to

get around,

especially if you can't buy these devices

in the region that you live in and

you have to rely on resellers to purchase

them.

So I think it's just a really unfortunate

situation for the people that were

compromised.

And it doesn't seem like a huge amount

that you can really do.

Like you said,

it's not super obvious unless you know a

lot about it,

like computer electronics and stuff.

Yeah.

And I'm not, um,

unfortunately I've never been to Southeast

Asia would totally love to visit one day.

But, um,

from what I understand this crypto bill is

placed to me,

it sounds like they're a very well-known

reseller.

Um,

like the things that come to mind for

me are like new egg here in the

U S I'm, I'm sure there's others nowadays,

but it's not like, you know, oh,

I bought some,

something from the sketchy third party

eBay reseller.

It's like, no, it's like,

if I bought something off new egg

personally,

I would trust that it's legit because I've

been using them for years and they're,

they're a well-known company.

So, um,

And I actually, when I read this story,

I was kind of like, oh man,

that's so evil that.

Is to me,

it's the kind of price that like,

it's too good to pass up,

but it's not too good to be true.

Like it's a hell of a discount.

Don't get me wrong,

but it's not just like, you know, oh,

it's off.

And it's like, okay,

something's obviously off here.

But at the same time, it's like, ooh,

you know, yeah,

I could go officially through,

who was it here?

Ledger.

I could go through Ledger here officially,

or I could go through, you know,

this place where it's half off.

Like, I don't know, man, that's, it sucks.

I guess what I'm getting at is like,

there's no huge red flags to me.

Maybe I'm wrong.

Maybe somebody will be like, no,

this crypto bill,

this place is super shady and everyone

knows to stay away from them.

But yeah,

it seems to me like it was just

a,

Trying to be thrifty and bad luck,

unfortunately.

Yeah,

I guess there's not really a lot of

defenses against this.

Like we said,

as far as we can tell,

you couldn't tell unless you were opening

it up and looking at it and knew

what you were looking at.

One thing I should mention is the

investigation is ongoing,

so they don't know who this was.

They don't know who the attacker was.

They don't know if this was a rogue

employee or, like the article mentioned,

maybe somebody was buying them and

modifying them and returning them.

So, yeah,

but I guess the only the only other

thing I could think of that I would

advise people is just don't flash your

crypto around.

I mean,

that it's a lot of people when it

comes to cash.

I know I haven't heard this in a

while,

but I know for a while there were

a lot of people who were like, oh,

I don't want to carry cash around because,

you know, what if I get mugged?

And it's like, well,

criminals aren't psychic.

They don't know that you've got one

hundred dollars in your pocket.

Unless you do like Futurama fans will know

the reference here.

Unless you're like Bender going to the

club and flashing all your money around,

then you might draw some attention.

So, you know, if you do have,

like you said,

you have like ten thousand dollars in

crypto.

Yeah.

Maybe don't post about that on Twitter all

the time.

Maybe don't be like, oh, crypto's up.

I made seven hundred dollars today.

Like, just keep that to yourself.

You know, tell tell your partner,

tell your wife,

don't tell the whole world.

So, yeah,

that's that's probably the best I can

offer.

But yeah.

Um,

I think I'll throw that one to the

audience.

Like what,

what do you guys do to secure your,

your crypto?

Like odd bite here said I use cake,

which cake is great.

Um, and then, uh, yeah,

somebody said you could just don't use

crypto.

I mean, yeah,

if you don't see a need for it,

if you've got access to cash and other

tools, that's also fine.

Not saying you have to, but, um, yeah.

I'll let you guys answer that one.

And I think we'll turn it over to

Jordan,

because I don't think there's been any

questions yet.

I'm checking all the different chats here.

And so far, no questions.

So I think I'll turn it over to

you for our first forum post.

Yeah, definitely.

We did get a little comment here from

SJJKGSNKJ.

Very interesting name.

Thank you.

First time catching you live.

Yeah.

Good to see you here.

And hello to everyone else who's joining

for the first time.

But yes,

let's dive into this first forum

discussion.

And if you weren't aware...

I guess now you are.

Join our community on Fluxer.

So we now have a Fluxer community.

So I guess just quoting some of the

posts that Jonah made,

I want to invite you to test the

Privacy Guides community on Fluxer.

I think our Matrix chats are extremely

underutilized because there are a million

reasons people just don't want to deal

with Matrix.

But I think Fluxer solves those problems

for most people.

It's pretty cool.

So please join and give us feedback about

whether we should stick with Fluxer in the

long term.

And I guess some key points here,

is our community self-hosted?

No,

it can be self-hosted and migrating to a

self-hosted community should be possible

later in twenty twenty seven.

And Joan also said,

I think self-hosting it will be the end

goal.

And I guess to answer some more questions

about this, will it replace Matrix?

Maybe.

Will it replace discourse?

No.

So there was quite a lot of discussion

on this.

This was posted three days ago and it

already has eighty replies.

So quite a lot of discussion happening

there.

A lot of users were disappointed by me.

lack of end-to-end encrypted direct

messages and some people are just not

really a fan of text chat communities

which I can understand and that's why we

have two that's why we have discourse

that's why we have a forum that's why

we have multiple places for people um

I think the main thing is to have

a community that everyone wants to,

you know, what they prefer, basically.

So if you prefer more of a text-based

community for asking questions,

you can do that on Fluxer.

You can do that on Matrix.

And on Discourse,

you can also ask questions in a more

structured format with a forum.

So it's all very interesting.

We've been testing this out for a little

bit.

And we've currently got, it looks like...

about three hundred members on the Fluxer

community.

So it's been quite interesting to see that

a lot of people have been joining that.

I guess throwing it to you, Nate,

do you have any thoughts on this one?

Like,

was there any comments that you saw from

the thread that were interesting?

How do you feel?

I didn't go through the whole thing

because like you said,

that's eighty posts.

And yeah, I think it's

I think it's very, I mean,

as far as like texts,

like real-time chats versus forums, to me,

it's a mixture of personal preference and

use case.

You know, some people, like you said,

or like people said in the comments,

some people don't want a real-time chat

because they're just too chaotic.

They move too fast.

It's not a good place to get information.

And that's fine.

Like,

that's why we're not getting rid of the

forum.

The forum is sticking around.

It's not going anywhere.

Jonah said that.

Yeah.

And nobody's saying you have to join

Fluxer.

It's just like, hey,

this is something we're exploring.

As far as like Matrix versus Fluxer,

my personal opinion on Matrix is I've been

extremely disappointed with the moderation

tools.

I used to have my own Matrix community.

The moderation tools did not exist.

And I had to resort to third-party tools,

which my community was getting attacked so

specifically that I was actually in talks

with the Dropnear people and they were

like custom building stuff for me.

It was so bad.

And eventually I still just threw up my

hands and I was like,

this isn't worth it to me.

I quit.

So what I'm interested in with Fluxer more

than anything is like,

how is the moderation?

Because in my opinion,

that's like the big thing that I think

is going to keep things from mainstream

adoption.

Like I got my brother on Matrix for

a little while and he left because he

got tired of all the CSAM that people

would come in and troll and spam rooms

and stuff.

And if a room falls into disrepair,

there's nothing you can do about it,

which I guess once Fluxer gets federated,

that'll still probably be an issue.

But yeah, it's, I guess my point is,

is like, I'm not opposed to,

I like the idea of Matrix,

but me personally,

I feel like Matrix just has so many

gaps and it's had them since I got

into privacy.

It's been this way for like ten years.

And I'm interested to see if Fluxer can

fill any of those gaps.

But at the end of the day,

I think it's going to be about the

community.

Like we've even noted like, oh, wow,

Fluxer is really chatty right now.

But, you know, it's the honeymoon phase.

Will it still be this chatty in a

week, two weeks, a month?

Like we don't know.

So it's just something we're exploring.

We're testing out.

And yeah.

think yeah i don't know i mean like

leave your opinions again i think um it's

going to add end to end encryption that

is on the road map federation is on

the road map all this kind of stuff

is on the road map so if that's

your issue i think we've only got to

wait a few months to see if they

deliver on those promises but if you have

other issues then or other concerns i mean

yeah i don't know i've been enjoying it

it's it's been nice to chat a little

bit especially now that i work from home

and i

don't get out of the house as much.

But yeah.

So yeah, level five here says,

as a Discord refugee,

I've been really liking Fluxer.

Yeah,

it looks exactly like Discord without all

the orbs and the quests and the ads

and stuff like that.

So yeah, definitely agree.

I definitely think that it is

controversial, I would say.

There's definitely a lot of people with

some critical opinions of it.

You know,

there's a lot of people saying that

there's possibly some AI being used to

develop the software.

There's people, you know,

saying that you should use something else.

There's always people suggesting that sort

of stuff,

but it really comes down to which piece

of software is working the best and has

the best features and has what we need.

And currently,

people are suggesting Stoat and other

things,

but the feature set just isn't quite

there, which is really unfortunate.

But Fluxer seems to have progressed quite

quickly.

We've definitely seen some...

some interesting discussions in the forum

thread um but do let us know what

you think like that's the whole purpose of

this it's it's a beta it's a test

run it's to see whether this is something

that we uh end up keeping in the

long term and whether we actually move

things towards that direction or not I

think it's I like discord I know that's

a hot take but uh that's where all

the communities are and it works really

well it's it's a convenient app everything

is like

nice.

It works well.

There's ads, I guess, but like,

I still think that Discord is still like

the best at what it does,

but I do think, you know,

Fluxer is looking like it could come

close.

Um,

it definitely mirrors a lot of the

features that Discord has and it has a

lot of other benefits that Discord doesn't

have, right?

Because Discord is, um,

as far as I know, it's, uh,

I just got a signal message from our

supporters chat from Oddbytes.

They said,

did you just call Discord convenient?

I mean, yes,

it is convenient because that's where all

the communities are and that's where

everyone is.

So...

It's convenient to talk to people, yeah.

Because, you know,

getting people on other apps,

they're not going to respond as quickly.

They're not in communities there.

So, yeah, it is convenient for me.

I'm not sure if maybe it's not for

you, but it is for me.

I would be sad to see the Fluxer

community go...

um and then they said they got to

go all right thanks so much for tuning

in but uh yeah no i think it's

interesting and it's definitely something

we're keeping an eye on but if you

haven't joined it already definitely check

it out there's a forum post uh that'll

be linked in the newsletter if you

subscribe to that or you can go to

privacyguides.org live streams and check

that out there but yeah i guess uh

i guess i don't really have too much

more to add unless you had something named

I'll just real quick,

you were saying towards the beginning that

some people would prefer this,

some people would prefer that.

That is one of the drawbacks of having

such a large community is unfortunately

we're never going to please everybody.

So like you said,

we kind of got to figure out what

works best for most people.

And that's fine.

I'm not...

trying to say that like oh you have

to like flux or you have to like

matrix you have to like discourse like

that's not what we're trying to say it's

just you need to understand that like

whatever we decide it's going to be

because this is what's working best for

the most number of people so yeah um

advice says is it convenient to click

forty fifty times to get past all the

ads how many ads are you looking at

man why aren't you using an ad blocker

I've never seen that many ads in Discord.

Or using a modified client.

I would just say use a modified client

or use uBlock Origin in the browser.

It'll fix it.

Oh, maybe that's it.

I always use uBlock or a browser that

has ad blocking at least.

Real quick before we move on,

Jason Archer said,

only today I discovered I can watch this

stream not from YouTube.

Yeah, if you guys didn't know, we're on,

let's see here, we're on YouTube,

we're on the main channel and the Clips

channel, we're on Twitch,

we're on Twitter, we're on StreamYard,

and I think we might also be streaming

somewhere else too.

But that's all in the forum post.

We have a pinned post each week asking

for questions,

and it links to all of our different...

streaming locations there.

So on that note,

we'll go ahead and move into our next

story, which comes from France.

It actually comes from a lot of places

in Europe, but primarily from France.

And it says fridge hat costing millions

and sparking fires stemmed from poor

security.

And I am Jack's complete lack of surprise.

So earlier this week,

a mass hack of refrigeration systems at an

estimated seven hundred supermarkets

throughout France caused them to suddenly

malfunction,

causing spoilage of untold tons of

perishables and in some cases even fires.

More specifically,

Internet connected controllers that allow

technicians to remotely administer the

store wide systems were compromised.

Let me scroll down here.

Um,

the unknown attackers responsible then

activated defrosters long enough for the

fridges to reach temperatures as high as

fifty degrees Celsius or a hundred and

twenty-two Fahrenheit,

which is pretty toasty.

By the time the mass compromise was

discovered, food was spoiled,

and in some cases the electrical systems

caught fire.

So...

um multiple security advisories and public

research reports show that all three of

controller models reportedly hacked in the

incident contained critical

vulnerabilities that allowed attackers to

remotely log into the devices you with the

same rights as administrators until

recently for instance uh the danfoss

controllers used a credential that changes

each day and the password is generated by

the publicly available firmware based on

the date any uh any attacker who takes

the time to analyze the code can do

the same thing on any device that hasn't

received a recent update

Daily passwords are identical across

models located in hundreds or thousands of

stores.

They do say that a raft of critical

vulnerabilities fixed in the past few

months in these controllers also gives

similar remote access.

So there was a patch that was not

applied.

They say besides running controllers with

outdated firmware,

the affected stores likely also failed to

put devices behind a VPN and create a

restricted list of IP addresses allowed to

log in.

These protections are standard but often

not followed.

And in this case,

the failure enabled a mass hack that

likely cost tens or hundreds of millions

of euros.

Spain, Portugal, Poland, Germany,

and Belgium were also reportedly affected.

So let's see here.

Trying to make sure I just cut out

the –

relevant parts here.

So yeah, further down, it says so far,

the party behind the attack has remained

silent.

That raises the possibility that the

motive was vandalism on a mass scale.

Another possibility is a nation state or

another international actor aiming to

create continent wide disruption.

And I actually didn't put this in the

notes, but I love this final paragraph.

The incident underscores the tension

between the financial and security

departments in most businesses.

Some companies are loathe to spend large

sums of money on new equipment when there

are no tangible benefits or savings.

Only after a

executives that affected supermarket

chains will likely learn the hard lessons.

Less clear is whether the cautionary tale

will sway other businesses.

And yeah,

I do not come from an IT background.

I come from an audio video background,

but definitely same there is, you know,

a lot of the time they're like, oh,

the salespeople are the ones that bring in

money.

Of course, we're going to, you know,

give them anything they ask for.

But, you know,

you're asking for better cameras,

better TVs, whatever.

Like, you're just costing us money.

And it's like, yeah,

but that's what allows the salespeople to

have effective zoom meetings.

So I digress.

But yeah,

I think I don't I don't know if

we have too much to say on this

one.

But it is just kind of a reminder

that cybersecurity matters at all levels.

We are increasingly in a digital world.

yeah,

if you're in a position where you can

convince your company, uh,

try to get them to care.

But, uh, yeah.

Do you have any other takeaways, Jordan?

I don't, I don't really,

I think you covered that really well,

actually.

I don't really have too much to add.

I think I would just say, yeah,

I think you're right though.

These companies need to probably,

you know, plan for the worst.

It seems like a lot of these companies

were not ready for this, uh,

in the slightest, uh,

which is why you did mention,

I think there was millions of dollars of,

uh,

perishables being spoiled and stuff you

know that's obviously that's really bad

it's all food that can be eaten it's

a waste it also sucks for the company

because now they've got a whole bunch of

stock that needs to be moved into the

garbage so yeah this is just really

unfortunate stuff and I think this also it

becomes more of an issue the more critical

this becomes right if we're talking about

like

fridges in this case it's not that bad

right the food just goes off what if

we're talking about you know people's like

medical devices all sorts of really scary

stuff can happen so you know all this

stuff is kind of important um to make

sure that there's actual cyber security

practices being followed um especially now

because things are just like much more

complicated than they used to be and

things are internet connected so uh

you need to follow suit, right?

When things become more complex and are

connected to the wider internet,

there needs to be more thought and care

put into this sort of thing.

But yeah,

I don't really have too much to add

apart from that.

Yeah, no,

that reminds me of what you were just

saying,

reminds me about someday it could be

medical devices.

Darknet Diaries has a really good episode,

and he's got a ton of episodes, obviously,

but he's got one where the guys were

doing a digital pen test in a hospital,

and they were basically given free reign

to go hack whatever you can.

And they obviously knew it's like a

hospital, like, okay,

let's not cause any trouble.

But one of the things they hacked into,

you know,

they would write down like the IP address,

like whatever information they could,

they would write it down and be like,

all right, made a note,

we got into this,

let's move on to the next thing.

And so when they were doing the report

about here's all the things we were able

to get into,

one of the devices they hacked into was,

you know, whatever it was,

they like read it off and the hospital,

it was like a zoom call with the

hospital and the hospital was like,

wait a minute, what was that one?

Say that one again.

And they like read it off again.

And they're like, what time was that?

And they like looked at their log and

read off the timestamp.

They were like,

we're going to call you back and just

like hung up abruptly.

And they later found out they had hacked

into like a laser surgery machine while it

was in surgery.

And so it's a really good thing that

they were just, like,

making notes and moving on.

But, like,

they could have literally killed somebody

there.

And obviously that's not their fault.

That's the hospital's fault.

But, like, yeah, like,

that's not even a hypothetical,

what you were just saying about, like, oh,

it could be hospital devices.

Like, yeah, it really could.

Like, this stuff is, again,

the world is becoming so heavily dependent

on the internet and connected devices,

for better or worse.

We need to take it seriously, so...

Yeah,

the only other thing I had written down

on the notes here is like,

I've been saying this for years, is like,

it's not a bad idea to take a

little bit of an interest in disaster

prep.

Like,

I'm not saying everybody has to go out

and hoard like,

ten million guns and build a doomsday

bunker, but like,

there are literally people out there

that...

If you don't go to the store tomorrow,

you're not eating.

You only have enough food for today.

And so maybe have some bottled water.

I've lived in many places where it floods

and the system gets overwhelmed and

they're like, oh,

boiled water notice for the next,

you know,

seventy two hours just to be safe.

And like,

I just throw some water bottles in the

fridge and move on with my life.

Or, you know, um, yeah, it's just, it's,

it's nice to like have a little bit

and it's really simple to get started.

Like next time you go somewhere,

the things that you eat regularly that

last a while,

like maybe bread's not a good example

cause that stuff can go bad pretty quick.

But you know, if there's any boxed goods,

canned goods, pasta, stuff like that,

like just grab two boxes instead of one.

And, um,

I know they're controversial to some

people,

but FEMA has a guide about like how

to stock up for like seventy two hours

of disaster.

It's actually really useful.

It tells you like the different foods you

can store and how long they last.

And so, yeah, I mean,

it's it's really easy to get started

again,

not telling everybody they need to prepare

for the zombie apocalypse,

but having a couple days of spare food,

definitely not a bad idea.

So, yeah.

And then, of course,

maybe just share this article around with

people, if anybody cares.

has any uh you know kind of again

drilling that point home of like cyber

security matters it's not about hiding

something it's like this is the world we

live in so anyways i think i've rambled

enough if viewers have any uh takeaways

that we missed go ahead and let us

know and uh i will turn it over

to jordan again to take us into the

site updates

Alrighty,

let's dive into some site updates.

But before we dive into the next story,

which is about zero click malware being

served by ads,

we're going to give you some quick updates

about what we've been working on at

Privacy Guides this week.

Remember to leave your questions and

comments in the chat and we'll get to

them in a moment.

Firstly,

we had more news briefs this week.

So we had Android on-device AI gets a

security bump with next-gen enclaves.

Hackers at Pwn to Own Island exploit zero

days in the Pixel X, Samsung Galaxy S.

And OpenAI Codex.

So we also had some other ones here.

I'll just read out those.

So we had a data breach roundup,

which Nate does every week.

So that was from October

and there was also uh that story that

we're going to talk about soon about

targeted ads and mercenary spyware but

yeah i guess i'll throw it back to

you nate we've got some site changes i

believe

Yeah,

so it's been a little bit of a

slower week back here behind the scenes.

Not as many changes,

but we do have an upcoming change.

We are removing LangTool,

which personally I'm not super familiar

with.

I guess it was a...

I believe it was a grammar and spelling

plugin or extension, I should say.

Kind of like an alternative to...

Oh God, what's the one?

Grammarly, I believe.

And yeah,

if you go to our GitHub and you

click on the commits, you can see here,

this one will actually take you to...

a link to the actual pull request,

which also links to the forum.

And there's quite a bit of discussion

actually,

it's been going on for a while about

apparently their privacy policy is a

little bit questionable.

And, um, again, if there is, uh,

if you go to the forum post,

you can see a little bit more nuanced

discussion.

Apparently there are ways to run it that,

um, reduce some of that telemetry,

but I guess we couldn't really find a

way to, um,

couldn't really find a user-friendly way

to uh recommend that to people so we

decided it was best just to like

completely remove this tool so um that

should has not been pushed out yet but

it's one of the commits so it should

be coming on the next big site update

but yeah again um kind of a shorter

week so that's really all we got going

on here but um usually we are up

to quite a bit at any given time

and all of that is made possible by

our supporters so you can sign up for

a membership or donate at

privacyguides.org donate

Or you can pick up some swag at

shop.privacyguides.org,

like this awesome little water bottle that

I've been drinking here.

Privacy Guides is a nonprofit that

researches and shares privacy-related

information and facilitates a community on

our forum and matrix and now Fluxer,

where people can ask questions and get

advice about staying private online and

preserving their digital rights.

Now let's talk about how Google is

tracking all of your accounts.

And again,

remember to leave any questions or

comments in the chat,

and we will get to them in between

stories.

And I will turn this one over to

Jordan.

Alrighty then.

So this is a story from Android Authority.

Google is silently linking your phone

number across all signed in accounts.

Google now automatically verifies and

attaches your phone number to every Google

account signed in on your Android device

without explicit prompts.

Google updated its documentation between

August and October,

to reflect this opt-out behavior,

which links numbers across secondary,

work, and alt profiles.

Users can turn off verify phone numbers

automatically in the Android device's

Google settings page,

but previously linked numbers must be

manually removed from each Google

account's personal info page.

So this is sort of a shorter story,

I guess.

This is just like Google vacuuming up even

more information than they already have.

Again,

this is like one of these things where

Google can kind of roll out these changes

and

You don't really get much of a choice,

right?

Especially if they control the operating

system.

We are showing on screen how to disable

phone number verification.

Open your phone settings,

tap on the Google account,

switch to all services.

Under privacy and security section,

locate phone number verification and

toggle off verify phone numbers

automatically.

So that is kind of a lot of

steps.

I feel like the majority of people are

not going to do this.

I think it is one of these things

where...

Is Google doing this for a good reason?

Is this a security benefit for a very

small section of people where they're not

adding their phone number to their account

and it actually protects them from losing

their data?

Maybe, but let's be real.

Google is an advertising company.

They just want to suck up as much

data as possible.

I think this is mainly one of these

things where they're just trying to get

access to more people's information and

correlate more things.

It also could be used to address people

making too many accounts as well.

But yeah, I don't really know

this does seem like one of these things

where it's just an unfortunate situation,

right?

Yeah, for sure.

It's yeah.

Like you said, shorter story.

I know you said this,

but just to drive it home,

if this has already happened to you,

like if you're on stock Android and you

have multiple accounts,

you can turn off that verify phone numbers

thing,

but you still have to go into the

account and manually remove the phone

number.

It won't get rid of the phone number.

So yeah, it's, it's really annoying.

Cause it, it,

It's funny because Google says,

so the way this is supposed to work

in theory,

like this verify phone numbers

automatically thing,

the way it's designed to work,

according to Google, and you could,

for the record, two things can be real.

I think Google genuinely means this,

but I think they're also like, hey,

more data, why not?

The way it's supposed to work is like,

let's say I have the same Google account.

I've had the same Gmail account since I

was in high school, right?

And I go out and get a new

phone,

and let's say I move to a new

state or whatever,

and I change my phone number.

If I forget to update that phone number

with Google,

I could potentially get locked out of my

account.

And so Google's whole thing is like, oh,

well,

we'll just automatically pull it and

update it for you.

And that way you never have to worry

about this.

I'm not sure how much that holds up

though,

because we're living in an age where

people move, at least here in the US,

I don't know about other countries,

but here in the US,

people move constantly and we just don't

change our phone numbers anymore.

Now that we have cell phones,

there's no reason to.

I run into people all the time who

have local phone numbers,

who have the next major town over,

who have other sides of the country.

I actually...

I one time just for fun,

when I first got into privacy,

I picked a phone number and I purposely

picked this like tiny,

tiny little town in Idaho that ninety nine

point nine percent of you had never heard

of.

And I don't know why I did it.

I think it was just for fun.

I was like, oh,

that'll nobody will know where this is

from.

Like they can't Google it or anything.

Um, but anyways,

I went to like AutoZone and I gave

the dude the phone number and he's like,

Oh, you're from that town too.

And I'm just like, God damn it.

I just put myself into a hole.

But anyways, um, yeah,

but that's what I mean.

It's like nobody bats an eyelash when you

come in from any area code,

any phone number.

And so I think I get in theory

where Google's going with this,

but I feel like that just happens so

rarely these days that people change phone

numbers.

Like they,

they basically turned into other

identifiers and

It's super weird.

So again,

I'm not trying to say Google had perfectly

pure intentions.

I think both things are real.

I think it was a convenience thing,

but also a data thing.

But it's insane that they would do that

with multiple accounts because there's so

many people that have secondary accounts

that they specifically don't want.

Like my first thought was like,

what if you,

if you have like MDM stuff at work,

the mobile device management,

you have a work account on your Google

phone.

Is it going to scoop up that phone

number?

And then now what happens when I leave

the company?

Is it going to be easy for me

to,

to like reset my password and get back

into my work account because my phone

number's linked there now?

Like that sounds like a liability to me.

And yeah,

Yeah.

I mean,

there's people who use all kinds of

profiles, like content creators, right?

Like people will make, um,

if they're smart, which many of them are,

we'll make a separate YouTube account for

their, you know,

Twitch streaming or their,

whatever it is they're doing online.

And it's like, cool.

Now that phone number is linked.

And I've, I talked last week,

I think about how back when I used

to be a Facebook user, I would like,

you know, I'd meet a girl,

I'd text her.

And then a week later it would be

like people, you know, on Facebook.

And I'm like, thanks Facebook.

Now I feel like I'm stalking this girl.

I barely know.

And it just feels like this is going

to happen all over again.

So yeah, I don't know.

Possibly good intentions on Google's end,

but definitely questionable for the user.

And I think the number of people who

will actually benefit from this is

extremely small compared to the number of

people who are going to be burned by

it.

I think, yeah,

the only real stuff I have here in

the notes is like,

if you have any friends that are using

stock Android,

send this to them so they know.

Like I have several friends that I've sent

this to and they're like, oh crap,

I didn't know that, thank you.

And try to use a de-Googled phone like

Graphene.

Maybe you could try using different

profiles.

I don't know how well that works on

a stock Android, but just a thought.

If anybody has any other thoughts,

definitely let us know.

I see a lot of people were chatting

while I was talking here.

I recall Google was doing something to

verify whether an incoming call is spoofed

to match.

I don't think this is part of this.

I think that's something else,

but I could be wrong.

Yeah,

Xander said they're just being annoying.

Yeah,

and most online verification stuff is

completely unnecessary.

Again,

I don't think this was like verifying who

you are.

I think it was more trying to keep

your information up to date.

But yeah, I don't know.

Do you have any additional thoughts on

that one, Jordan?

I mean,

I read some of the comments on this

article itself,

and there was some people that had a

different opinion.

So let's try and be a devil's advocate

or whatever.

So there was one person in the comments

of this article, and they said...

they're grateful for this because they use

fifteen different Google accounts on a

daily basis for tech support and volunteer

organization administration.

And basically it allows them to log into

those easily because it adds their phone

number automatically.

So, you know,

I think some people seem to

have think this is you know a useful

feature but I think in the in the

grand scheme of things that is a little

that is a little that is a little

wild uh I think things should be done

with consent right like I think privacy is

kind of important and you know if you

didn't know that this was happening and

you weren't notified that this was

happening then that's the main concern

here right like I think if you consented

to the phone number being added if you

entered the phone number for the explicit

purpose of verifying your account and

security purposes and it asked for that

and you gave it to google then that's

fine it's just when you start verifying

people's phone numbers automatically

without their consent or giving them a

prompt to do it but in a way

that disguises what they're actually

asking but as far as i'm aware this

shouldn't be happening automatically so if

this is like it should at least prompt

you at some point um that is my

understanding of this but

if it's doing it without prompting you,

then that is kind of a bit of

an issue, I think.

And again, it's like one of those things,

like Nate said, it's creating a social,

like a social map of your entire life

because, you know,

they can see who has your phone number

in their contacts because they're using

Google contacts and they can really get

quite a lot of information about that just

by having your phone numbers linked to

your account.

So it is kind of creepy as well.

Did you have anything you wanted to add

though?

Yeah,

I'm talking to Oddbite in the supporters

chat and he also posted it here.

Apparently disabling this will actually

like turn off RCS.

And he seems very confident about that.

So I would say try it anyways and

like see what happens.

But yeah, keep an eye on that.

He said it could take up to a

month, but it could disable RCS.

And if that's true,

that is incredibly unfortunate.

Um,

he says he's a hundred thousand percent

sure.

So yeah, that's, that's pretty messed up.

Um, that is incredibly interesting.

Thank you for sharing.

I'm reading the screenshot here in the

article.

Google will periodically obtain your

number from your operator by exchanging

device info,

such as your SIM card identifier to enable

Google services.

Um, yeah, so quite possibly, man, that is.

Man, that's messed up.

Yeah.

Universe Middle Production says,

I'm tired of getting scam calls.

They should be illegal.

They are illegal, fun fact.

They're a crime, but...

I should write a post about how to

get rid of scam call.

Cause I never get any.

And it used to actually frustrate me in

my last job.

Cause my coworkers, you know,

we'd be somewhere like somebody would get

a scam call or whatever.

And, uh,

they'd hang up and they'd be like, Oh,

you should talk to Nate.

Nate never gets spam calls.

And I'd always be so mad because I'm

like, dude, it's not one thing though.

It's not like I just downloaded an app

and they went away.

It's like,

it took some time and there's like a

system and a lifestyle,

but like I could totally, um,

I could totally write a blog about that

or something.

It feels like something we should talk

about.

Um,

Xander says it didn't disable RCS for you.

So yeah, like I said, I mean,

I would recommend trying to disable it

anyways.

But just keep an eye on that,

that it could potentially disable RCS.

So that is what our resident Android

expert is telling us.

But anyways, if that's all you've got,

I think we'll move on to our next

forum update.

Alrighty.

So our next forum discussion was inspired

by a Substack post that you guys may

have seen making the rounds,

which is why we're discussing it.

And it's titled, Passkeys are a trap.

Do not use them.

So this is a post, again from Substack,

that no offense to the author,

this is coming from me.

You need to trim it down or break

it up into parts or something.

It is way, way too long.

I tried to read the whole thing.

And yeah, again, that's coming from me.

I'm long-winded.

But anyways,

they basically have this claim that

Passkeys will eventually become

inshittified by big tech,

and that's like the basic summary of it.

Someone posted this to the Privacy Guides

Forum and asked for everyone to fact check

it and weigh in.

And so the general consensus here,

how many replies we had?

We've had twenty two replies in the last

three days.

So a good number of people have weighed

in.

The general consensus from what I've seen

is that people say that there is a

lot of information in there that is

technically correct.

um and in fact some people even said

like oh i learned a couple of things

about pass keys that i didn't know but

at the same time everybody seems to agree

that this post is very um conspiratorial

like it's it's very um you know someday

this might happen and and this could

happen and this is technically possible

but a lot of people are also saying

like yeah but it wouldn't really like hold

on let me find one there was one

that i thought was um

So on first reading,

it sounds like saying don't use web

browsers because some websites might

require one specific browser and you

shouldn't be forced to use software you

haven't chosen.

So, you know, it's very...

know like i get where they're coming from

and i don't want to like brush this

person off and and say that they're wrong

especially when i personally am not uh

technically qualified to be um saying that

but these are what other people are saying

some people point out that uh you know

this this author mentions that like oh is

made up of all these tech companies like

google for example i know google is one

of them for sure and people are like

yeah but it also has like bit warden

and mozilla and one password

organizations who would never allow this

to happen.

And big tech is not,

from what I understand, steering FIDO.

It is relatively democratic in that sense.

One person actually linked to a rebuttal

from someone on Mastodon who actually

works with the standards group at Apple,

I believe.

And they were basically like, yeah,

this is completely ridiculous.

This is not going to happen.

And one kind of annoyed me is like,

they didn't even...

From what I saw, again,

it was way too much to...

I have a job.

I'm not trying to be too snarky.

But from what I saw,

they didn't make any mention of what

passkeys are supposed to do and what are

any better solutions.

They're basically just like, well,

we have passwords and we have TOTP and

that's fine.

And it's like, okay, but TOTP is fishable.

which is what pass keys are supposed to

stop.

Most people don't use TOTP.

I don't know the exact statistics.

I forgot to look it up,

but I know most people don't use a

password manager.

So I'm willing to bet the number of

people using TOTP is even lower.

And then on top of it,

like that was the original design behind

pass keys is like, again,

most people don't use a password manager.

So they're reusing the same garbage

password everywhere they go.

And that's what pass keys were designed to

fix.

So I respect this idea that the author

is like,

Hey,

I'm worried that these could be abused

someday, but it's like, okay,

and what's your solution?

Just keep going with this god-awful state

of affairs that we currently have?

Like, I don't know.

So, yeah,

I think we really just wanted to bring

this up because, again,

this post has been making the rounds.

And this is, again, from the community,

a lot of people weighing in.

Like,

it seems to be a technically informed

piece, but if I'm being kind,

I'd call it a bit of speculation at

best.

Uh, it's misleading.

I can see times where at the same

time I can see where it comes from

their edge cases.

So yeah,

if any of you have seen this post

and you've also been wondering like, okay,

what are the arguments against it?

I would tell you to go through here.

Cause a lot of them are, um, sorry,

I'll wrap up here.

A lot of them are there.

They're not like attacking the author.

They are attacking the argument,

which is really nice.

So yeah, I think, uh,

I think that's all I got.

Do you have any thoughts on this post,

Jordan, with your new haircut?

Yeah, thanks.

I think the main issue that I have

with this post,

I've been really busy this week,

so I've not had time to read this

absolute monster of a post.

I really genuinely think...

Get down the arguments that you're wanting

to make and make it smaller because there

is a lot here and there is a

lot of stuff that is, in my opinion,

unnecessary.

So try maybe next post that you make,

try and make it a bit briefer.

But my understanding is this is mostly

about the attested versus non-attested

pass keys, which is...

as far as I know, an issue,

but it's not something that we're dealing

with currently.

So I'm not really, it's kind of,

as like Nate said,

it's like a speculatory thing.

Um,

I'm not really sure.

I haven't really had time to read through

this whole post,

if I'm being completely honest.

So I don't really have too much to

add in that respect.

But I think there's definitely like this

was discussed quite at length on our

forum.

And there was a really good post from

Nathaniel, who kind of did like a whole,

I guess,

debunking or like at least

explainer of some of the things that are

wrong in this post,

which I thought was really good,

but I really haven't had time to dive

deeper than just reading through some of

the comments on our forum, unfortunately,

which...

It's definitely a hotly debated thing.

I think the main thing that people need

to know about pass keys though,

which I think I still see people like

misunderstanding this to this very day is

that websites don't get access to your

fingerprint.

They don't get access to your biometric

information that happens on your device.

Like just please, there's,

there is some misinformation going on

around about that.

It's, that is not what,

that's not how pass keys work.

Um,

that's that's not how that works that's

done on your device so um that's like

the main thing we definitely have some

information about passkeys i know jonah

did a video pretty i feel like it's

probably three years ago at this point

maybe maybe more even um that was quite

good about passkeys so it's worth checking

out that maybe but there's plenty of like

you know

discussion about this on the forum.

So if you're curious and you're not sure

about it,

I think it's one of these things where

you need to take things with a pretty

big grain of salt and hear everyone's

opinion on things first before diving into

it.

At the end of the day,

this is just a random person writing a

post on Substack.

So take that with what you will, right?

But yeah,

we did get a comment here from

lucas trauman saying that they like my

haircut yeah um kind of a kind of

a running joke now um i just got

here i'll have to go back and listen

to the first fifty minutes yeah it'll be

available on podcast platforms afterwards

as well if you wanna check it out

there as well so yeah i guess we

can jump into the next story here unless

you have any more thoughts

Yeah, I'll just add one thing real quick.

In addition to Jonah's video,

it's a little bit older now.

It's three years old, actually,

as of this month.

But EFF,

if you just type in EFF passkeys in

your search engine of choice,

EFF has a two-parter on passkeys that I

thought was really awesome.

And I guess we'd have to see how

well the information holds up.

But

It explained the first part is what the

heck is a passkey?

And then the second part is called

passkeys and privacy.

And it explains if you're concerned about

your privacy,

when does it make sense to use a

passkey and when doesn't it?

And I found that really enlightening.

So yeah, in addition to Jonah's video,

I would recommend checking that out.

But yeah, with that,

we can move into our next story.

All right, sweet.

Yeah, that is good advice.

But yeah,

we can jump into this story from Wired.

So nightmare scenario,

zero-click spyware is infecting phones via

targeted ads.

During twenty twenty four and twenty

twenty five,

Citizen Lab concluded that forty five

devices belonging to the newsletter Al

Jazeera were targeted with zero-click

attacks delivered by ads.

The researchers say that the targeted ads

were issued by Israeli founded

marketing firm Discover Tech and

distributed spyware attributed to the

Israeli developer Kandaroo.

Infected devices had contact with domains

linked to Discover Tech and then connected

to infrastructure associated with

Kandaroo,

according to Citizen Labs analysis.

The situation is so concerning, he notes,

because there isn't much that people can

do to protect themselves from zero-click

ad attacks other than blocking ads as

thoroughly as possible on all websites and

platforms.

It goes back to that thing that we

kind of joke about a little bit,

but ad blockers are kind of a security

tool at this point.

The ability to push individualized

arbitrary content

at specific users is a hallmark of the

modern online ads ecosystem and is

perfectly suited to the mercenary spyware

industry.

Until this architecture changes or ad

companies get serious about customer

vetting,

we're going to keep seeing this kind of

abuse.

Often when you see ads online or in

apps,

they're displayed following a complex

process known as real-time bidding,

essentially an automated auction where

advertisers place bids to show you

specific ads.

The millisecond long process can result in

advertisers collecting huge volumes of

data about your device, your location,

your browsing history,

plus a whole lot more.

The process has been a privacy nightmare

for years with murky data brokers selling

people's personal information

and law enforcement agencies and hostile

nations buying it to track or target

people.

The Citizen Lab researchers say that

Discover Tech operates an advertising

platform, Controllium,

that can allow its users to de-anonymize,

fingerprint,

and automatically infect devices once an

ad appears.

Overall,

the researchers estimate that millions of

devices were directed to Kandaroo's

servers,

where they could be profiled.

By analyzing ad bidding records,

they were publicly exposed on the Discover

Tech website.

The Citizen Lab researchers say ads linked

to the firm with attacker script tags were

shown in more than seventy thousand mobile

apps and more than one hundred and twenty

thousand websites between March and June

this year.

Multiple apps, the researcher says,

displayed more than a million ads linked

to Discover Tech.

The firm's ads weren't all necessarily

weaponized to potentially distribute

spyware,

but the researchers say that in general,

they have seen DiscoverTech ad impressions

on government and national security linked

networks around the world.

These include NATO and United Nations

networks,

as well as lawmaking bodies in Europe,

critical infrastructure providers in

Australia,

plus armed forces and government agencies

in Norway and Sweden.

previous zero-click targeted ad campaigns

that distributed spyware have rarely

surfaced publicly,

but the Citizen Lab researchers say that

this is likely a symptom of ad

infrastructure being so extensively

trusted and incorporated into all aspects

of digital life without specific

oversight.

Wow.

This is quite a big story.

I guess, like,

we kind of assumed that this could be

done, right, in the past.

We kind of assumed that, you know,

malicious ads were a real thing.

But we've never really seen something

so...

sinister right where something could

legitimately compromise the device without

any sort of interaction from a user um

i guess throwing this back to you nate

uh like this is kind of like pretty

concerning stuff because this is something

that you know seems to be at least

deployed at mass scale um what can people

do like what do you what are your

what are your thoughts

Yeah,

so one of the first things I want

to say is that every time there's like

a big malware story that goes around,

like I remember when Pegasus first made

the headlines, people were just like,

oh my God,

how do I check if I'm infected?

If you're watching this,

you are probably not infected.

And that goes for me,

that goes for probably Jonah, maybe Jonah,

I don't know.

But I think most of us,

like this is state level malware.

They're targeting like investigative

journalists.

They're targeting like high profile

activists,

people like Greta Thunberg level,

whether you like her or not.

They're not talking about the people who

are just randomly posting memes on

Discord.

They're not going to use state-level

malware on you.

Because especially these days,

there's been more attention paid to

spyware.

Every time they deploy this thing,

there's a risk of getting caught.

And they pay literally millions of dollars

for these zero-day exploits.

So when they do this,

they need to make sure...

We have to make sure the intelligence that

we're getting from this...

is going to benefit or is going to

outweigh like if we get burned and we

get caught deploying this.

So I just want to,

I say that to reassure people because I

know a lot of people, again,

like they freak out and they're like,

oh my God,

how do I check if I have Pegasus?

And the answer is you probably don't

unless you're like covering the, you know,

the cartels in Mexico or something.

Anyways, that said, yeah, I mean,

I think the defense against this is ad

blocking like this ad blocking to me.

I've been saying this for a couple of

months now is I feel like ads are

the least talked about privacy invasion,

like the biggest privacy invasion in our

lives that gets talked about the least

because I meet so many people that I'll

admit my bias here.

I hate ads.

I hate ads.

I hate ads.

I hate ads.

So much.

I will go...

I would rather stare at a black screen

for thirty seconds because my ad blocker

blocked the ad than see the actual ad.

Um... That's just me.

I know some people would get bored.

So, anyways, um...

where I'm with that is I run into

a lot of people who are like, well,

the app has to make money somehow.

And like, you know, they're not that bad.

It's, you know, the example I just gave,

it's like, well,

I'd be bored staring at the screen for

like,

I'll just sit there in serene silence and

enjoy it.

I should probably sit in silence more

often anyways.

But, um,

But the ad, like the article said,

like the real-time bidding process is so

incredibly invasive.

And again,

EFF has great articles about real-time

bidding too.

Basically,

when there's an ad space on a website

or an app or whatever,

it could go to anybody.

And it's literally like an auction.

It's like, all right,

who's willing to pay the most for this?

And in order for companies to decide how

much they're willing to pay,

they have to get a bunch of information

about you, like your location,

your device, your this, that,

your whatever.

So they can make assumptions about like,

oh,

this person has like a brand new iPhone.

They live in Beverly Hills.

They probably got a lot of money.

I'm willing to pay a little extra for

that ad.

And-

This has become a way to spy on

people because companies get to keep that

data even if they don't bid.

And so there are literally – again,

you can look this up.

There are literally governments in the

past have set up shell companies that

enter the advertising stream,

and they never bid.

They just collect the data.

That's like another way they surveil us.

So –

Yeah, and I mean, even putting this aside,

like, yeah, okay,

they're probably not going to put

state-level malware on your phone,

but they're still collecting your data.

And there have been plenty of instances of

regular malware on your phone.

And as it becomes more economical,

more criminals will start to do it.

So, yeah, I mean, to me, like,

ad blocking is one of the single most

important things,

especially if you're starting out in your

privacy journey.

Like,

that's kind of become the thing I've

started suggesting to people,

and I think I got this from Henry,

to be totally honest, back at TechLore.

Like,

When people say like, okay,

what's one thing I can do to start

taking my privacy seriously?

Like ad blockers,

because not only will it protect your

privacy, it's something they can see.

And like I said,

like when people start going to YouTube

and they don't see as many ads or

they go to like news sites or some

of the worst and they don't see an

ad every like three paragraphs,

it's just like, oh wow,

the internet cannot suck.

This is kind of nice.

And then they'll come back and be like,

all right, what else?

So yeah, sorry.

I know I really went off on a

rant there, but...

I hate ads so much.

If you're not blocking ads,

I honestly don't even know how you're

surviving the internet.

It's awful.

Jason's got my back.

Jason said staring at a blank screen for

thirty seconds is definitely healthier

than watching an ad.

Yeah, I mean, again,

like there's I'll keep this one quick.

There's a composer named John Cage who

wrote a song called for thirty three and

it is literally four minutes and thirty

three seconds of silence.

And that's his whole point is like just

for four minutes.

Just sit there and be quiet and just

listen to the world around you.

And again, I should do it more myself.

I really should.

But.

There's something to be said for it.

Anyways, did I miss anything?

Do you have some additional thoughts?

Yeah, I think, yeah,

you kind of covered the major aspects

there.

I think, you know,

definitely use ad block stuff.

Like we have recommendations on our

website for content filtering stuff.

So, you know, uBlock Origin, AdGuard,

use all these tools.

But I also think, you know,

There's definitely something to be said

for the level of manipulation that ads

actually can do, you know,

especially because,

like this story talked about,

these are targeted advertisements.

You know,

they're collecting a lot of information

about you and

about your interests, things like this.

You know, someone could also use it for,

not in a way to hack you, but,

you know, they're hacking your brain,

basically.

They're rewiring your brain to basically,

you know,

give you thoughts that you wouldn't

usually have based on, like,

advertisements, right?

This is something that we've seen for a

long time,

and we've seen that the role that

advertising plays with this.

I believe...

I remember when I was at art school,

I think one of the recommendations,

like one of the things that they talked

about was like using,

like originally cigarettes were like a

men's thing.

It was like, oh, you're a man,

you smoke cigarettes.

But then they started doing advertisements

with women smoking cigarettes.

And then it became a thing that's also

quite like, you know, applicable to,

you know, men and women.

So it kind of rewired people to think

something differently about something that

they already knew about smoking.

which is kind of much more sinister on

a much larger societal level because

people can use this technology for,

I think you might be able to talk

a bit more about this because you know

a bit more,

but I believe there was the issue with

Facebook,

targeting people with political ads and

all sorts of stuff like that.

It's very powerful.

I think ads are

pretty terrible for the world in general,

but unfortunately the world kind of

operates that way and that's how things

get paid for.

Someone said freedom sticks.

Do you want to start with some reference?

Yeah, that's what you're referring to.

That was part of the marketing towards

women.

I think it was Lucky Strike Cigarettes,

but don't quote me on that.

is um they made it and this could

have been like a world war ii era

thing but they made it like a like

a cool like patriot like almost with

movies you know you look at old movies

and it's always like the dude in the

leather jacket who's like really cool and

doesn't care about anything and he's the

one smoking a cigarette like that's one of

the marketing techniques they used is they

called them freedom sticks and they like

they made it like this patriotic thing to

like smoke which is kind of funny because

now most people uh

It's uncommon in America to go out in

public and see people smoking,

but I remember when I went to Europe,

I stepped outside the airport and

immediately cigarette smoke.

But yeah,

that's what they were referring to is the

story you were telling about the

cigarettes.

Yeah, no,

you're a hundred percent correct.

I mean, oh,

what was I just thinking of a second

ago?

Diamonds.

I mean,

diamonds are like the universal story

about... Diamonds are worthless.

They're pretty much worth... I mean,

they do have a few practical applications,

but diamonds are not in short supply.

As far as supply and demand goes,

they are absolutely worthless.

But literally...

All the diamond companies in the world

back in the day got together and they

were like, hey,

what if we restrict the supply?

And then on top of it,

we run this big marketing campaign that

tells everybody that diamonds are forever

and diamonds are a true sign of love

and diamonds, diamonds, diamonds,

diamonds.

And so now you're paying hundreds,

thousands of dollars for a rock that can

be picked out of the ground.

Yeah.

with very little effort.

So, um, I mean,

I don't know about very little effort

under those diamond mining,

but you get my point.

It's like, again,

they're not in short supply.

They are objectively worthless in that

sense, but marketing.

So, and yeah, um, Facebook there's,

I mean,

if you look up the Cambridge Analytica

scandal, which I,

I kind of pitched that as an idea

of video, we should totally make, um,

at some point soon for those of you

who don't remember in

We realized how much data Facebook was

collecting about us because there was a

company called Cambridge Analytica that

found a clever way to get a hold

of all that data.

And they were in turn weaponizing that

data for – what's the word I'm looking

for?

For political advertising.

And personally, I –

All right, this is a personal take.

I'm going to rant a little bit here.

I think it's really arrogant to think that

propaganda doesn't work on you,

and that goes for anyone.

That goes for me.

I know for a fact that I bought

some propaganda earlier this week.

There was something I saw on Mastodon that

I was like, oh, yeah, that tracks.

And then a little while later,

I saw somebody like, yeah,

there's no evidence for that story.

That doesn't exist.

And I'm like, oh, yep, that also tracks.

So –

Like,

I think this whole idea that we know

there are troll farms.

We know it.

We know this is a fact.

And this whole idea that, like, oh, well,

I'm too smart to fall for the propaganda.

So you're too smart to fall for somebody

who does this forty hours a week,

eight hours a day,

and it is their full-time job.

Like...

Imagine if somebody said that to you,

like whatever your job is,

imagine if somebody came up to you and

was like, I've never done this job before,

but I'm better than you at it.

Like that's the kind of arrogance that has

to be is like,

like even the lowest level job and no

offense to anybody here,

but like servers at a restaurant,

I've never been a server.

And I guarantee you,

if I went up to a server and

I was like,

I could do your job in ten minutes.

Really?

You know the best way to remember orders?

You know the best way to hold the

dishes and the best order to bring the

dishes out?

Cooks will do that.

Cooks will start certain dishes before

other dishes and stagger them so that they

all go out at a certain time.

There's little tricks that you pick up

over time.

And just the sheer arrogance to be like,

I could do your job better.

It's like, no, dude,

these people are experts.

Their whole job is to pump out propaganda

and influence thinking one way or another,

or just to cause chaos, whatever it is.

And so, yeah, I think, unfortunately,

not all of that can be blocked with

an ad blocker.

That is far more complex.

But my point being is like, yeah,

like ads are just this whole idea that

it's like, oh, well,

I don't see a McDonald's commercial and

then run out and buy a Big Mac.

No,

but I guarantee you it's working because

I'm talking about McDonald's right now.

So anyways, I digress.

I could rant about that for a while.

It's, yeah, I'm with you.

Ads are...

I think we're hitting the point where we

can safely say ads are turning into a

net loss for society.

Advertisers are trying to put them

literally everywhere they can,

as aggressively as they can,

as many as they can,

and it's just completely out of control

and is turning into a privacy and security

risk.

So definitely block ads.

Please block ads.

I think I'm done ranting for now.

Okay, we did get a question from,

I definitely agree.

But yeah,

we did get a question here from Life

and Death.

So I would say over half the YouTube

ads are for fraudulent products or free

games that I have no interest in.

So if the only choice is to block

them all, then okay.

I would say, you know, again,

like just because, you know,

you see these ads and they seem kind

of unappealing or like uninteresting,

they are having a subconscious impact on

you.

and your impression of things,

even if you don't think that they are.

Again, going back to what Nate said,

you are not immune to propaganda,

something like that.

And, you know, there's...

There's definitely...

Some people seem to think that they're

really bad at recommending things.

But I think there is definitely a reason

why they show things to people.

And there's a reason why they keep doing

it.

It's because it makes them money.

And they work.

So if they didn't work,

we wouldn't have ads.

So they do a hundred percent work.

Maybe not on you.

They work on people.

And they are convincing people to buy

things.

So...

I think it's a little bit,

it's a little bit silly to dismiss all

of that because you know,

that's basically how the entire internet

works now.

Everything is based on advertising.

That's how everyone pays for everything at

least.

So,

And not to get too deep into the

rabbit hole, but like, you know,

Life and Death also said,

I love seeing fast food ads at midnight,

three hours after the stores have closed.

Yeah, it's like, I mentioned a minute ago,

the whole like, you know, people are like,

well, I didn't, you know,

I don't run out and buy a Big

Mac every time I see a McDonald's ad.

No,

but the goal is to like put it

in your head.

And then they want you to like think

positively about these companies so that

next time you're out driving around and

you're like, oh,

I'm kind of hungry and I'm not going

to be home for like three more hours

because I'm running errands.

I'll get some fast food.

Oh, you know,

I haven't had McDonald's in a while.

And it's on your mind because you keep

seeing the ads or, you know,

like Taco Bell.

I'm not going to lie.

I love Taco Bell.

I know it's not real Mexican food.

I'm well aware.

I lived in Texas for ten years.

You know, it's like –

just thinking to myself like man i haven't

had taco bell in like six months i

could really go for a crunch wrap or

whatever and and that's what they want you

to do is they want it to be

front of mind so that your brain is

more likely as opposed to like what was

it somebody said the other day somebody

said something to me that i was i

mean this has happened a couple times the

last few days that i'm just like man

that oh in the fluxer chat we were

talking about games and somebody mentioned

need for speed and they were like yeah

ea really ruined that franchise and i was

like

I haven't heard that name in years.

And you're not kidding.

Like need for speed used to be like

grand theft auto.

It used to be like the big gaming

franchise.

And like,

now I haven't heard that name in years.

I haven't thought about that name in

years.

I mean, I never really played it,

but you know, it's like, it's,

that's what advertisers want is they want

it to be at the front of your

head.

And instead of just being like, Oh man,

I haven't thought about McDonald's in five

years.

I didn't even know they were still around.

So, um, yeah.

And then, uh,

What's the last thing I was going to

say?

I don't know.

Jason Archer said here that he got his

uncle using DuckDuckGo and he's super

grateful because now he can get things

done without being distracted and was so

glad that he shortly thereafter bought

DuckDuckGo Premium.

So yeah, it's...

The internet's a wonderful place without

ads.

I did have one more thought that I

was going to mention,

but I can't remember what it was.

I got distracted by talking about how

advertising works.

Yeah.

I think one thing that it reminds me

of is what you're talking about is like,

what's that thing where they like pour

water on you and then like you like

waterboarding,

they're like waterboarding you with ads.

So you'll become like,

you'll become softened and then you'll

like buy their products or something.

I'm not sure.

Like,

I feel like it is a bit like

that.

Right.

I mean, probably because there's, okay,

I'll admit I've never looked into this,

but I've never heard anybody argue it.

There's this whole idea that we only have

so much mental bandwidth to like make

decisions every day, right?

And that's why like historically,

Steve Jobs always wore the turtleneck,

right?

I'm sure there were a lot of reasons,

but one of them was like,

it's one less decision to make every day.

I don't have to stand in my closet

and be like,

what am I going to wear today?

It's turtleneck and jeans,

same thing as every day.

And

Allegedly, Warren Buffett eats,

ironically,

a McDonald's hamburger every single day

for lunch.

And I don't know if that's why he

does it or if he just really likes

McDonald's.

But it's like when you have those built-in

things where you don't have to think about

them,

it frees up your brain to think about

other things.

And I firmly believe that like...

when we have to put up with ads

all day especially on social media where

like it's like post post ad post ad

post post like you have to pause for

a second and think like oh is this

oh that's an ad i'm gonna keep scrolling

and that's like one more second of

bandwidth that they take away from you

that's like one more decision that's one

more and so by the end of the

day you're so tired because you've been

looking at ads all day like imagine if

we didn't have that imagine how much more

energy we'd have at the end of the

day like i mean yeah you're probably not

gonna

I don't know, solve the,

the quantum mechanics,

the next big thing in quantum mechanics,

but like maybe you'll have the energy to

cook dinner.

Maybe you'll have the energy to like start

learning a language or read a book or

I don't know.

So yeah.

Yeah.

Yeah.

We did get a comment here from E

six T three N.

And they also said that I had a

cool, cool haircut.

I don't know.

Why do people keep saying that?

I'm not sure why, but thank you.

First time on the live stream.

Welcome in.

They also said DuckDuckGo premium isn't

available in Germany, by the way.

Yeah.

It's also,

I don't think it's available here in

Australia either.

It is kind of annoying when like services

will limit services.

the rollout of their products to certain

countries because it always seems like

they do the United States first every time

or something like that.

And it's like,

it's frustrating because those tools can

be useful for people outside of there as

well.

Like, I think, you know,

maybe also we've been looking a little bit

more into

private card masking services, uh,

in light of the privacy.com stuff.

And that's also another issue.

Like a lot of those financial ones,

a lot of them it's available in the

U S and it's not, um,

odd bite said, I feel targeted by Jordan.

I don't know.

I don't, I don't think so.

Uh, someone else said, uh,

I eat a lot of fruit.

Um,

That's good to beat McDonald's.

I think because I keep saying McDonald's

over and over,

that same person also said McDonald's

gross face.

Yeah, the DDG premium thing,

I totally agree with it.

And especially those,

things like privacy.com or voice over IP,

it's unfortunate.

And I do wish there were more options

for international people,

but I get it because the banking

regulations are really strict in a lot of

countries.

And in some countries,

you have to show your ID to get

a phone number and stuff like that.

So-

I get why those ones are kind of

generally limited to one country or

whatever.

But yeah, things like DuckDuckGo Premium,

what regulation is making it so difficult

to run DDG Premium in Germany or

Australia?

Yeah, those ones confuse me.

I don't know why those aren't more widely

available.

I wish they were.

Oddbite did say, oh,

they're talking about, okay,

they're talking about how they work at

Cape,

and Cape is only available in the US.

Yeah, can you convince them to, like,

open that up more?

Like, get that in other countries.

I want that.

Universe said, nobody advertises fruit.

That's true.

Fruit is underrated, man.

I love bananas.

Bananas are delicious.

I will tear through.

I know it's not fruit,

but I will destroy an entire container of

cashews.

I probably shouldn't be proud of this,

but at one time I actually ate so

many cashews in one sitting,

I made myself sick.

So I love cashews.

Um, yeah.

Uh, good evening.

Uh, nomad outdoor adventures.

Unfortunately, we're actually, um,

that was actually our last story.

We're kind of wrapping up here.

Swear.

I had one more thought on that story,

but I cannot remember what it is to

save my life.

So yeah, I don't know.

Uh,

In fun fact, in Germany,

you must present an ID card to get

a SIM card usually,

but sometimes they just physically mail

you the SIM card and use that as

an identification of your address slash

identity.

That's okay.

That's a very robust system.

I mean, I'm not complaining.

It gives you an opportunity to protect

your privacy, but yeah,

what could go wrong?

So.

Yeah, we do need that in Australia.

You need to verify your ID either way.

So that sucks.

But for privacy.com,

the international option is HaloCard.

Yeah,

definitely looks like an interesting

service.

It's something we're probably going to try

and look into at some point, but...

I'm not sure if that's a section of

the website that we are focusing on at

the moment,

but it'll be interesting to probably dive

into that once we get the time.

Yeah,

I'm not really seeing any other questions

or comments,

especially even in the signal chat or on

the forum thread.

Yeah,

I guess we can wrap it up then.

All right.

Man,

that's going to bug me all night what

my last thought was.

But, you know, as they say,

if I can't remember it,

it must not have been that important.

All the updates from this week in privacy

will be shared on the blog every week.

So sign up for the newsletter or subscribe

with your favorite RSS reader if you would

like to stay tuned.

We also offer a podcast available on all

podcast platforms and RSS.

which now includes video on supported

platforms.

And this video will be synced to PeerTube.

Privacy Guides is an impartial nonprofit

organization that is focused on building a

strong privacy advocacy community and

delivering the best digital privacy and

consumer technology rights advice on the

internet.

If you wanna support our mission,

then you can make a donation on our

website, privacyguides.org slash donate.

You can also make a donation on any

page on the website by clicking the red

heart icon located in the top right corner

of the page.

You can contribute using standard fiat

currency via debit or credit card or opt

to donate anonymously using Monero or with

your favorite cryptocurrency.

Becoming a paid member unlocks exclusive

perks like early access to video content,

exclusive video content,

and priority during the This Week in

Privacy livestream Q&A.

You'll also get a cool badge on your

profile in the privacy guides forum and

the warm,

fuzzy feeling of supporting independent

media.

Thank you everyone for watching and we'll

be back again next week with the latest

news.

See you next week.