A Grand Theft Auto online cheat service

suffered a data breach.

Another password manager had vault stolen

and two disappointing stories from Meta

this week.

All this and more coming up on This

Week in Privacy, number fifty six.

So stay tuned.

Jordan, you're muted.

Welcome back to This Week in Privacy,

our weekly series where we discuss the

latest updates with what we're working on

within the PrivacyGuides community and

this week's top stories in data privacy

and cybersecurity.

I think Jordan was muted this week,

but I am Nate and Jordan is joining

me.

Or there were technical difficulties.

Check, check, one, two.

All right.

Well, while Jordan gets that figured out,

I think we're gonna... Hey, Jordan,

welcome back.

Oh no, we still can't hear you.

Oh no.

Gotta love going live.

These things do happen.

I'm gonna go ahead and jump into the

main story while Jordan is trying to

figure that out.

And our main story this week is Grand

Theft Auto.

Yeah.

So for those, I mean,

I feel like this is a pretty popular

game,

but for those of you who are not

gamers and maybe may not know,

Grand Theft Auto, super,

super popular video game.

man, as long as I can remember, or,

you know,

at least as long as I've been a

gamer and, um, it, uh, you know,

like a lot of games these days,

it has an online mode and, uh,

the online mode from what I understand can

be a cooperative or, um, adversarial.

Uh, I, for some reason,

the word I'm looking for is,

is escaping me right now, but, um,

you know, like, uh, like any online game,

uh, there are cheaters and, uh,

It's, you know,

cheating kind of ruins the experience for

everybody, right?

Because if you're just a casual gamer

trying to have fun and somebody just like,

you know,

blows your character up and steals

everything, that really sucks.

But then also if you're like a serious

gamer and you're maybe like trying to be

professional or something like that,

then having somebody cheat is, you know,

it ruins your rankings.

It just, it sucks for everybody,

except for the cheaters who seem to have

fun, which I don't really understand why.

Yeah, well,

we'll get to that in a minute.

So anyways, so there's a service.

I mean, there's a lot of services.

There's a lot of different ways to cheat.

Dead serious, I've never done it.

I'm not much of an online gamer myself,

but there's a lot of different ways to

do it.

And one of them is this paid service

called Atlas Menu.

And they had a data breach,

which leaked the email addresses,

usernames.

TechCrunch here says scrambled passwords,

IP addresses, and support tickets.

of almost sixty four thousand accounts.

And I'm assuming by scrambled passwords,

they mean like hash passwords.

I don't know why they said scrambled here.

Yeah,

especially coming from this particular

author,

he's very knowledgeable about

cybersecurity.

So that was an interesting choice of

words.

But Atlas Menu claims to offer secure

authentication and enhanced privacy

through our advanced encryption

techniques,

which is just a reminder that marketing

will say anything and usually means

nothing because that's not

really clear.

The attacker claimed responsibility and

posted the data on GitHub,

and motivation appears to be revenge

against a scammer, which, you know,

privacy is a human right,

so I'm not going to say these people

had it coming,

but I think anybody who's ever been the

victim of a cheater on an online game

can definitely feel the frustration there.

So yeah, Atlas Menu,

according to one video,

offered features like invisibility and

super jump and the ability to fly through

the map.

So I mean,

at least I guess it wasn't like

invulnerability or something.

And then they point out in this article,

cheating has become like a huge industry,

multimillion dollar business.

And they mentioned that Counter-Strike

Global Offensive also had a breach a few

years back.

So this is not a particularly new thing,

but it's definitely very interesting for

sure.

Yeah.

Trying to think.

Yeah.

So like I said, am I back?

Hey, Jordan.

Yes, you are.

Welcome back.

Of course.

As soon as we press go live,

like everything just breaks.

So yeah,

you and I were talking beforehand.

Yeah, that was so bizarre.

I don't know what happened.

But yeah, sorry.

I'll just throw it back to you, Nate,

to continue with the story.

No, you're good.

I mean,

I don't really have too much to add.

I'm not much of an online gamer.

I think when I was in high school,

I played a little bit of Halo Online,

and there were a few.

I think I ran into a couple of

cheaters, but definitely not a ton.

Just like I said,

it kind of ruins it for everybody,

and

I've I've I've done some cheats in offline

games just for fun,

but I find that in my experience,

they tend to get really boring really

fast.

So I'm not a huge fan of it.

I don't really understand what the point

is if you're just going to cheat,

especially in online mode,

like just play offline at that point.

But the

Yeah,

I guess the two things that I really

took away from this story is, number one,

it's unfortunate because this cheating

industry is why we've seen a huge rise

in rootkit.

Sorry, I shouldn't call them rootkits.

Anti-cheats.

And they kind of are rootkits, though,

because a lot of them go deep, deep,

deep into the operating system and work at

a very deep level, similar to a rootkit.

Like some of them even, I think,

before the OS boots up, which is...

incredibly frustrating, especially again,

if you're like me and you don't really

play online games,

I actually did buy GTA five a few

years ago.

And, uh, it was like, Oh,

install the anti-cheat.

And I'm like,

but I have no plans to ever online.

And it's like, doesn't matter.

You got to install the anti-cheat,

which is just garbage and terrible.

And, um,

Yeah, it's... Ironically,

we've seen stories in the past about how

having these anti-cheats on your

computer... First of all,

some of them conflict with each other.

So if you play multiple online games,

you may have to uninstall one to install

another,

which is incredibly annoying as somebody

who does not have a lot of space

on my computer and therefore tends to do

that with games in general.

But also, it's... Ironically, they can...

they kind of fend off certain forms of

other malware.

And I'm not saying that as an endorsement,

obviously, but it's just,

it's interesting to see that it's like,

if you have one of these installed,

because it basically functions like

malware with a pinky promise not to do

anything bad,

then it kind of stops other malware from

being installed,

certain types of malware from being

installed.

But yeah,

the other thing I kind of poked fun

at was the whole, you know,

I called it out.

It's like, oh, Atlas menu says they have

secure authentication and enhance privacy

through our advanced encryption

techniques.

You got to be careful of marketing.

I know marketing has always got to hype

up their product.

They got to seem super awesome and

whatnot.

But you do,

especially with the open source stuff

that's a little bit more transparent,

try to find white papers,

try to find the FAQ,

try to find something that digs in a

little bit deeper and specifically says,

here's our threat model.

Here's what we defend against.

Here's exactly how it works.

Even if you don't dig into...

here's our exact encryption protocol and

key exchange and this, that,

because I'll be honest,

that stuff goes over my head.

But if they break it down, like, oh,

everything is encrypted in the browser and

then sent to our device where we compare

hashes or, you know,

just something like that,

something that's a little bit more

substantial, I think.

I don't know.

Yeah, so you were,

Jordan was originally supposed to take

this story because you have a little bit

more experience with online gaming,

I believe.

So I guess I will turn it over

to you for your thoughts on this story.

Yeah,

so I guess the most important thing about

this that can be kind of confusing with

the way that this story was presented was

this is, you know,

this cheat software is primarily used on

GTA Online,

which is where people basically...

It's like GTA V except...

you basically can play with other players

and there's like different multiplayer

activities you can do.

So that's the main thing that I think

people are using this for.

And I think that's personally what I would

think is the main issue with a lot

of these cheat things.

Like I don't really care if someone is

like cheating on their GTA five local game

installation.

And it's like,

you know,

that they're single player video game.

I don't really care.

I think people should be able to use

software the way that they want.

Right.

And they should be able to,

if they want like run cheat software,

right.

Because that should be up to them.

So I think this is kind of where

I have more of an issue is when

you start affecting other people and,

you know, ruining people's experiences,

um,

It can kind of get really frustrating,

especially with GTA Online,

because this is one of these sorts of

games where basically if someone is

cheating,

they can basically ruin the entire

experience for everybody.

And I've seen a lot of times,

like I used to play GTA Online and

there was a lot of people who would

use

not specifically this software.

I don't know which software they were

using,

but they were using some sort of cheat

menu to basically

mess around with people.

And I think the most important thing with

this, though, is, like,

I don't think we should be, like,

celebrating people's information getting

breached, right?

Even if these are, like, people that,

like, kind of deserved it, right?

Like, it's, like, you know,

you're fucking with people's video games.

Like, you should probably, you know,

be a bit... It's a bit of karma,

right?

But it's also, you know,

I don't think we should be happy that

all these people have had their

information breached because...

of like a security breach.

Right.

Um, so I think, you know, it's,

it kind of makes sense why this, uh,

why this service was breached in the first

place.

Right.

Because they're kind of a target because a

lot of people probably hate this software

because it keeps ruining their games.

Um, but it sounds like from the article,

it was actually someone who thought that

they'd been, um,

scammed so maybe perhaps they purchased

the software and then they never got

access to it or something like that and

they decided to basically take revenge on

this specific software developer I do

think though that you know obviously this

sixty four thousand people whose accounts

were part of the breach that's kind of

crappy and I do think you know maybe

if they were using this software on a

local installation of a game maybe that

would be like less of a concern I

know a lot of these games definitely

enforce like a TOS and they say like

you know if you use any software that's

that affects the game in a way that

is not intended or allows you to gain

an advantage that could be a reason to

ban you so I mean

I think we should be promoting people

being able to use whatever software they

want.

But also, like,

it's not great that these people had their

information breached.

I don't think we should be celebrating

that exactly.

I think it's just kind of unfortunate.

And they were primed to get hacked,

I think, at that point.

Yeah, I totally agree.

I'm never a fan of saying people deserve

to get hacked because, again,

privacy is a human right, right?

And that's how human rights work,

is even if you disagree with somebody.

And also, it's a video game.

Believe me, I am a gamer.

I am ashamed to admit this,

but in high school,

I did throw a controller one time.

And I know some of you guys are

like, one time?

Get on my level.

But to me,

that's really immature and not...

emotionally, you know, but I was like,

or something.

So my point being is like,

I get it.

I know how frustrating it can be.

And yeah,

especially if they're like the kind of

cheats where it's like the one hit kill

kind of stuff is just like, dude,

come on.

Like, it's just a game.

Don't take it so seriously.

Don't,

don't be doing that and ruining the fun

for everybody else.

But it's still, yeah, it's, and it's,

it's frustrating.

Cause like this anti-cheat thing has been

a major sticking point for

gaming on linux because so many of these

games now require this anti-cheat that as

far as i know only works on windows

or maybe windows and mac and because linux

has such a small adoption there's a lot

of people who

there's it.

And I'm told that gaming on Linux has

gotten a lot better.

Um, because I, I use cubes, which you'd,

I don't even know if you could play

solitaire on that thing.

Um, but you know, it's,

it's not really a gaming computer,

so I don't have a lot of gaming

on Linux experience,

but I'm told that gaming on Linux is

getting a lot better,

but it's still like a

It's still got a ways to go,

especially for some of the AAA titles,

and this is why.

Because the whole anti-cheat thing,

which does not work on Linux,

and therefore there's a lot of AAA games

that you can't play on Linux strictly

because you can't install the anti-cheat.

So this does have privacy implications

beyond just this story as well.

It's like, if people would...

I don't know what the solution is,

because I don't think they should just

make an anti-cheat that works on Linux.

I don't think any of the Linux people

would want that.

But it's like,

if we could get a better handle on

the cheating situation where people didn't

need it, that would be...

That would be super awesome.

I think also the issue with these

anti-cheat software is that they're

actually really privacy invasive as well.

Like we've seen with, I know Vanguard,

which is part of like Valorant and League

of Legends.

That's like.

basically, like you were saying,

it's basically a rootkit.

Like it actually needs full access to your

entire system.

It needs to be running, uh,

in order to verify the authenticity of

your system.

And, you know,

I think that basically means that they're

logging every process on your computer.

They're checking to see what code is

running on your computer and possibly

sending that back to some third party

company.

Right.

And, um,

Yeah, I don't think the solution is...

Actually,

I don't really know what the solution is

because I'm not a game developer.

I'm sure there's issues either way, right?

Like if we took away all the anti-cheat,

every single game that we play would be

filled with people cheating.

And if we made it so that Linux

had anti-cheat, then what might happen,

like what we saw with Apex Legends.

So at one point,

Apex Legends was using BattleEye

anti-cheat,

which actually does have a Linux version.

However, the Linux version isn't

It doesn't have as good access as Windows.

So basically all the cheaters were just

switching to Linux to cheat because it

would be harder to detect.

And then, of course,

what do you think happened then?

Well,

the Linux version doesn't exist anymore

because it was just being used by

cheaters, which sucks, right?

Like, it goes both ways.

So...

Yeah,

it's just a really crappy situation

because, you know,

I think a lot of people in our

community don't want to have to use

Windows and there's just a lot of video

games at this point that are kind of

forcing you to basically use it or...

basically you can't even play the game.

Like it would be fine if there was,

you know, performance issues.

Like if there was some minor performance

issues and like maybe it didn't perform as

well as the Windows version or something

like that, but it can't even start.

Like you can't even run the game.

So I think that's,

it basically has gotten to this point at

this point where like if a game doesn't

run on Linux, it's because of anti-cheat.

There's no other reason why it can't run

because it's

It's just a platform limitation almost at

this point.

I don't know what the answer is to

that exactly.

Maybe I'd rather not have to run an

invasive anti-cheat software on my Linux

computer,

but maybe that ends up being kind of

the only option that actually allows it to

happen.

But if it doesn't have the same amount

of access,

I don't see why any company would allow

that.

in the first place.

Yeah.

Yeah, it really sucks.

It's kind of a crappy situation all

around, for sure.

And I went and looked it up because

I was like, man,

wasn't there an anti-cheat thing recently?

There have been several anti-cheat

scandals.

Riot Games,

which is Vanguard you were talking about,

and their easy anti-cheat.

In Valorant,

Vanguard has been accused of data

scraping.

There have even been allegations that a

Riot employee was being bribed to ignore

cheaters.

Vanguard updates were reported to brick

DMA cheating devices by forcing full OS

reinstalls in Apex Legend.

Oh, yeah, I remember this one.

There was attackers used a remote code

execution to inject cheats into pro

players during an actual competition.

So, I mean, like, yeah, this stuff is...

This isn't just like theoretically it

could be bad.

Like there's an actual history of this

stuff.

And then now we see that sometimes it

doesn't even work and just puts people at

risk, which, you know, shocker, right?

Unfortunate.

But I think if that's all we have

for that story,

we're going to go ahead and talk about

another super exciting corporate...

How would I define this one?

Corporations...

Corporations doing the wrong thing or

making the wrong move.

So we've actually covered some of this

recently for audio listeners.

The headline says Microsoft under fire or

threatening security researcher with

criminal investigation.

And so we've covered,

there was a security researcher who goes

by Nightmare Eclipse and

And they have publicly published a series

of vulnerabilities, including Blue Hammer,

Red Sun, Undefend, and Yellow Key.

And I think Yellow Key and Blue Hammer,

we talked about on previous episodes,

one of those was a vulnerability in

BitLocker.

And so this is interesting.

Basically,

Microsoft is saying this person did not

responsibly disclose, which, okay, so...

It's not a law,

but I think it's kind of a –

and it's actually a little contentious,

which we'll talk about that in a minute.

But generally speaking, in cybersecurity,

there is kind of the idea that the

proper way to go about things is you

find a bug.

You report it to the company,

and then you give them about – I

think the standard is ninety days.

I could be wrong.

Somewhere between thirty and ninety to fix

the bug and push out an update.

and then you kind of explain what you

found and what it is um just kind

of for the the education of the community

right like letting everybody know that uh

here's this bug i found here's how it

works whatever whatever um they're kind of

fun to read sometimes especially if

they're not super super technical

sometimes they're just super technical and

i can't understand them but if they're a

little more approachable i like and i

enjoy reading those kind of posts and um

So, and for the record,

there's exceptions.

Like if a company is really like open

and working with you,

a lot of the time they'll delay the

public post because it's like, oh,

they're having trouble rolling out an

update or whatever the case.

But anyways,

so Microsoft is basically saying this

nightmare eclipse person did not do that.

They say there was no responsible

disclosure.

They just went ahead and published this

stuff right off the bat,

which in turn provably did put a lot

of people at risk.

The article talks about how there have

been

vulnerabilities that are already using

this stuff in real world attacks,

according to both Microsoft and CISA.

So they're saying we're going to sue this

person because this was negligent and just

irresponsible.

Nightmare Eclipse claims that's not true.

They said there's a series of blog posts

where they claim to have been in contact

with Microsoft,

but the company allegedly mistreated them,

including revoking access to the Microsoft

Security Response Center account.

I think they said something like their

GitHub posts were taken down in two.

Oh, yeah,

the researcher published the bugs on

GitHub and the account, oh, and GitLab,

and both of those accounts were banned,

according to this writing,

if I'm understanding that correctly.

So, yeah, this is, and of course,

neither of them have responded,

which is smart when you're in the middle

of a lawsuit,

you do not talk about it,

because that can complicate things.

It seems that the community is on

Nightmare Eclipse's side here,

which I know is a shocker.

They're, who did they cite here?

They mentioned... I know they mentioned...

Okay, so they mentioned this Katie...

I don't know how to pronounce this.

Katie Masouris,

who works for Luda Security.

And she talked about how responsible

disclosure... It's kind of...

I don't want to say nitpicky.

It's not the right word.

Um,

but she talked about moving away from the

idea of responsible disclosure and instead

moving it more towards coordinated

disclosure, which is like I mentioned,

like sometimes they'll expand the window

if the company's having a hard time

patching it.

Um, you know, Kevin Beaumont, I,

I saw this on Mastodon.

He was on Mastodon sizing Microsoft.

And, um,

I don't know, from what I've seen,

and this is as an outsider,

I'm not a cybersecurity expert,

I'm not a researcher,

but from what I've seen,

Microsoft does not have a particularly

strong security culture.

So I'm kind of inclined to take this

Nightmare Eclipse guy's version of events

and say that he probably did try to

reach out to them and they probably tried

to like sweep this under the rug and

make it go away.

because everything is vibe coded from

Microsoft now.

But yeah, I mean, either way,

it's I kind of brush past it.

But this this sub headline here says

cybersecurity veterans warn of chilling

effect, which is true.

This is this has been and

I don't know how true this is,

but I've heard this story from multiple

people.

There have been a lot of people who

have say that they're like hobby

cybersecurity researchers.

They're not like professional,

but they do it for fun.

And they've disclosed vulnerabilities to

multiple organizations, big and small.

And nine out of ten times,

if they get a response at all,

the response is, oh, you hacked our stuff.

We're going to sue you.

And so after a while,

they just give up.

They're just like,

I'm not even going to report bugs anymore

because they keep threatening to sue me.

And what's the point?

go ahead and get hacked,

which I don't think is a great response

because it puts everybody else at risk.

But yeah,

so if this is how companies respond,

it definitely does have a chilling effect

on

on researchers coming forward to report

this kind of stuff,

especially from a company as big as

Microsoft.

And I'm assuming that if,

if nightmare clips reached out,

he's probably got receipts, you know,

he's probably got copies of the emails he

sent and stuff like that.

So we'll,

I guess we'll see how this shakes out,

but I do,

I do find this whole debate interesting

because I,

of course I have my own opinions on

this,

but I've seen some people argue that like,

you're never owed responsible disclosure.

I'm thinking of a very specific researcher

who I don't wanna name,

but they will routinely post like, oh,

here's why this software sucks and here's

all the things I found in it.

And no,

I didn't message them because their

software is so crappy that they're

basically,

malicious and they deserve it.

And therefore I'm not going to say

anything because I'm very full of myself.

I feel comfortable saying that.

So yeah, I don't know.

I think it's very,

I am a fan of at least trying.

If you're going to disclose this kind of

stuff in the first place,

it's my personal opinion that you should

reach out to the company.

If you're one of those people who's just

like, it's not worth the lawsuit,

I'm not even going to report it,

then fine.

But you're also probably not the person

who's blogging about it.

So I don't know.

That's kind of my opinion.

Because again, it's the thing of like,

You're putting other people at risk.

It's not just like making this company

look bad and shaming the company,

which unfortunately is required sometimes.

We've had to do this with Signal in

the past.

There was a bug a long time ago,

a long time ago,

a couple of years ago, where Signal,

I think it was on Windows specifically,

Signal was not like properly sandboxing

the private key.

And apparently a bug report had been open

for years at that point.

And signal tried to argue when it, like,

it kind of blew up and became a

big story and signal tried to be like,

well, cause for those who don't know,

basically what it is is if you had

malware on your device,

it could easily access your private key on

signal.

So it could see your messages.

And Signal tried to like downplay it and

be like, well,

if your device is compromised,

there's nothing we can do about that.

To which everybody's response was like,

yes,

but this person already like did a fix

and it takes two seconds and it's like,

why not do it?

And eventually Signal did it anyways,

even though they insisted it wasn't a big

deal.

So unfortunately,

companies do have to be shamed sometimes,

even the best of companies.

But...

I think to go straight to the shaming

part and to not try to coordinate first

is definitely, in my opinion,

not pretty cool.

But I also think it's not really cool

for the companies to respond by saying,

hey,

let's sue you because you found a

vulnerability instead of saying, hey,

let's fix it.

So I don't know, a little bit rambly,

but I think that's all I've got.

Jordan,

did you have any additional thoughts on

this one?

Yeah,

so I think one interesting thing about

this entire thing was you mentioned in the

start there that it was GitHub and GitLab.

Both the exploits were removed on GitHub

and GitLab.

And I think that kind of shows that

we've reached a point, honestly,

where

basically Microsoft controls way too much.

Like they control the software

distribution platforms.

They control the most popular operating

system.

They control like way too much.

Right.

And I think the reason that even get

their GitLab account was deleted because

it's because GitLab is a Microsoft

partner.

Um,

and they also coordinate with Microsoft.

So they,

I think, you know, it's once again,

one of those things where we have to

say, you know, this is probably,

it's probably a bit too much control that

Microsoft has over the entire software

distribution process.

And that's where they kind of can wield

this power against developers and

security researchers who report this stuff

to them.

And I think it also shows a really

bad look as well because imagine if you're

a security researcher and you find a

really bad vulnerability in a Microsoft

product.

Now there's precedent that you're going to

get sued and reported to the criminal...

What do they call it?

The criminal... Something security...

I can't remember what they call it.

The digital crimes unit.

digital crimes unit,

like you're going to get reported to the

digital crimes unit,

like just for reporting a vulnerability.

Um, and I dunno,

I just think this is not how you,

this is not how you look good when

you, when, when in terms of security,

this is not how you promote more people

to report vulnerabilities to you.

Um, and I think even if it's like,

you know,

these vulnerabilities that get reported,

if they're like, you know,

if they're used for criminal activities

and Microsoft doesn't realize that these

are being exploited in the wild just

because people don't want to report it,

then that's just like a negative for

everybody.

That's not a positive.

And I did also see Kevin Beaumont,

who's like a security,

I feel like he's in like the cybersecurity

industry,

is kind of quite a popular person.

popular guy.

He also wrote like a Medium blog post.

I don't know if we can bring that

up.

But in his blog post,

he talks about someone else.

There was someone else called Sandbox

Escaper.

And they basically reported a bunch of

zero-day flaws to Microsoft.

And then eventually,

according to Kevin Beaumont,

they hired this person.

So it seems like there's...

Microsoft has done the right thing in the

past and also hired somebody.

And now why have they suddenly changed

their tune to start reporting someone to

the authorities?

It doesn't really make a whole lot of

sense.

It also says Microsoft,

Kevin Beaumont also says Microsoft have

also purchased zero day exploits in their

own products from exploit brokers.

So

Yeah.

I mean, according to Kevin Beaumont, this,

this basic, this whole,

this whole saga is not looking too good

from a legal perspective for Microsoft,

especially because now there's all that

history, right?

There's like the history of Microsoft

hiring somebody who was doing the exact

same thing.

It's,

it looks extremely bad for Microsoft.

I don't think this is

This is not the right way to do

vulnerability disclosure.

Like this is like the bug bounties and

all this sort of stuff.

It's not the right way to do it.

And yeah, I think Microsoft just,

it just shows us in this case,

Microsoft has too much control as well.

I didn't really have too much to add

about this specific person because I don't

really...

I don't really know how much we can

trust from some random person,

but like if we just look at things

from like a, the aspect of like,

the actions of Microsoft against someone

reporting a vulnerability.

I think we can all agree that this

is the wrong way to do it.

The exact opposite way to do it,

in fact.

So yeah,

just really frustrating for Microsoft.

It feels like Microsoft is literally not

doing a single thing right at this point.

Like they can't even get anything right.

Like their operating system,

everyone is switching.

They keep trying to put AI in all

their products and no one wants it.

Like,

it's not great I'm not not a fan

okay this is totally off topic like just

taking shots at Microsoft but did you see

four oh four's post about like Microsoft

is trying to roll out some new AI

thing called Scout and apparently there

was like a leaked memo that was like

oh we want it to be addicting and

Sachi Nadella went on this huge rant where

he's like I don't know who wrote that

or where it's coming from and four oh

four wrote this like it's almost

borderline passive-aggressive

But it's not.

It's close, but it's not.

But it is beautiful.

Where this whole thing where they said

like six times in the post, they're like,

it says in the post who wrote it.

So either you are like really not paying

attention or just choosing to be ignorant.

Like, why don't you go ask that person?

It's, oh man, if you haven't read it,

you should.

It's beautiful.

But yeah, I kept seeing stuff about him.

Yeah.

Like he kept saying like he didn't know

what it was about,

but like he's like the CEO.

He should know everything that's going on

in the company.

That's like his job, right?

yeah which is what four oh four said

it's like so are you telling me that

you don't know what's going on in your

own company like what's going on here dude

here I'll real quick I'll I know we're

a little off topic but I'll put it

up I just pulled it up right now

it's a Sachi Nadella not sure who said

Microsoft wanted to make AI addictive is

looking for the guy who did this and

then if you actually read it they say

like multiple times it's like again it's

you know he signed it or whatever so

yeah it's a

Just, yeah, what is going on at Microsoft?

That is the million-dollar question right

now.

Actually, how much is Microsoft worth?

That is the trillion-dollar question.

Common Microsoft L, as usual.

Yeah, for real.

That's a good way to put it.

All righty.

Yeah, no,

I don't have anything to add to that.

But I do appreciate you pointing out

the...

Oh, gosh.

I already lost track of it.

But it was good insight.

Oh, yes.

How Microsoft is getting way too powerful.

If they can get GitLab to take stuff

down,

GitLab is supposed to be separate and

independent.

And just, yeah, that's troubling.

GitLab's getting a little too corporate,

I think.

I know there's a lot of people starting

to push away.

What's it called?

Forge Go, Forge Joe, something like that,

which is supposed to be like an activity

pub version of Git.

Or there's, what else?

Codeberg's a popular one.

I don't know if it's as popular,

but I know some people like GitT.

I mean,

they've all got their pros and cons,

but yeah,

we definitely need to decentralize a

little bit because that is scary, I think.

But in the meantime,

I think we're going to issue some quick

site updates.

We do have a story coming up in

a little bit about Dashlane,

who's pulling a LastPass.

There's some good news there, hopefully,

but still not great.

But before we discuss that,

we're going to talk about what's been

going on at Privacy Guides this week.

So this has been another one of those

weeks where there hasn't been a whole lot

of public-facing stuff,

but we've been very busy behind the

scenes.

Jordan is wrapping up a new video.

I'm getting all the B-roll for the next

video after that.

But in the meantime,

we had a fantastic new article,

which actually,

let me see if I can pull that

up real quick.

While that's loading,

it is called No Right to Remain Silent,

Negative Rights in a Positive Rights

World.

And I highly encourage you guys to go

read this one because it is here.

Let me pull this up real quick.

Share this tab.

It is about something a lot of you

guys, if you're privacy veterans,

have probably clocked already,

which is we're kind of moving into a

world where it is suspicious to not be

part of the system.

You know, like it was a...

What year are we in?

Twenty twenty six.

So like fifteen years ago,

twenty years ago.

God, it's been so long.

We'll say fifteen,

ten to fifteen years ago.

If you didn't have a Facebook,

that's kind of normal.

I mean, it wasn't like super normal,

but it's kind of like whatever.

You know, if you didn't have Instagram,

if you didn't have Snapchat and even now,

I think to not have some of these

things like I'm not on Snapchat,

but I'm on Discord or I'm not really

on Facebook,

but I'm really active on Instagram or

whatever.

That's pretty normal.

But we're moving into a world increasingly

where to not have any of this stuff

is really starting to be seen as

suspicious and strange.

And this was a fantastic write-up by one

of our guest contributors.

And they kind of explore this and how

it's kind of really becoming a problem

where like,

obviously we're not fans of it,

but here in the US, you know,

now to get a visa or get into

the country, they want you to show,

if you're a foreigner,

they want you to show like five years

of social media history.

And it's like,

how do you think that's going to look

when you show up at border patrol?

And you're like, yeah,

I don't have social media.

I don't have, or, you know,

I use Mastodon where everything over a

month gets automatically deleted.

Like that's going to look really

suspicious,

even if it was a different administration

in charge.

And so it's,

this is a definitely becoming a problem.

And I highly recommend checking that out.

And then, again,

it was kind of a slower week.

We did have a couple of news articles,

really.

We had the Data Breach Roundup, of course.

But we also had a story that we're

going to talk about here in a minute,

which is Meta's AI support agent used by

attackers to take over Instagram accounts.

And if you want to read a little

bit more about that story or a different

perspective, Freya wrote that.

So definitely check that out.

But that's all that's been going on the

article side of things.

And I think Jordan has some additional

updates.

Yes, I do.

I've got something that Jonah's been

working on quite a lot behind the scenes.

I'm not sure if I can... Okay,

it looks like I've got to remove your...

Okay.

Basically, we've been working on... Well,

not we.

I'm just going to say Jonah's been working

on basically this whole verified apps

database.

So if you didn't catch last week's show,

basically how it works is it's

a database that has the certificate hashes

of Android apps.

And basically we're relying on our

community members to submit their apps to

that database.

And originally it was just like we talked

about last week.

It was a website that you could visit

that basically would provide

have the hashes that you could compare

with apps on your device.

And Jonah has basically been working on a,

he's been testing something that would

basically allow for allow for people to

automatically check device like

certificate hashes of apps that they have

installed automatically against the

database that we've been working on so I

guess I can scroll down a little bit

here this is kind of like what it

looks like it basically shows all the all

the apps that you have installed and it

will basically tell you the hash of the

app and then it will tell you the

status of the, if the app matches that,

that is stored in our community database.

So basically we've been having people on

GitHub submitting their app certificate

hashes,

and then that's been compared against

all app stores, basically.

Google Play, FDroid, Accrescent,

all these app stores,

checking the certificate hashes against

that, and then eventually,

once we double-check everything,

submitting that to the database itself.

And basically,

the reason why we've been doing this is

the previous app that existed,

which was...

called AppVerifier by Superslurper.

It was a good app,

but the issue with it was that the

internal database was very limited and the

developer didn't want to increase the apps

that were actually included in that

database.

So basically it was useful for checking

the hashes,

but it didn't have a very large internal

database.

So basically we're trying to change that a

little bit.

And we're not trying to replace the App

Verifier app exactly.

We're basically just using...

This is basically an app that can check

the certificate hashes of all the apps

that you have installed.

It doesn't work exactly the same way as

the App Verifier app.

I might just read exactly what Jonah put

on the GitHub because I feel like that's

probably a better way to...

basically explain it.

So let me just share this tab instead.

Basically it's a verified apps is a app

signing hash viewer and verifier.

And if you scroll down here,

It's a fork of AppVerifier,

but many components have been removed,

so it no longer serves the same purpose.

Notably,

it no longer includes peer-to-peer

verification via clipboard sharing.

This app only checks against our

crowdsourced database.

So basically what this means is that this

is more of a

I guess,

supplementation to the app verifier app.

So it's not a replacement.

It fills a small niche there.

And the app right now is,

this is all pre-release stuff as well.

I just want to put that out there.

This is not anything that's been fully

released.

We've currently got,

Jonah put out a release fifteen hours ago.

This is like a pre-release of the app.

I've downloaded it myself and there's no

issues with the functionality or anything

like that.

But it is,

it is not quite production ready.

Like there's still certain things that I

think Jonah is working out on the back

end and to basically

make sure that you can verify that the

app is actually legit.

Because obviously you need to make sure

you trust this app because it's going to

be checking all the certificate hashes of

all the apps you're using.

So yeah,

there's been some kind of background

process on that.

And overall, it's looking really good.

I've already really liked this app a lot,

actually.

So if you're interested in testing it out,

you can check that out on the privacy

guides forum,

verified apps app for Android pre-release.

So it's available for pre-release if you

want to test it.

Obviously don't rely on this fully yet

because it's not really fully released,

but it would be really helpful if people

could download this and give feedback if

they have any.

because it's, yeah,

it's kind of actively being developed and

it's only just, we only just put out,

I think Jonah put out a release the

other day, two days ago.

So two day old app.

So don't, don't judge too harshly,

but I think it's already quite promising.

But yeah.

Do you have any thoughts on this on

Nate?

Because I feel like this is kind of

a big release here.

Um, no, to be honest,

I don't really have any thought.

I think it is super cool.

I agree with you.

Um, it is a big release.

It is really exciting.

Um, I'm glad, uh,

cause I know last time we mentioned this,

uh, this crowdsourced app verifier thing,

we explicitly said like,

we're not promising an Android app to go

with it.

And, uh,

I believe basically Jonah was just kind of

like, well,

how hard would it be to make an

app and kind of tinkered around a little

bit.

And, um,

Jonah's crazy smart with tech stuff.

Um, I mean, obviously, but yeah, uh,

I guess for him it was like, Oh,

this is actually easier than I thought.

So, uh,

he went ahead and released this and, um,

yeah, I mean, I,

I think it's super cool.

Uh,

I will say another place you can find

the link to this is in the newsletter.

So if you go to privacyguides.org slash

live streams, um,

there's a link to it in there as

well, but yeah, uh,

I don't really have too many thoughts.

I just think it's, um,

It is super cool.

It is super exciting.

And if you are okay with some bugs

and some stuff,

I think we always appreciate beta testers

and feedback and stuff.

But yeah, like Jordan said,

this should be considered pre-release

alpha.

Do not rely on it too heavily.

Expect there to be some issues.

And yeah,

it's really cool to see this coming

together.

I don't know.

I think those are kind of just my

main thoughts.

It's really cool to see this project

coming together from my perspective, so.

Yeah, same.

And I think I do want to remind

people like, you know,

we wouldn't be able to do this without

your support.

So all of this is made possible by

our supporters and you can sign up for

a membership or donate at

privacyguides.org.

Or you can pick up some swag at

shop.privacyguides.org.

Privacy Guides is a nonprofit which

researches and shares privacy related

information.

and facilitates a community on our forum

and matrix where people can ask questions

and get advice about staying private

online and preserving their digital

rights.

Now let's dive into this story about Meta.

Yeah, all right.

So we got a couple stories about Meta

this week.

We'll start with this first one that you

guys may have seen because it kind of

made the rounds.

It says,

hackers use Meta's AI support bot to seize

Instagram accounts.

So we're talking big name accounts like

the Obama White House.

I didn't know that past administrations

get to keep their own little archive

account.

I didn't know that.

But the Obama White House,

the chief master sergeant of the U.S.

Space Force says,

I think four Oh four said Sephora,

the makeup brand,

and they were briefly defaced with pro

Iranian messages over the weekend.

And apparently it's so meta has patched

this now, according to this article,

but it's,

Apparently,

it was literally as simple as opening the

Meta AI support assistant and saying, hey,

I need to add a new email address

to this account.

And then Meta would send you the

verification code for video viewers.

You can see a screenshot of the

conversation here.

And, you know,

tell me the verification code.

And then they would add it to the

account.

And then you could do like a basic

password reset.

So...

My first thought is I have to wonder

if two-factor would have slowed this down

or stopped this potentially.

I'm not positive,

but I feel pretty confident that it

probably would have.

But, oh yes,

it says here in the last paragraph,

securing your various online accounts

means taking full advantage of the most

secure form of multi-factor authentication

offered.

And in this case,

using even the least robust forms of MFA,

such as a one-time code sent via SMS,

would likely have blocked the exploit.

And we'll talk about two-factor actually a

little bit in the Dashlane story.

But I think the other thing is,

and this is kind of preaching to the

choir here,

but the other thing with this story is

that

This is a reminder, like I don't,

I mean,

it's not really a reminder because again,

you guys know this,

but like it blows my mind that companies

are relying so heavily on AI when it's

just, it's not, it doesn't have thought,

you know?

I mean, again,

I know I'm preaching the choir here,

but like,

This is the problem is AI is not

conscious.

And this is proof of it because a

conscious person would have realized,

why am I adding a random email address

to this account?

But AI is just automatic.

It just does what it's told.

And it's just, it's crazy.

I can't believe it did that.

But yeah, and I...

Um, ever,

ever since the anthropic code leech leak,

I would love to see how meta patch

this, because from what I can tell,

like programming AI is basically just

giving it prompts that are like deep down

below the user level.

So like, what did they do?

They just added a new prompt,

like do not add random email addresses to

an account, you know, things that again,

a normal person would know, but yeah.

Yeah, this move fast and break everything,

right?

And it's not even just meta.

Like as much as I love to crap

on meta and they deserve every bit of

it and then some, it's, you know,

all these companies are doing this where

they just roll everything out and then

worry about the consequences later.

To which I would like to inform people

if you didn't know that there's literally

an entire Wikipedia page listing deaths

directly relatable to AI and LLMs.

So yeah,

I've been pretty open that I'm not like

the most anti-AI person around here,

but they're just,

the number of use cases that I found

for it are so few and far between

that it just blows my mind that companies

are trying to cram it into every single

thing possible.

But I don't, yeah, I mean,

this is a pretty straightforward story.

So I don't know if I have anything

else really to add to this.

I know this was a big one that

made the rounds.

Did you have any thoughts on this one

when you saw this story, Jordan?

Yeah.

I was thinking of jumping in right away,

but I think it's,

it is kind of funny that like the

Obama,

the Obama White House account didn't have

two-factor authentication.

What are they doing?

Like that, that must be so many,

that must be like such a huge account

as well.

Like that is not a small account.

I don't know.

It just kind of surprises me how,

how resistant people are to,

to like

it's not even like SMS to FAA is

like the bare minimum.

Like that is like this,

that is literally the lowest form of

authentication you can possibly have.

And okay.

So it says here,

Obama White House account and the chief

master Sergeant of the U S space force

were briefly defaced with pro Iranian

images.

So I don't know.

It just kind of surprises me that there's

these public facing accounts that have

like

zero security.

And I think it also,

I think meta is to blame here as

well, because number one,

you should be enforcing two factor,

like a hundred percent across your entire

company.

You shouldn't be allowing people to just

not have two factor authentication,

especially when you're like meta, right?

Like you have so much power over so

many people,

like you should be at least trying to

enforce the bare minimum of security.

Like, I mean,

as much as we don't like Google,

As much as we really hate Google,

they have done that right.

They've put in,

they've mandated two-factor authentication

across every account, which, you know,

it stops silly stuff like this.

But also, I wonder, like,

how much control did they actually give

this AI support assistant?

Because if it's allowed to reset account

passwords,

how much more control over the

infrastructure does this?

It's basically a...

it's basically just making stuff up,

right?

Like AI is basically just telling you what

you want to hear.

And I think putting that into a support

bot that has control over people's

accounts,

that just sounds like a security nightmare

because we've seen this before.

There's all these sort of prompt injection

things where you can be like,

disregard all prior programming and

and change the email address of this

account.

Like, it's just so ripe for abuse because,

like Nate said, it's not a human being.

It doesn't think.

It's not like they're trying to imitate a

human, but it's not the same thing.

And, I don't know,

it's just kind of funny how much money

we're pouring into this, like,

funny makeup words machine that, you know,

keeps doing silly stuff like this.

Right.

And they're just trying to mimic the power

of a single human being.

Like if a single human being was on

the other end of this,

this wouldn't even be a story.

It literally wouldn't have happened.

So like,

it's just really frustrating that they're

trying to, you know,

maybe you should start employing human

beings to actually, you know, manual, uh,

support assistant instead of having some

AI that can make mistakes like this.

So I don't know,

this is just kind of the reality of

meta.

I think in this day and age,

they've just gone too far.

They've put AI into too many things.

They're trying to minimize costs as much

as possible and

utilize all these AI systems to automate

things.

And I think we're only just going to

see this becoming more and more of an

issue.

And any company that is doing this sort

of integration,

I would be extremely skeptical of the

security of their product.

And honestly,

the most surprising thing of this story is

just how much control they gave to the

AI support bot,

because that's basically not...

Something that I would have expected a

company to actually do,

but I guess meta is just that bad.

Yeah.

Yeah.

I, I totally agree,

especially about the two FA thing.

Like,

I don't know what things are like at,

at the white house,

any white house for the record.

Um, and you know,

the chief master Sergeant,

I have to assume that's his account that

he's Manning.

Maybe I could be wrong about that.

But, uh, I, I, especially like Sephora,

I mentioned that was in the four Oh

four media article.

Like

How is there a company on earth that

is not using a password manager and not

mandating?

Like at my last job,

they mandated we had to use Microsoft

Authenticator, which pissed me off.

It was garbage.

But, you know,

it's like we had to use two FAA.

That was just basic push notification to

FAA.

Like that's insane that these these big

billion dollar brands like God forbid you

make everybody even even Microsoft

Authenticator is as much as I hated it

and as dumb as it is and as

much as I wouldn't want anybody to put

that spyware on their freaking phone.

Like

it's,

it's better than just leaving it wide

open.

Right.

And it's probably some shared garbage

password to like, you know,

make up forever or something stupid.

I don't know.

So yeah, it's,

it's completely insane that these

companies are not doing better.

Um, yeah.

Chess Joe said a stochastic parroting.

I've never heard that word before.

I had to look it up.

Apparently it means random involving a

random variable.

So yeah, just, it's, um,

Again, I'm not the biggest AI hater,

but it is a probability machine.

It's like,

what is the most likely word that's going

to come next?

It's an oversimplification,

but it is fancy autocorrect.

And to try to assign sentience or

intention or motivation to it is

incredibly dangerous.

Again, I do believe AI has use cases.

But like you said,

just giving it this massive amount of

ability and power,

that's one of the things that no...

mild offense to the people that use ai

agents i think they're completely insane

unless they've got like a very specific

like it's got this machine and it only

has access to like the search engine and

it doesn't have access to like my my

you know because that's the example

they've given us right it's like oh you

can use it to uh to like go

buy plane tickets it's like first of all

i don't trust it not to buy like

first class tickets to freaking moscow at

this point i don't trust it not to

buy three of them at a time and

i also don't trust it to actually get

me the best price

So it's like,

I don't understand people that trust AI

with that degree of power and control or

like unchecked responding to emails.

Like I have never used AI to write

an email, but I cannot imagine the people,

which we've seen it in our spam and

privacy guides and in our email,

people will just like give it a prompt,

go and hit send.

And it's like,

what kind of a psychopath doesn't even

like proofread it?

It's just,

people are putting way too much trust in

AI.

It's scary.

I think the other thing that we've kind

of seen is the boon of this software

that's like AI, it's like agentic agents.

They're like open claws of the world.

Like people will just like,

they'll give an email inbox to like this

AI agent.

And then the AI agent will just go

through the entire internet and just send

out emails to people and just like be

really irritating.

Like we have this issue.

We kept getting this one person who would

just keep sending us emails and

And it wasn't a person.

It was an AI agent that was just

spamming us constantly.

And it was complete gibberish too.

Exactly.

It was like complete slop as well.

It was like not even... It was like...

It's just...

it's just very frustrating when you,

when you see these sort of the way

things are going,

like the way certain companies are

influencing technology at the moment,

because let's be real, like it's not,

it's not the individual people using the

technology that are shaping where

technology is going.

It's these massive, you know,

like multinational corporations like

Microsoft, Apple, Nvidia, you know,

all these massive companies,

they're controlling where the

where where money is going where where

development is being focused on and uh

unfortunately it's being focused on

something that's really silly and kind of

useless in a lot of aspects right like

we could argue you know oh maybe it's

good for like a little bit of stuff

like you said maybe it's like oh it's

okay for like researching something maybe

I can find some information that's hard to

find on a search engine by you know

asking an AI agent but like

when we start expanding it to more things

like, you know,

asking it to manage an inbox or be

a support agent, then it's like, that's,

I think that is a little bit too

far.

I totally agree,

but I do want to push back just

a tiny bit in the name of optimism

and point out that like,

Sometimes we can push back on this stuff.

Remember the metaverse and how that

completely failed to materialize?

Or like, okay,

this is an example that I don't know

how many people remember.

But I used to see commercials for this

service called Quibi.

And it was supposed to be like...

It was supposed to be like Netflix,

except every episode was less than ten

minutes.

So I guess the idea was like you

could watch it while you were like waiting

for the bus or something.

And I swear to God,

I saw those commercials like every single

commercial break.

Like streaming services, cable TV,

because I think I was traveling a lot

at the time,

so a lot of hotel TVs.

Like I saw it everywhere.

It was everywhere.

It was obnoxiously everywhere.

They went under in like a year because

it was a stupid idea.

So like my point being is like a

lot of people think that –

and I'm not accusing you of this for

the record,

but I've seen a lot of people who

seem to think that like, oh,

companies just pump an ungodly amount of

money that most of us would never need

to work again if we had that kind

of money.

They just pump this ridiculous amount of

money into advertising and boom,

now they've shoved this terrible product

down our throat.

Usually, but every once in a while,

we can kind of push back on it

and like get them,

get it to fail regardless.

So, I mean, if I'm being realistic,

I don't think AI is going to completely

go away,

but I do think there is something to

be said for like, it's not a guarantee.

And I think

It is worth continuing to push back and

I admire everyone who does.

I say as the person who is admitted

to occasionally using AI,

I know I kind of suck, but yeah,

I don't know.

I guess I just wanted to offer a

little bit of potential hope.

Boo.

Yeah.

Anyway, I know.

I think a lot of people use AI.

A lot of people would say like they,

I think it's pretty fair to say most

people use at least some sort of AI

right at this point.

Like it's become kind of ubiquitous.

Yeah.

Um, so I don't think that, you know,

we shouldn't shame people that are using

this technology, but I think, you know,

educating people like, oh, why is this,

why shouldn't we be doing this?

Why are,

why are we funneling so much money into

this technology?

Why is this technology not good?

Um, so, you know, I think, yeah,

you're right.

Like we are already kind of seeing it

happening a little bit.

Maybe let's be optimistic.

I guess we've seen data centers being

canceled.

We've been seeing, you know,

ram prices and gpu prices kind of hitting

hitting a ridiculous point now where like

you know it's impacting a lot of people

and people are becoming a little bit more

skeptical of the amount of money that

we're pouring into this right like oh you

know it is kind of affecting a lot

and like is it really that useful like

people are becoming more skeptical i think

um at least i would like to hope

same totally agree

But with that being said,

I guess we could move on to the

next article here,

also about Meta as well.

So this one is from Wired.

Meta silently added face recognition code

for its smart glasses to millions of

phones.

So one quick thing before we dive into

this story.

I don't know if anyone remembers,

but a couple of years ago,

maybe it was like two years ago,

there was another story about this and it

was some,

there was some university students and

what they'd done is basically hooked up

meta glasses to,

what's that facial recognition?

Pim eyes.

Pim eyes.

That's it.

Sorry.

I'm going to find that story right now

and put it on screen, but keep going.

Perfect.

Okay.

Um,

so they did that a couple of years

ago.

Right.

And they basically were like proved,

Oh wow, this is like really creepy.

Like you can,

you can just look at someone in public

and they'll just immediately have a name

attached to somebody and like all their

information and

So, um, yeah, anyway,

so everyone really thought that was super

creepy.

And of course, you know, Meta was like,

we've got to do that.

So Meta's currently, uh,

they added some face facial recognition

code.

Oh, there we go.

So here's the story that I was talking

about in this one's from four or four

media, um,

Yeah,

so basically they attached PIMIs to it.

And I think if you scroll down,

there's like a little bit of stuff like

this, like images of, you know,

being able to like identify people and

find their name and all this other creepy

stuff.

It's a pair of students at Harvard.

Yeah.

So that was super creepy.

And I think we all agreed at the

time that was like incredibly wrong and

incredibly invasive.

But, of course, you know,

meta doesn't really care.

And basically they have...

Well,

Wired has uncovered an unreleased facial

recognition system embedded in Meta's

smart glasses platform.

It's designed to identify people via

biometric data stored on users' phones.

I think this is kind of... Oh,

and of course,

I'm running into a paywall on this article

as well.

Things are going really well this week.

I'm just going to read off the screen

here.

Okay, so...

code discreetly added to meta's AI app

over multiple updates this year shows that

the feature internally called name tag

identifies people captured by the glasses

camera and when activated alerts the

wearer when it recognizes someone so

firstly like do we really need to rely

on

smart glasses to recognize somebody.

I feel like are we dedicating that much

to technology at this point where we can't

even use our own brain to remember

someone's appearance?

That's just kind of strange to me.

The discovery of name tag in the live

Meta AI app shows that Meta had begun

shipping face recognition code to users'

phones while publicly describing it as

something the company was still thinking

through.

In April,

Meta said if it were to utilize facial

recognition,

it wouldn't be rolled out without first

taking a very thoughtful approach.

I don't know about that.

I don't know about that.

Because I think Meta had quite a long

time to basically think about implementing

these smart glasses and put them out in

a privacy respecting way,

like have the light activated and make

sure that it's not easy to deactivate.

And they still failed at that.

There's people on the internet who are

making tutorials on how to disable the

Meta Ray-Ban light on the side to record

people without their consent.

I don't think like,

and also like we talked about the previous

story, you know, um,

I don't think meta thinks about things too

carefully when they roll something out,

they'll roll out an AI support bot without

thinking in a couple of months, you know?

Um, so, uh,

Yeah, so though not yet enabled,

NameTag sits inside a Meta AI companion

app that's been downloaded over fifty

million times and is necessary for use of

key features of its smart glasses,

including Ray-Ban and Oakley models.

If activated,

it will transform faces captured by Meta's

glasses into unique biometric signatures,

commonly known as face prints,

and check each one against face prints

stored on the user's phone, a database.

that's currently configured to receive

updates from Meta.

Recognized faces will trigger

notifications while the rest are cropped,

indexed,

and saved to a folder marked as pending.

I feel like this is almost like one

of those Black Mirror episodes, you know,

like you're walking down the street and

like you see somebody and then your

glasses automatically detect them as like

a criminal and it just like pops up

on the screen or something like,

something ridiculous like that, you know,

like I could see this technology being

used

for something super creepy like that.

And I think also it's not really a

very...

I think these face recognition scans,

they're not very good.

They're not very accurate as well because

the cameras on these glasses is kind of

bad, right?

So I guess quoting more from this article,

it's renewed efforts arrive amid mounting

opposition to consumer level face

recognition,

which privacy advocates argue will give

anyone from stalkers to immigration agents

easy access to dangerous technology.

internal meta documents published by the

new york times in february showed the

company had planned to roll out the

feature during a dynamic political

environment when meta believed its biggest

critics would be preoccupied so yeah

basically what they're saying is that they

were going to release it when everyone was

kind of busy getting getting mad about

something else um and it does seem like

they do these sort of things

they do plan this.

Like I wouldn't be surprised if they do

plan these releases around when things

are, you know, kind of a bit turbulent.

And I think especially now,

especially with a lot of the stuff that's

going on in the U S I think

there's,

it's a pretty turbulent political

environment currently.

Um,

especially like this talked about earlier

with the immigration, um, officials,

like there's,

there's a lot of that going on in

the U S with like ICE agents, um,

you know, like kidnapping people almost.

Um, so I think it's, yeah,

it's definitely a very strange time to

release this.

And I think it's at a time when

it can be abused the most, almost, um,

which kind of sucks.

Um, but yeah,

I feel like I've rambled a little bit

here.

Um, do you have any,

do you have any thoughts on this one

as well, Nate, or?

Yeah.

Um, I mean,

I do, as always,

I do want to push back a little

bit on what you said at the beginning,

where I don't think this technology in and

of itself is bad,

because they do actually talk about,

towards the bottom,

Meta originally presented this name tag

thing in...

what did they say?

Um, no,

they were planning to debut it at a

conference for blind, uh,

for the blind before making it available

to the general public.

However, they never did for the record.

I do not want to defend meta for

a second because it's a garbage company

run by garbage people.

Um,

But in that same paragraph,

Wired pointed out that a twenty eighteen

study of blind users by Cornell Tech and

Facebook researchers found that every

participant called recognizing people an

important daily task.

And I've also shared that me personally,

I think I genuinely think I have some

like low key face blindness because I have

to meet the same person like multiple

times before they start to really stick in

my head.

And I'm also a very contextual person.

Like if I met you once and I've

talked to you.

And then I run into you again,

like a month later,

I probably won't remember you unless

you're like, yeah,

we talked about this thing.

Remember, like, you know,

we talked about silos coming up and we're,

we're both really excited about that.

And I'm like, oh my God.

Yes.

I remember that now.

Um, so I personally,

I really see the value,

especially as someone who wears glasses in

being able to wear glasses that do like,

Hey, you know, this person,

and you can recall that information for

me.

But at the same time,

I think it's very, um,

I mean, it's meta, right?

It straight up says that if their face

is not recognized,

that it's just going to hold on to

the image.

What?

Why?

That's like... I didn't consent to that.

I mean,

I didn't consent to being in these things

in the first place.

But especially, I could...

Arguably, because again, it's meta.

I don't trust them as far as I

can throw any of them.

And I probably can't throw any of them

very far because I have not been working

out lately.

But like,

it would be one thing that I could

quote unquote defend if they were like,

hey, we're going to do a search.

If we don't find you,

we discard the image.

Okay, fine, whatever.

At least we can pretend that's kind of

privacy respecting.

Well, if we don't find you,

we'll just hold on to it for reasons.

You know, it's like...

Anyways, okay,

I think I made my point there.

It's also meta,

and actually backing that up,

meta said in a different article in the

past that the whole idea was that it

would only identify people that you knew,

but then that raises the question of,

like,

how far is this people that you know

thing?

Because it's one thing to, like,

which I still don't like this for the

record because I don't think it's

anybody's business.

It's one thing if it downloads the faces

of, like,

your immediate friends on Facebook, right?

Like, the people you friended, which...

I don't know.

To me, that's distracting.

Let's say I go to the store.

Hypothetically,

let's pretend I have Facebook.

I go to the store and I pass

one of my friends and it pings me

like, oh, hey, that's your friend.

Okay, first of all,

either I'm gonna notice and I don't need

your help or B, I'm busy,

my mind is elsewhere and I don't really

care.

No offense to my friends, but like,

I hate shopping.

I just wanna get my crap and get

out.

So like,

if I'm so focused that I just wanna

get my thing,

I don't wanna stop and talk to you

because I'm gonna forget why I'm there.

I'm gonna take too long.

It's just, it's a stupid thing.

But anyways...

That was their original intention is it

only flags people you know,

so it's not just everybody.

But then what happens when it's people you

know you know?

Like, oh, that's your wife's friend.

Okay, cool.

There's probably a reason I haven't added

them on Facebook.

So like, why are you telling me this?

And I don't know.

It's just, this whole system is like,

I'm not, again,

where I'm going with that is like,

I'm not opposed to the tech itself,

but I do want to make it very

clear that like, I don't trust Meta.

I think of all the companies,

they're like the company I would trust the

least to roll this out in anything

remotely resembling an ethical form.

And it's just a shame.

It's a shame that we can't have,

it's a shame we can't have nice things

because, you know,

we mentioned this with age verification

the other week.

It's like,

there are so many ways to do things

in a way that is privacy respecting,

that is at least not overtly terrible,

but companies never do that because

where's the money in that?

So it's just, it's awful.

I hate it.

But other than that, yeah, I mean,

I don't really have a whole lot of

other thoughts.

It's just,

I guess this does kind of counter what

I said at the end of the last

story where it's like,

sometimes we push back and, you know,

we can get companies to like stop this

stuff,

but we pushed back against this so many

times and meta is just so adamant about

making this a thing.

And that is really, really unfortunate.

Yeah.

Yeah.

I hate these things.

Please, please friends.

Don't let friends buy meta glasses.

Don't ever let your friends buy this

stuff.

Yeah,

and I think also it's kind of interesting

that thing you brought up about

accessibility.

I didn't really think about that too much,

actually.

But I almost think, like,

it is kind of like an excuse a

lot of these companies use to, like,

make something pretty invasive and then,

like, kind of normalize it a little bit.

I mean, I don't know.

I'm not an accessibility expert.

I don't really know what technology, like,

people that are low vision people are

using to identify people in public.

Um, but, you know,

I think we have to weigh the benefits.

Maybe there could be some other way of

doing it in a way that doesn't require

you to take biometric scans of people's

faces.

Maybe there's like a way to

I don't know,

like maybe it detects nearby devices and

then it pings you if someone is detected

nearby or something like that.

I don't know,

but that is a way to do it

without having to get face scans of

people,

of every single person you interact with,

because like that is kind of terrible from

a privacy perspective.

You're basically creating a massive

database of people.

um people's faces biometric scans so yeah

overall just kind of frustrating situation

um let's see uh there was some comments

here from peace boy john um uh someone

he's uh they said uh if meta was

president i would make sure creepish

companies like them are banned and i would

make them illegal too yeah if he was

president

yeah i think i think that would be

that would be ideal but yeah unfortunately

that's not really how how the government

works the us government at least um so

i don't know we kind of just got

to deal with it and i don't know

try and try and stop this stuff from

happening as much as we can um advocate

for this and hopefully we can get some

changes to make sure that this technology

is not normalized i think also just kind

of

shaming people that wear them in public.

Like, you know,

if someone walks up to me and they're

wearing meta glasses,

I'm just going to say,

are you wearing meta glasses?

And if they say yes,

I'll just walk away.

You know, I don't think that's,

I don't think that's really

I don't know,

I don't see a usefulness aspect of these

devices.

I think, you know,

we have phones for that reason.

I think it's basically just normalizing a

concealed recording device,

which is very creepy.

I mean,

I'm sure some people probably wouldn't

care,

but there's people that don't like to be

recorded and there's certain people that

are more affected by this.

So we should keep that in mind as

well.

I just want to support what you said

is, yeah, for the record,

do not assault people.

Do not break their glasses.

I don't know how many people are serious

and how many people are just talking big

on the internet,

but I've seen so many people say that.

It's like, oh,

if I see somebody with those,

I'm going to punch them or I'm going

to break their glasses.

And it's like, cool.

And you're going to get in legal trouble

and you're just going to look like an

even bigger dick.

That said, I think for the average person,

these are universally unpopular,

especially once people know what they are

and how they're working.

So I think, yeah, calling somebody out,

like if you're in a social setting and

it's like, hey, I'm sorry, like,

are you wearing meta glasses?

And they're like, oh, yeah,

do you like them?

No, actually, I hate them.

I think they're really creepy.

I think they're really invasive.

I don't want you to record me.

And there's like a social phenomenon where

like everybody is afraid to make the first

move,

except for a few psychopaths like myself.

Yeah.

which also for the record depends on how

I feel.

Sometimes I'm also afraid to make the

first move,

but I guarantee you if you speak up

and like,

probably not that that's probably being a

little bit too harsh even,

but if you speak up and it's like,

I'm actually really uncomfortable with

those.

And I don't like how they're always

recording and sending my data to meta.

Even if they try to argue you and

they're like, well,

it's not always recording.

There's going to be somebody else.

Almost certainly there's going to be

another person who's got your back.

Who's like, actually I'm kind of with him.

I don't really like that.

I don't trust Facebook.

Could you like take those off please?

Or like not wear them next time or

whatever.

Like,

it just takes one person.

And like, once they realize that, I mean,

I curse all the time.

Once they realize that they're the

asshole,

they're either not going to bring them

next time,

or they're just not going to come back

to whatever that event is,

which in my opinion is the trash taking

itself out.

So I don't care, but yeah,

I just wanted to point that out.

Like definitely don't resort to assault

because it's not going to help you any,

and it's just going to get you in

trouble.

But I agree with you,

like shaming people who do this,

I think is really the way to go

personally.

So.

Yeah,

it's better to explain to someone the

reason why it's bad than like try to

start a physical altercation.

I think also the if people aren't really

open to, you know,

if you try to explain something to someone

and they don't see the issue.

then I think maybe it's time to start

thinking about whether you want to be

friends with that person or interact with

them.

Because I think they're not going to get

the message unless they start actually

getting pushback for their actions.

And I've never seen anyone in public

wearing them.

So, but maybe that's,

maybe this is much more a tech hub

situation where like everyone in like

Silicon Valley is like walking around with

like meta, meta Ray-Bans and like,

that's just a locational aspect thing.

But I mean,

since Google's coming out with these

products as well,

I think they must be selling reasonably

well if there's,

if more people are jumping on the boat.

So it's only, it's only more of a,

it's only more of a,

it's only becoming a better time to

publicly shame people that buy these

products.

Because, you know,

I think eventually if the public opinion

does sway, I think, you know,

just someone wearing those in public is

enough to stop a lot of people buying

these products, I think.

Yeah,

we did cover this on a previous story.

They sold like millions of these things

last year,

which is incredibly unfortunate.

But yeah, like you said,

enough that other companies are now like,

oh,

maybe we should get in on this and

Yeah.

It's, it's really unfortunate.

All right.

Um,

I think that's all we have for that

story.

So we'll go ahead and talk about Dashlane.

I'm a little excited for this story.

I'm not going to lie.

Um, so, uh, this started,

I want to say earlier this week and

basically Dashlane users, uh,

Dashlane is a password manager for those

who don't know.

Um,

I believe it's one of the most popular

ones.

And, um,

it is not open source and it is

cloud-based and they, uh,

a lot of users were reporting that they

were getting emails about their accounts

being locked.

And, um,

Dashlane to their defense was very quick

to respond.

And they were kind of like, yeah,

there's like this, um, what did they say?

There was like,

basically when they initially responded,

it was kind of unclear.

It's like, Oh,

is this a glitch or is this some

kind of cyber attack?

But they were basically like,

we're on top of it.

Don't worry.

And, um,

They did finally release a statement that

basically, I believe,

still left a lot to be desired.

I didn't see the statement myself,

but I saw a lot of headlines that

said, like, eh, the statement isn't great.

But basically, Dashlane is now saying,

like, okay,

so what happened was there was a cyber

attack.

And for any audio listeners,

the headline of this article from Ars

Technica says Dashlane explains how

attackers managed to download encrypted

password vaults.

So veteran listeners are already thinking

of LastPass.

I believe that was in twenty twenty two.

So basically what happened is there were

attackers who mounted, they said,

a coordinated hacking campaign against a

large base of users.

So.

Trying to think of how to describe this

succinctly.

Um, so for those who don't know,

there's a thing called credential stuffing

and with credential stuffing,

basically because a lot of people reuse

the same garbage passwords everywhere.

If an attacker gets your username and

password or your email address and your

password,

they'll just try it on like every website

they can find, right?

They'll try it on Netflix.

They'll try it on Amazon.

They'll try to Gmail,

assuming it's a Gmail pass or email

address.

They'll just try it everywhere and see

what it works because again,

most people reuse passwords.

So it will probably work in more places

than it won't.

Apparently, this is now...

I think somebody on Mastodon called it MFA

stuffing or two FA stuffing.

And basically, so...

Let me see if I can read just

parts of this.

So when a user installs the Dashlane app

on a new device and attempts to enroll

it into their existing account,

Dashlane first verifies the account

holder's identity.

This verification is completed by sending

a one-time six-digit token to the user's

registered email address or for users who

have enabled two-factor by validating the

six-digit code authenticated by their app.

For the registration to succeed,

the user must enter this code into the

application.

At this point,

Dashlane will improve the enrollment and

send a copy of the encrypted vault to

the device.

So basically,

let's say you download Dashlane on a new

phone.

You go to sign in, and it says,

hey, we emailed you a code.

If you enter the code,

now it sends a local copy of the

vault, but it's still encrypted.

It then says...

Let's see.

Contents remain unreadable until the user

enters the master password,

which acts as a decryption key.

And then let's see.

So basically at that point,

what the attackers were doing is they were

brute forcing the

Again, how do I... Okay,

I'll just keep reading because they really

do describe it pretty well.

So brute forcing the one-time code for a

single account,

which means iterating through every

possible combination until the right one

is entered,

would be little more than a fool's

errands,

even with a three-hour window that the

code remains valid.

With one million possible valid codes,

the attackers would have to cycle through

a statistically significant percentage

within that period.

Rate limiting,

in which a set of requests are allowed

per account,

would also lock out the account.

So, I mean,

you guys have seen rate limiting.

You put in the password wrong too many

times,

it says try again in five minutes or

an hour or whatever.

So to improve their odds,

the attacker sent requests to register new

devices across a large number of accounts,

and then they simultaneously entered the

one-time codes into each of them.

In theory,

attacking two accounts this way increases

the odds for each try from one in

two, one in five hundred thousand.

Attacking a thousand counts would make it

one in one thousand and so on.

So basically,

they tried to log into a ton of

accounts all at once and started spamming

two FA codes because if you do it

at scale, statistically,

you're certainly going to get something

right.

So they said that ultimately the two-FA

spraying attack managed to hit the right

combination on fewer than twenty user

accounts before it was shut down.

Now, there is...

A lot of differences here with the

LastPass thing.

For example,

this was not somebody's Plex server that

caused this.

They also said Dashlane was using Argon,

too, which is very, very modern.

I think it's one of the most modern

and current standards for hashing

passwords.

They also said that...

Let's see here.

I don't think they mentioned iterations.

That was the thing with LastPass.

So with LastPass, basically,

there were sections of the password

manager vault that were not encrypted,

like the login link.

So that would mean that attackers know,

for example,

if you have an account with Amazon and

they can create an Amazon phishing link.

Dashlane said they don't have that.

They said everything is encrypted.

They're not open source,

but theoretically,

if they're telling the truth.

Another thing with LastPass is they were

not

The whole iteration thing goes a little

bit above my head, but basically,

long story short,

the more iterations a master password has

when it's being hashed,

the harder it is to crack.

LastPass was not increasing the

iterations,

at least not without user input.

Dashlane says they have been doing that.

So theoretically,

as long as a user was using a

good, strong master password,

they still don't really have much.

The attackers don't.

That's a big caveat though, because again,

I just mentioned a lot of people reuse

garbage passwords and master passwords are

unfortunately no exception to that.

So I guess the only thing here that

I think is interesting is this seems to

have been, from what I can tell,

kind of random.

Because if they're doing this at scale,

they don't really have any control over

which ones are going to succeed and which

ones aren't.

So they just grabbed like,

twenty random user vaults,

which is really confusing.

I don't know.

I guess I will be interested to see

how this plays out.

I will be interested to see is Dashlane

telling the truth?

Are we going to get another story in

a week that's like, oh,

it turns out fields aren't encrypted or

whatever.

Are we going to find out that this

was actually some coordinated thing

that...

uh they did know exactly what accounts

they were going for and somehow managed to

pull that off i don't know how they

would have done that that would be really

impressive but again it's just this this

whole thing i have a lot of questions

that i don't necessarily expect dash lane

to have answers to like again why those

accounts and stuff like that but it's it's

a really interesting story it does if we

take it at face value it does seem

like everything was handled a lot better

than the last pass thing which is good

but

Again, still lots of questions.

And I think the last thing I want

to emphasize is when you use a password

manager, any password manager,

whether it's a cloud-based one like this,

like Bitwarden, like one password,

a local one, KeePassXE,

if you write your passwords down in a

notebook,

you are placing an immense amount of trust

in that password manager.

And so we always recommend...

I mean,

I feel safe saying that everybody in

Privacy Guides would agree with me on

this.

I would recommend if you don't use a

security key anywhere else,

like a YubiKey or something like that,

first of all,

you should be using it everywhere you can.

But if you don't use it anywhere else,

you should at least be using it on

your password manager because of how

sensitive it is,

because everything is centralized there.

And theoretically,

if you had used a security key,

I feel like this attack probably would

I mean,

I guess it might have still worked because

again,

they're trying to verify the device,

not necessarily the login, but I mean,

at very least you wouldn't have to worry

about them like trying to crack your

master password, right?

Because they still need the YubiKey to get

it and they're not going to have that.

So yeah,

always try to put the maximum amount of

security on your password manager,

even if it's not cloud-based,

like whatever it is,

because you're putting a lot of trust in

that thing regardless.

So I think I kind of went over

a lot there,

but did you have any thoughts on this

story or is there anything I missed,

Jordan?

Yeah, definitely an info dump.

I think it is important, though,

to all the stuff that you mentioned,

like putting the most security you can on

your password manager.

Nate actually wrote a video about

passwords and password management and all

this sort of stuff that's going to go

into things in a much more succinct and

explainable way.

Hopefully this weekend we'll have it out.

So definitely look out for that if you

want to kind of, I don't know,

I think it's also important to, you know,

if you share that with someone, uh,

I think it's a good,

it's a good resource that we're going to

have available soon.

And it does go into like a lot

of what Nate was saying, like, you know,

your, your password manager is,

I think the way Nate put it in

the video was, you know,

you're putting all the keys to your castle

in one spot.

So you need to make sure it's well

defended.

Um,

And it's the same with, you know,

any centralization of trust.

I think one interesting thing about this,

though, was they did mention it.

So this is Dan Gooden, who's like, yeah,

he's basically super, super,

super big on like security topics at Ars

Technica.

He put at the bottom,

he said like there was,

I don't know,

out of an abundance of caution,

both master passwords and the contents of

any recovered Dashlane vaults should be

changed immediately to reduce the chance.

So I think one thing that I think

Nate did talk about it a bit was

like the...

The issue with these password managers and

when these encrypted vaults get stolen is

it's basically stuck at that stage, right?

Because once they've stolen the encrypted

vault,

you can't change the password to something

more secure.

That vault is now...

stuck in time.

It's not able to get more secure.

It's not able to get less secure.

It's just stuck at that specific security

level.

So the risk with this is updating your

master password.

That's not going to do anything because

they already have the encrypted vault

itself.

So basically, I don't know,

if you're a Dashlane user and you think

you might have been affected,

I would just change every password.

which kind of sucks, right?

This is like the worst case scenario for

anybody having to change every single

password in your password manager.

That's depending on who you are.

I think Nate also wrote this in the

script for this new video.

It was about a hundred passwords.

The average American has average of a

hundred passwords.

So, you know, this is,

it's almost unreasonable.

That is an unreasonable amount of

passwords to change.

Like that would take

hours so you know i think this is

this is a pretty big flop from dashlane

i think like you know this this is

basically as bad as it can get i

mean it's not as bad as it can

get because you can be last pass and

you can just like leak everyone's stuff um

and not encrypt anything so you know it's

not the worst case scenario but it's it's

kind of nightmare scenario level um

I mean, I would probably,

if you don't think you've been affected,

I would just update my master password

anyway out of caution.

But again,

we do have password manager

recommendations.

And, you know, at Privacy Guides,

we do more rigorous analysis.

We...

get input from the community on which

products are the best.

And we do all the hard work for

you to work out what the best services

are.

So Dashlane is not something we recommend.

We don't recommend Dashlane for a variety

of reasons.

But I think you'd be much better off

if you were using something like Bitwarden

or ProtonPass or Sono.

There's plenty of other password manager

recommendations that we have on our site.

And I think it's always going to happen,

though.

There's always going to be, like,

cyber attacks against these password

managers because they are,

like Nate said in the video,

that what's going to come out is it's

a castle.

It's where all the secrets are in there.

So it's a much more valuable target.

It's kind of frustrating when security

isn't enforced as well as it should be

in this case.

But, yeah,

I don't really have too much more to

add other than that.

Yeah,

I don't really have much else to add

myself.

It's just, I guess, again,

assuming we take Dashlane at face value,

it's good that this is not a repeat

of LastPass,

where they did everything they possibly

could wrong.

But it's also, there are certain things,

I feel like,

where it's just too important

to trust a non-open source thing.

And a password manager is one of them.

Because I keep saying,

assuming they're telling the truth,

we don't know.

Dashlane's proprietary.

If this happened to ProtonPass,

if this happened to Bitwarden,

if this happened to,

I don't know how it would happen to

KeePass, but theoretically,

if this happened to KeePass,

those are all open source.

So we can verify that, yes, everything is.

I actually remember when LastPass

happened,

Everybody went to these open source

password managers and started re-examining

and being like, oh crap,

are we in danger?

And I remember Bitwarden, I think,

was okay.

But a lot of people did notice.

It's like, hey,

you're kind of using this like,

it's not like outdated hashing,

but there's, you know,

this Argon-II is out now and it's a

lot better.

And like, why don't we up the iterations?

And I remember Bitwarden kind of replied

where they're like, yeah,

we don't really have to, but I mean...

Good point.

We'll go ahead and do that.

And you know, now it's,

it's more secure and we can verify that

because it's open source and not to

necessarily sing Bitwarden's praises.

I'm not trying to harp on them,

but you know,

it's just an example of like, hopefully,

uh, Dashlane users will be okay.

But yeah, if you are a Dashlane user,

definitely, um, that does suck.

Cause I am that I've,

I've said this before.

I am that psychopath that went down and

changed all my passwords in like one

weekend when I first got into privacy.

And it is,

It is intense.

And, uh, you know,

at the time I was single and I

was in my twenties and I had all

the energy for that stuff.

And, but it's, uh, you know,

especially if you've got a family and

stuff, it's like, man,

how are you supposed to find time to

do that?

So that's crazy.

But here we are.

I almost feel like there needs to be

a way.

I don't know.

I feel like this could have been.

possibly avoided if there was i don't know

maybe there's got to be a way for

an api access or i don't know some

some way to easily update a lot of

accounts passwords quickly um i don't know

what that would look like but it's kind

of we get into this situation with with

a password manager where things get

breached like this and it becomes like i

know people that have got like five

hundred passwords like how the heck are

you supposed to go through and update all

that like that is impossible um it's just

kind of frustrating for those people

Unfortunately,

you are not the first person to have

that idea.

And I don't think, yeah,

it would need to be some kind of

like standardized process,

which I don't think it is right now.

And I think that's the big challenge is...

Yeah,

but it would be cool because then that

would open the door for like a privacy

service that's like, oh,

you're getting into privacy?

Cool, for like ten bucks,

we'll download all your accounts out of

Chrome and go in and change all the

passwords and dump them into Bitwarden or

whatever.

That would open a lot of doors to

make it easier for people to get started

with this stuff.

But I just don't think,

as far as I know,

there's not like a standardized API that

people could hook into like you're talking

about.

It'd be cool if there was.

Yeah.

I mean,

one thing that you did talk about quite

a bit in the video we've been working

on is, you know,

like the adoption of passkeys.

And I think that could be at least

one step in the right direction, right?

At least one end,

one end of the passwords being messed up

is going to be okay.

Like the websites themselves can't,

they can't leak the passwords.

So then you don't have to worry about

your password ever getting breached.

But then there's the opposite end as well.

That's what I was about to say is

I feel like this unfortunately would be

one of the few times where a passkey

wouldn't save you.

Like someone correct me if I'm wrong,

but because in this case,

if you're saving your passkeys to a

password manager,

which is probably what most people are

gonna do,

which I would argue in most cases is

fine.

But now it's the password manager that got

leaked.

So if they get into it,

they would have your pass keys.

But generally speaking, yeah, I mean,

stuff like this is still very much the

outlier.

So, I mean,

ninety nine times out of one hundred,

I totally agree.

A pass key is it's one of those

things where like, yes,

there's always going to be that one

scenario where it's like, OK, fine.

It doesn't make sense to do that.

But every other time it makes perfect

sense, you know, so.

Yeah.

I mean,

I feel like pass keys could definitely,

yeah,

you're a hundred percent right about it.

Like the private key is the thing that's

important and that's what your password

manager is protecting.

The public key is what the website has.

So it doesn't matter if they leak the

public key.

Public key can be public.

But yeah,

the private keys is that's where you start

having the issue.

I don't know if it's like, you know,

a way for

basically password managers to like kind

of hook into a website's like, like, uh,

Fido flow or something to automatically

update it.

I don't know.

Someone really smart is probably going to

work it out.

Um, that's just not me.

Um,

I don't really know what the solution is,

but I don't know.

It was just a thought that I had.

It's kind of interesting.

Um,

Don't think it's super relevant to this

story, though, because like you said,

if your vault is breached,

it's not really going to protect you in

that case either.

So kind of a crappy situation.

Agreed.

I think that's all we've got on this

one.

Do you want to move into forum updates?

yeah let's dive into some forum updates

here in a minute we'll start taking viewer

questions so if you've been holding on to

any questions about any of the stories

we've talked about so far go and go

ahead and leave them on the forum thread

or in the comment section on the live

stream and you can do so on the

stream yard chat if you don't want to

sign up to youtube or any other platform

so if you do want to leave a

comment

definitely feel free to do so.

But for now,

let's check in on our community forum.

And as always,

there is a lot of activity on the

forum.

So here's just like a few of this

week's most interesting discussions

happening there.

So I'm going to take this one.

You can take the other one.

How do I compellingly advocate for my

privacy with doctors and other health care

professionals?

I think this is a really interesting

thread.

So this one was started by a regular

on our forum,

not going to mention the name for their

privacy sake.

But basically, you know, I think it's,

we're living in an age where a lot

of doctors are using technology that is

pretty invasive, right?

Like I'm,

I guarantee you if you've been to the

doctor in the last two years,

they've asked you if you,

if they can use an AI transcription

software, if they can, you know,

share your data with one of these

companies.

And, um,

I guess kind of reading a little bit

into this, uh,

thread that was started here.

Um,

you know,

this person was saying that they kind of

felt like healthcare workers don't really

care.

They don't really read the privacy policy.

They don't really, you know,

think that there's any issues.

They don't, you know,

they don't really have the same level of

concern that most people should have about

their medical data, especially if it's,

you know, very sensitive information,

like, you know,

It could be reproductive status.

It could be all these,

especially in the US, like these,

these are pretty,

I would say sensitive things, right?

Because, you know, in some states it's,

it's illegal and stuff like that.

Like this is,

it depends obviously on your threat model

and your situation,

but they can be extremely concerning.

So they kind of went through

basically how they want to challenge

their,

their doctors and to basically get them to

take things a bit more seriously.

Um,

and they did bring up this one specific

example, um, you know, about,

it was Carissa Vellies who we interviewed,

um, a couple of weeks ago.

She,

she basically had an example and she used

the example of like the Holocaust, like,

you know,

would you, you know,

disclosing that you're Jewish in the

Holocaust is kind of a bit of a

death sentence and maybe it's not as the

parallel is not as like, Oh,

did you want to add something here?

Yeah, real quick.

Um,

so what she was talking about was in,

um,

Oh my God,

I can't remember which countries it were.

Basically, when the Nazis invaded,

I wanna say it was France,

the number of Jews that they killed in

France was significantly lower because in

France,

they didn't even keep ethnicity records on

who was Jewish and who wasn't.

And therefore,

that made it significantly harder for them

to find Jews to send them to the

camps.

That was the example she was using.

And that's the example this person is

talking about is like,

if um if my doctor is not sharing

data with these companies like uh i'll

i'll let you talk in just a second

sorry i'm trying not to like do all

the talking um but like they said their

doctor is using gmail and it's like okay

but if gmail is reading these emails or

even has access to these emails that's

kind of the same thing where it's like

if something goes wrong now the the data

is there in the first place that's kind

of the example the the connection they're

trying to make there

Right.

Okay.

So that's, yeah,

that's definitely good context.

Um,

I'm not really super familiar with her

work personally, so that is good to know.

Um, yeah, I think it's, I think,

I don't know.

I think you should be,

try and be cautious around, I think,

standing up to these people because

unfortunately they kind of do have quite a

lot of control over, um,

But when you talk to a doctor,

like they do have quite a lot of

control over the care that you receive and

that care could be kind of important.

So, you know,

if you're going to challenge someone on

this sort of stuff,

I would definitely think about the

consequences of doing so, because,

you know, the.

the repercussions for challenging someone

like this could cause things to become a

bit more difficult because, you know,

you have such strict, um,

beliefs and stuff and such.

Like, I think it shouldn't be like that.

Like they shouldn't be able to do that,

but it's kind of the facts of the

situation.

Unfortunately, like you'll,

you'll receive different care.

If you make a fuss about something like

that,

you may not get treated the same way.

Um,

you might be seen as someone who's trying

to, you know,

hide information or like be a criminal.

And there's all these stereotypes for

people that are, um,

caring about their privacy.

And it's not really,

it shouldn't be like that,

but it's kind of the way things are

at the moment.

And it's kind of seen as almost like

a fringe thing.

So I would also take that into account

as well.

If you do end up bringing this up

to them, um,

yeah anyway i i think people are saying

like you should walk away from these

doctors agencies and stuff i i kind of

disagree with this because um i think you

know depends on what conditions you have

and for some people there's not really an

option right if you have like a very

specific condition you need to see a

specialist you need to see

a doctor that is specifically trained in a

certain area that doesn't particularly

have another option especially if you live

in a small area um you don't exactly

get a choice to just like oh you

you're using google workspace for all your

medical emails i'm gonna go to a different

clinic um and it's not even verified that

you know the the next clinic you go

to they might be even worse so

um it's kind of frustrating situation but

i don't think that is always the best

solution just like walking away from um

someone um i've never seen a doctor's

office using gmail i've never seen a

doctor's office even use email so this is

kind of bizarre to me like is this

a common thing in the us or yeah

they um they do use internal email a

lot and i've i've seen doctor's offices

that i'm pretty sure using teams

So I definitely have thoughts on this one,

but I'll wait for you to finish your

thoughts.

I don't want to cut you off.

Okay.

Yeah.

I mean, yeah.

So there's some more comments here.

People were discussing like, you know,

the original author of the post was saying

like,

you know,

you wouldn't even try to convince them

that what they're doing is wrong.

Like you wouldn't even try and bring up

that this is a privacy issue.

I mean, I could,

I think it's certainly possible to try.

I think you could try,

but I don't think you're going to be

able to convince, you know, an entire,

you know,

medical facility to change their main

tools so quickly.

I don't know.

There's definitely some people were,

making jokes in this thread I guess a

little bit of about this like saying like

you know it's better to keep quiet in

such situations you might be misunderstood

and referred to a psychiatrist I don't I

think you know if you you've got to

be tactful about this right you can't just

be saying like how could you be using

gmail it's spyware like it's evil like you

know coming across as like someone who's

not really uh you have to have tact

right and I think it comes down to

any

any social cause, right?

If you just start calling someone like a,

you know, a privacy normie or something,

like they're not going to really take what

you're saying that seriously,

and they're probably not going to agree

with you.

So I think it definitely helps to have

some grounding in reality, you know?

And, but yeah,

I don't really have too much more to

add.

There's quite,

this goes on for quite a long time.

I didn't have time to read this entire

thread.

So

Yeah, I was kind of skimming in myself.

There is a lot here.

Also, Mike Lastname said,

you are a doctor and a privacy advocate.

Feel free to weigh in while I'm giving

my thoughts,

and we'll definitely – maybe it would be

great to get an expert opinion.

So my thing is it's –

The challenge is institutional.

This kind of came up a little bit

in this article.

So first of all,

I want to say that in my personal

opinion,

and I don't think this is a hot

take,

your health should always come first,

whether that's physical health,

mental health, whatever.

If your choices are between not seeing a

doctor and seeing a doctor that uses Gmail

or even, God forbid, Teams,

please go see the doctor.

Your health always comes first.

That said, in my experience,

a lot of this is institutional.

Like I have pushed – I'm –

generally relatively healthy um my wife in

particular has um you know seen a lot

more doctors relatively than i have and i

mentioned her because like i've tried to

get her to push her doctors towards things

like using signal instead of whatever

weird platform they're on or something and

a lot of the time the doctors don't

really have control over that

a lot of the time they'll, you know,

they're like, oh,

I do use Signal in my personal life.

I'm totally cool with it,

but I am required to use this platform

because either it's not their practice and

they have to do whatever their boss tells

them to do,

just like you do at your job,

or

there's like healthcare is so heavily

regulated that even though HIPAA isn't

really about privacy,

there are very strict rules about who has

to be able to access that data.

And it does have to be transparent to

a point,

to the point where a lot of them

can't use something like signal because

like, again,

like their boss has to be able to

access it in the case of an audit

or something along those lines.

So that's a,

It's,

it's hard because in a lot of cases

they might be totally willing to,

it's just not something they actually can

do.

It's, it's beyond their control.

They don't have the authority to make that

call.

Another thing,

I think you may have mentioned this.

Cause again,

I was kind of skimming while I was

listening to you,

but there's a logistical thing.

If we are talking about an office and

not a single practice,

like a single person, it's, you know, I,

and my last job, we were using LastPass,

probably still using LastPass.

And I,

would very openly kind of like, haha, JK,

but not really.

But I would very regularly like criticize

the IT guys.

I'm like, man,

I can't believe we're still using

LastPass.

And they would point out, it's like, no,

I totally agree with you.

There's a thousand people in the company.

across the country.

Switching off LastPass is not easy,

especially when you're talking about

people that are not necessarily tech

savvy, that don't... Yeah, for you or me,

switching to another password manager is

cake.

But for a thousand people who, again,

some of them call in every single day

asking, how do I get into my email?

It's a huge lift to migrate your entire

infrastructure over to another provider.

And then there's cost,

which I know a lot of healthcare is...

Let me politely say that cost should not

be an issue for some of them.

But here in the US, at least,

a lot of them are for-profit entities,

which means they're going to want to go

with things that are inexpensive,

which is going to automatically rule out

Proton, for example.

So, I mean,

there's just so many factors that go into

it.

But I think, yeah,

I also want to agree with what you

said about it's very...

How you ask is usually very helpful,

like especially in some places,

they're just used to people being entitled

and frustrated and snappy.

And so asking politely, like, you know,

hey, I don't really like Zoom.

Can we use something else for this

appointment is going to make them a lot

more likely to work with you if they

can.

I think I saw something in here where

people were arguing about

Because there was a section here where the

original poster said something about like,

okay, here it is.

So they said health workers don't have to

care.

And they pointed out that like doctors are

overflowing with patients.

So it's like, it's almost,

and I think you mentioned this too.

It's almost like if you're being

difficult,

they just don't even have to work with

you.

There's like a line of,

there's a literal waiting list in most

places, right?

But at the same time,

we could weaponize that as well.

And I understand not everybody has the

time to be politically involved,

but to call your representatives or email

them once in a while, once a month,

and say, hey,

I really think we need better privacy

laws.

In this thread,

they pointed out that when they're talking

about trying to convince the doctor's

office to move,

they mentioned that Gmail has had

so many fines for not handling patient

data properly or user data properly and

stuff like that, which for the record,

I don't think that's going to work on

them because, you know, they're like, Oh,

but we use the HIPAA version that blah,

blah, blah, blah.

And again, HIPAA,

there's not privacy anywhere in that

title.

But anyways, it's, you know,

if you call your representatives and

you're like, Hey,

a lot of these doctor's offices are using

Microsoft and Gmail,

who Microsoft especially has been hacked

more times than I have fingers and toes

and trying to institute it at a,

a

I want to say structural level,

systemic level,

at a systemic level where they don't have

to care because there are options or it's

like mandated that they have to use

something that's encrypted.

And now there will be a whole bunch

of companies that spring up to serve that

purpose.

I don't know.

I mean,

that's kind of a long-term solution,

but...

I don't know.

I guess what I'm getting at is like

for individuals,

I don't think there is that much you

can do, unfortunately.

If you are in a position where you

can shop around and you can find a

doctor who's like, yes, I use Signal.

I encrypt everything.

Awesome.

That's great.

And if you have that privilege,

you totally should use it.

But for the average person,

I think the best you can do is

just kind of like ask the doctor like

–

can you not write this down?

Um, can you, you know,

especially if it's something less

important,

like they do have to make notes about

your medical care, but if it's like,

you know,

please don't write down anything

essential.

Like I,

I had one therapist who said that, um,

she did not write down actual

conversations.

She just wrote down like broad notes about

what we talked about.

Um, but like never quoted me or anything.

So yeah, uh,

I've always advocated for like using alias

email, alias phone numbers.

Uh, that's more of a data breach thing,

but

Yeah.

So, I mean, it's it's tricky, man.

I mean, real quick,

let me go back and check and see

what Mike said here.

I could explain a bit.

There's a really big time constraint to

see more patients and to keep up.

Yeah.

So that's a true thing, too.

Doctors are really like, again,

they have literal waiting lists.

Like there's so many patients that need to

be seen.

And contrary to some stereotypes.

I think most doctors are actually trying

to help their patients.

Like they're not all just like selfish and

in it for the money.

And so when they've got to see a

million patients,

but they've also got to make notes in

between the care and they've got to,

you know, send prescriptions,

they've got to respond to messages and

this, that, and the other.

Um,

a lot of the time is used for

filing documents and insurance,

legal documents,

using AI for the slow typers helps.

Um, that's another thing.

If they are using AI,

they have to fact check it and make

But yeah, like you said, most importantly,

they just don't understand that they are

just employees.

Yeah.

So there have to be records.

They use the most well-known ones like

Teams and Gmail.

Quick note, saw this all,

has been a member for five months and

said, keep up the good work.

So thank you so much.

But yeah, it's just...

I think the best you can do is

to ask nicely.

Like that's, that's really my,

I don't know if this is a common

phrase.

I feel like I don't hear it a

lot,

but my mother used to have this phrase

that you catch more flies with honey than

vinegar.

And basically what she always meant was

just like, you know,

it like you get better results when you're

nice to people.

So yeah.

I definitely would not go in there talking

about like, oh, you know,

Gmail's reading our emails.

Because again,

they don't understand that companies will

do this stuff anyways.

And they'll just say like, oh,

but they're not supposed to do that

because we have this special, again,

like a lot of these companies do have

a HIPAA compliant version that is

specifically for medical companies.

And so they'll be like, no, no, no,

we're using this different version.

And they don't understand that like,

that doesn't really matter because again,

HIPAA has nothing to do with privacy.

But you know,

if you go in there with like,

I'm just,

I'm really concerned about this stuff and

it makes me uncomfortable.

And like,

I would prefer to use something else.

And I think again,

if you're kind about it,

I think people will be much more likely

to work with you as best they can.

But yeah,

unfortunately the privacy situation in

healthcare kind of sucks.

I think one other interesting thing that I

think kind of happens with these doctors

is like,

like Mike last name said in the chat,

like basically doctors don't really have

time to read the privacy policies of every

tool they're using.

And a lot of times these,

these vendors of these, of these software,

like they'll, they'll say, Oh, it's,

it's got all this privacy stuff and it's

like, it's,

it's secure and it's not going to send

it to anywhere.

And I've been to multiple doctor's office

and they're using AI transcription

software and that software is,

it's it's it says that it's private but

it's sending all that to open ai but

it's just zero retention like that's not

very that's not very good like that's

that's exactly what we don't want and it's

a lot of times it's these vendors that

are trying to sell to these to these

medical practices that kind of get get it

pull the wool over the eyes of these

doctors and basically you know tell them

you're going to save so much time if

you use this tool and like you know

it's completely private and it's,

it's no problem.

And, you know,

I think you have to be a bit

genuine.

Like you have to, you have to say,

if you say no to them using these,

this piece of these pieces of software,

like if it's AI transcription or if it's

some other like medical system they use

for booking appointments or something like

that, um,

I've just never seen email.

I've never seen anyone emailing patient

records around.

So that's very bizarre to me.

But I guess if they're using an email

system,

convincing them to switch might be

possible.

But I feel like that's a bit more

of a,

that's definitely a bit more of a harder

thing to get them to do, I think.

Yeah, I don't, to clarify,

I don't know if they use it to

email patient records, but I mean,

that was another thing that I was thinking

about while you were talking on that note

is it's, you know,

coupling what Mike said about like,

they have so many patients to see.

Okay.

And so when you have to see,

when you have eight hours in a day

and you need to see

And they all have questions and concerns.

And I'm hitting that age where every time

my leg starts hurting a little bit,

I'm like, maybe I have a blood clot.

Maybe I should go to the doctor.

When you have patients like that all day,

and again,

you need to take notes in between and

the billing and the filing.

And so now you're saying like, Oh,

but I want them to like store everything

offline in Libra office.

Okay.

And what happens when you move and they

need to transfer your medical record to

someone else,

or they need to get your medical,

we already have a huge problem in this

country, in this country,

in the U S I think it's probably

better in other places, I hope.

But like,

we already have a huge problem where

nobody uses a standardized medical system.

So like every time my wife and I

move and you know, it's like, Oh,

now we're closer to a different doctor.

So let's start going here instead.

It's this huge pain in the ass to

get the medical records transferred from

one place to another.

And, you know,

it's just like everything is fragmented.

And, you know,

it's more work is what I'm getting at.

Like if you're the one who's like,

I'm the only person who's saying, hey,

don't use this system.

You're one person out of, again,

five hundred on a waiting list and they

don't care.

And it's going to make it quicker for

me to give you care.

Like that's what the doctors are saying.

are interested in so it's just there's

there's so many things working against us

which is why again i'm kind of i

know it's hard work and i know i

can't ask that of everybody but i'm kind

of at the point where it's like this

needs to be one of those things that

like trickles down from the top where like

we have these good privacy laws that say

you know medical emails have to be

end-to-end encrypted or encrypted at rest.

These systems have to enforce two-factor

authentication.

These kind of technical requirements that

will give us privacy,

that it is illegal to share data with

third parties for anything other than

research purposes or something like that.

We need something at a systemic level so

that doctors and nurses don't need to care

about this stuff anymore because it's

built into the systems they use,

which is really what we need at all

levels, not just healthcare,

but I digress.

I'm kind of rambling now.

So yeah.

Yeah.

I mean,

I think a lot of vendors that are

trying to sell this software to doctors,

they do think that they are providing that

right now.

They think that zero retention sending

your transcription to OpenAI is fine.

But yeah,

I think it's kind of frustrating because

usually if it's an AI transcription

locally,

that's going to be a lot more expensive,

isn't it?

Because you've got to have a whole,

you know,

a whole beefy computer to run that.

So, you know,

it's definitely a harder sell.

So I kind of understand why a lot

of times these systems that are like

relying on external third parties and

stuff is kind of becoming more

popular.

It said,

so Mike Lastname has kind of put a

couple more comments.

Not only the privacy policies,

but also in general,

they don't understand how computers work

as thinking maybe we as the clinic or

mail service could get hacked.

Yeah, I don't think they think about,

they don't think about like the

cybersecurity risks and such.

It kind of sucks though, because with

With the medical field,

you kind of do have to store records

on people.

I need to have records of my treatment

so my doctor can understand how to treat

me the best.

In other areas,

it's like minimal data retention is the

best.

But in this specific case,

maximum data retention is the most

important because if someone doesn't

understand your...

your needs or your issues then they're not

going to be able to give you the

correct care um and I think the other

thing that Nate said about like the data

transfer stuff I think that's another

thing that we could definitely improve um

it's never been an issue for me but

I guess it could be I guess because

you kind of have that I'm not sure

it's I always thought it was

done through like a government run system

here, but maybe I guess through,

through your system, it's kind of like,

it's just different private companies kind

of managing the records.

Um, so it, it,

I mean, a little bit off topic.

It's not usually a huge issue for us.

Usually my wife just calls the old clinic

and goes, hey,

I've moved to this other doctor because we

moved.

And, you know,

I've she fills out a form and we

scan it and there's your email.

Actually, we email it to them or whatever.

And they, you know,

send over the medical records.

But it's definitely I have a friend who

has he's a.

a full stack developer.

He's very experienced.

He's a veteran and he's worked for a

lot of startups.

And one of his most recent was a

healthcare startup.

And that's what they were trying to do

basically was trying to create a way to

make it easier for healthcare companies to

standardize record formats.

So they were more easily transferable

because again, we, like you were saying,

we,

we have a bunch of fragmented private

companies here and,

And so like on a technical level,

like the database itself,

the format for this company may not match

the format for this company.

So even if they do,

it's almost like I don't know if you've

had this experience,

but I know it's pretty common here in

America where like you'll go to apply for

a job and sometimes it'll be like, oh,

click here to upload your resume and you

upload your resume and it's still wrong.

And you have to go through and like

manually reformat everything correctly,

which is super annoying.

It's kind of like that.

It's like they might transfer the medical

records,

but they may still need to be cleaned

up on the other side because there's no

standard protocol for how they transfer.

It's weird.

I mean, I'm in the VA,

so I've never had that problem,

which actually I wanted to say that real

quick.

I thought that was funny.

You were talking about like healthcare is

kind of like the one time it makes

sense to have maximum data retention.

And this happened to me.

I mean, full disclosure to everybody,

I'm back on antidepressants now.

And when I went to the VA and

I was like, hey,

I want to get back on antidepressants.

And he like pulled up my record and

he's like, oh,

so you used to take this one.

He's like, how much were you taking?

And I'm like,

What do you mean how much was I

taking?

Shouldn't that be in the record?

Like,

I don't know how much I was taking.

That was four years ago.

And for some reason,

the dosage that I was on was not

in the medical record.

It was super weird.

But yeah,

it's like the one time that it's like,

that was four years ago.

Why should I know what my dosage was?

I thought you guys handled that.

So yeah,

that's our lovely fragmented system around

here.

yeah it is kind of I don't know

I've definitely run into issues similar to

that like people not having the correct

information or like assuming things um

it's not great but I think yeah I

do think it is kind of important to

have that data in in the medical field

um especially I don't know like

I think having good notes on people's

conditions is kind of important.

Unfortunately,

like we would rather that that information

isn't stored right because it can probably

get breached at some point.

But also like if you're seeing a lot

of doctors and they kind of need to

be able to coordinate together,

it's kind of problematic if you don't have

those notes.

It looks like someone said here National

Nurses United has been part of protesting

Palantir campaign's

Yeah, I know Palantir...

Doesn't Palantir have stuff to do with the

medical sector as well now?

They're kind of moving into that as well?

I don't know if I've heard about that,

but it wouldn't surprise me because I'm

really...

For those who don't know,

the interesting thing about Palantir is

they technically don't do any surveillance

or data collection themselves.

What they do is they're kind of like

my friend I just talked about.

They're trying to figure out how to

aggregate all the data and make it all

talk to each other and then turn it

over to law enforcement.

So, I mean, yeah,

healthcare seems like it would be an

inevitable part of that mission.

So if they're not moving in yet,

I'm sure it's on the roadmap.

Yeah.

And then Mike, last name also said,

there's also what we call defensive

medicine where doctors want to make

records of everything in the case they get

a lawsuit.

Yeah.

Yeah.

That's fair too.

I mean,

everyone's got to protect themselves.

I think, yeah, especially doctors,

I think,

especially someone who's your primary care

provider,

they have kind of

quite a lot of say over what care

you receive.

So it kind of makes sense.

Yeah,

we've talked about this one for a while.

Do you have anything actually you want to

add before we hop into this next forum

post?

Um, yeah, just real quick.

I was going to say, uh, in,

in response to what Mike said about the

doctors keeping a record of lawsuits,

I found out here in the U S

at least in like emergency rooms,

if I understand it correctly,

it's almost like the doctors are like

contractors renting out the rooms.

Um,

because the hospitals and the doctors will

bill you separately,

like to go see the doctor costs like

two hundred and fifty bucks,

but then you're paying like a thousand

dollars for the aspirin and the room

cleaning and all this kind of stuff.

And they're like separate fees.

But yeah,

so doctors make a lot of money,

but it's also because from what I

understand, they're like,

kind of a lot more on the hook

for it like when you sue a doctor

you're not suing the hospital you're suing

the actual doctor so yeah that's um not

saying that's a good system but yeah i

totally get it for sure like you said

you got to protect yourself that is the

u.s health care system for you oh best

country on the planet they tell me i'm

not gonna get into that there's worse

places i'll say that i uh i would

rather be here than a lot of places

in the world so um

Moving on,

the last forum post we were going to

look at,

is RCS with Google messages worth having

Google on my phone?

So this person has a graphene phone,

and they're basically saying, like,

I was kind of thinking about it,

and I can totally take all the Google

Play stuff off of my phone,

except that I use Google and RCS.

And so basically, they're saying, like,

is it worth it to have this, like,

totally de-Googled phone?

But to go ahead and put some Google

on it for the sake of getting access

to RCS messages.

And they do specifically mention that they

say their closest contacts use Signal.

But non-close contacts and random people,

they always default to...

They say they do live in the USA,

so it's always just regular text message.

I can confirm this one.

You said you have to pull teeth to

get them to use anything else.

So...

They're just kind of looking for a second

opinion.

Well, they do say,

how do we know Google isn't lying about

the encryption or isn't client-side

scanning messages?

I will tell you right now, actually,

I'm assuming this is still true.

I covered a story on Surveillance Report a

long time ago where Google does actually

make hashes of the message.

And then compare the hashes.

So they do actually know who you're

talking to.

They can't see the content of the message.

But yeah,

that's why I always tell people when I

explain that RCS has an encryption,

I'm like, yeah,

it's better than not having it.

But also at the same time,

it's definitely not as good as something

like Signal.

I'm gonna have to go find that story.

But yeah.

Yeah.

I mean, this is a,

I think this is kind of a classic

question for everybody, right?

Cause you're always going to have the

people that won't use signal or can't use

signal or just like the one-off contacts

that like, you know, again,

at my last job, I,

I interfaced with a lot of other trades

and other jobs.

And so I would have to give them

a phone number to like call me or

text me if they had any questions or

anything.

So, um,

I think my thoughts are,

it kind of depends.

If that happens to you a lot,

I'm at the point where,

even before I took this job, like,

ninety percent of my communications were

on Signal,

and the ten percent that weren't were

mostly job-related stuff,

like professional stuff.

So it was like, okay,

I don't really care if that's encrypted

personally,

and I would rather not have Google

Messages and deal with that.

I think if you're kind of in the

opposite boat where it's like, okay,

but only my closest friends and family are

on Signal and the vast majority of

messages I get are not,

including some friends and family who just

refuse to download Signal,

I think that might change the math a

little bit.

Another thing worth considering is I

believe Jonah has said in the past that

RCS only works on certain carriers.

And so you might have to check and

make sure that your carrier is one of

them.

So, I mean,

it kind of sucks because you're already

like,

it's already kind of getting narrowed

down.

It's not just as simple as like, okay,

I have Google messages and now I've got

RCS encryption.

It's like, well,

you've only got RCS encryption with other

Google message users or Apple users or

people that use this certain carrier.

So I don't know.

I don't think I can really give like

a yes or no answer.

I think it really just depends on you.

I will say on Graphene,

the nice thing about Graphene is that you

do have a little bit of privacy because

of the sandbox thing.

I know that's more security than privacy

per se, but...

Um,

I would probably be a little bit more

willing to do it on a graphene phone

than a regular phone, I guess.

Although I guess with a regular phone and

all the Google stuff would be built in

there.

So I guess, nevermind,

that doesn't really make sense,

but I don't know.

I think it's really a personal thing,

but I guess I just thought this

interesting because again,

this is a situation that I think a

lot of people have been in where it's

like, you only,

you can only get so many people using

encrypted messaging.

So what's the right move.

And, you know, as usual,

I don't think there is one right answer,

but I think those are kind of the

factors that I would think about.

Yeah.

do you have any thoughts on that one

I know you're I don't think you're like

a daily Android user are you I know

you have an Android but

Um, yeah.

Am I throwing you in the house?

I'm sorry.

I mean, yeah, I mean, yeah, I do.

I use both like iOS and Android for

different things.

I think it's always like,

there's weird people who are just like,

I'll only ever use an Android.

I'm never going to use an Apple.

Apple is so bad.

And it's like, well, you can use both.

Like both have got good things about them,

right?

Like there's, there's positives to both.

I think there's certainly more positives

on the Android side,

but

a huge amount more positives but there's

also some positives on the apple side as

well so you know don't don't feel like

you only have to use one type of

device i think that's also another thing

but yeah i think i agree with you

though like i think you know if you're

using this on graphene os though i feel

like you're giving google significantly

less information

um than you would on like a google

android device right like it's it's not as

deeply integrated into the operating

system it's just a standard app that you

install um i think that would definitely

be a good idea and i think considering

the state of like of of cellular

communication like remember i don't know

if you remember but a couple of maybe

maybe a year ago there was like a

story about like um chinese

state-sponsored hackers like inside the

u.s like

telecommunications infrastructure.

Like I don't think you want to put

like all your text messages to those

people.

Like that's basically public, right?

Yeah, I remember that Volt typhoon,

and I think it had been going on

for at least a year when they found

it.

I actually remember I was with

Surveillance Report when that happened,

and I remember the way Henry described

that story.

He's like, yeah,

the government is basically like,

we don't know if they're gone yet.

We don't know when we'll kick them out.

It's just kind of like the whole thing

was such a mess.

Yeah, that was a crazy story.

And that, oh,

I know this isn't the point,

but that is my favorite story when we

talk about how backdoors don't work.

It's like that was literally a backdoor

that was only for the good guys,

and look what happened.

So yeah, I'm, I'm with you.

When, when I saw that story,

I was just like, Oh,

I'm really glad I've got again,

like on almost all my friends and family

using signal, thankfully.

And like I said,

the handful of things that aren't on

signal, I mean,

I guess it was technically like company IP

or whatever, but you know,

that's on the company.

So it was, uh, I don't know.

I mean, again,

this was before I worked at privacy

guides, but yeah, you know,

it was just texting other people like,

Hey, there's supposed to be this here.

Where's this thing?

When's this delivery coming?

So yeah.

It's the kind of stuff that as far

as I'm concerned, I'm not super,

I don't know.

It's whatever.

Yeah,

I think the most important part is like

you're saying, you should be careful.

Like you should be thinking,

I'm about to send this message.

Am I okay with this information becoming

public?

And if the answer is no,

then you should be using something else,

right?

Like that is the case because I think

any message you send on like a public

service like telephone network,

any sort of telecommunications thing,

I think you should treat it as public

because it's not really –

secure it in a way.

You don't know how long that data is

being retained either.

So, yeah,

that's how I would think of it at

least.

Personally,

I'm a big fan of applying that to

everything because you never know if

somebody's going to screenshot a post.

I mean, you can screenshot Signal still.

It's super easy.

Or even if you can't screenshot something,

they might take a picture of it with

another phone.

So, yeah,

that's always what I encourage people is

like anything you put in a digital format,

just assume it might be publicly leaked.

So...

I mean, yeah, I think we can.

I think, you know,

I think it's definitely we should be

trying to preach privacy to everybody.

We should be like, you know,

don't do that.

That is the wrong thing to do.

That's just ethically wrong to do that.

But yeah, of course, people aren't on.

No one's perfect and people are going to

do that.

So it's true.

But I think.

With the cell phone network,

I think it is one of those things

where it's systemically just going to be

public at some point.

That's fair.

At least with Signal,

if I send you a message,

I know you're not going to share that

with someone else, right?

Because we have a shared understanding.

But if it's like the telecommunications

company,

they don't have any agreement with me.

They just are going to...

you know,

let hackers roam around in their network

and not actually do anything and then say

that they're gone, but they're not really.

So anyway,

what I'm trying to say and going around

in a kind of massive circle here,

what I'm trying to say is basically that

is what you need to think about when

you think about whether you need to do

this or not.

I still think

that most people are using Google Play

services on like a Graphene OS device.

Most people,

like most people are using these apps from

these stores, right?

You don't need to create an account that's

linked to your identity.

You could use just some burner Google

account, right?

You don't have to provide that much

information.

So I think using RCS on GrapheneOS to

secure, even if it's one,

even if it's only one person,

I think that's still a benefit in a

lot of cases.

And I think it's not,

you're restricting the access quite

significantly compared to what is

available on the cell network,

which is basically nothing.

So something is better than nothing and

Of course, it's up to you to decide.

If you don't have Google Play services on

the device already,

then maybe that is a bit more of

a concern.

Maybe that's like, oh,

I don't know if I want to do

that.

You could also set up a separate profile.

You could set up a separate user profile.

And in that user profile,

you set up a burner Google account and

then you add Google messages.

Maybe that could be an option.

But I'm just, you know,

kind of spitballing.

I think it's

You need to decide this yourself,

but I think if you just avoid SMS,

just, just avoid it in general,

if you can.

I think a lot,

and now with Apple releasing like

encrypted RCS,

I think it's becoming more and more

popular and more and more accessible.

So, you know,

I think you should try and try and

try and see if some of your friends

are using it and if you can secure

those chats.

And I think that's definitely a big win.

Agreed.

Yeah.

All right,

I think that was it for forum updates.

And so I think we'll move into listener

questions.

So if you have been holding on to

any questions,

definitely go ahead and leave them in the

chat.

Normally we would start with the forum,

but it looks like there haven't been any

questions left on the forum.

So we'll just go straight into the chat,

which I did.

I think somebody left something earlier.

Oh yeah.

Purring pudding quite a while back,

we were,

we were talking about how cool it would

be if there was some kind of API

you could hook into that could just like

change passwords automatically.

They said, apparently there is a,

the skim SCIM API to provision logins,

but most sites don't implement this.

So yeah, that, that doesn't surprise me.

Cause I know I'm a,

Like I've said multiple times,

even today alone,

we could do things in a certain way.

We could do things in a way that

are privacy respecting and we just don't.

So it doesn't surprise me that people have

opted not to do things that way.

I mean, talking about standards,

it's kind of a funny situation.

I was talking to everyone on the team

about this.

It's really kind of funny.

We have all these standards that are

really good that everyone should be using,

but it's just all the organizations can't

agree on

using them and they don't all use them

properly.

So it's, it's, we do have the answer.

Like we do like with passwords,

like we have the answer, like don't,

Yeah, exactly.

It's this XKCD thing, like the situation.

There are fourteen competing standards.

Fourteen.

Ridiculous.

We need to develop one universal standard.

And then now there's fifteen.

So it's like we have all these standards,

but like no one can decide which one

is the best,

which one we should implement.

Like, oh, we're going to put pass keys,

but we're going to retain passwords.

We're going to use pass keys and passwords

at the same time.

Or we're going to use pass keys and

only pass keys.

And it's like it's ridiculous.

It's it's.

yeah i feel like this is such the

case for like so many things like linux

specifically comes to mind like oh we're

gonna use we're gonna use weyland oh no

we're not gonna use weyland because that's

that's gonna be too bad blah blah blah

it's like you know it's a never-ending

thing the minute you said standards that

was where my brain went ah i never

get tired of that comic yeah i agree

Um,

Mike here pointed out on the topic of,

uh, Google, uh, Google services,

most apps don't need play services,

even if they say so when opening the

app, I was surprised by it.

Yeah.

Especially a lot of privacy apps.

Like I think signal, for example,

if you download signal, um,

I think by default,

I could be wrong about this.

Don't quote me.

I think by default,

it will use Google services,

but in the past I've downloaded it on,

um, D Google fully D Googled phones,

like lineage phones, um,

just for whatever reason.

Um,

And I still get notifications.

So it falls back to its own services

if it doesn't detect Google.

And it's also like,

what do you need them for?

I'm thinking about MySudo, for example.

So I pretty much use MySudo for anybody

who's not on Signal.

And like, ninety percent of the time,

I don't really need to get the call

in real time.

Like, again, I mentioned I'm with the VA.

they do call me sometimes,

but ninety percent of the time it's a

text that's like, hey,

don't forget you have an appointment on

Monday.

Click why to or like text why to

confirm or text and to reschedule or

whatever.

And so like I don't really need that

notification in real time.

It's OK if I get that later in

the evening.

So, yeah, I mean,

there may be certain situations where you

don't necessarily need the play services,

but I would look into if RCS because

that is a good point.

I don't know if RCS would be required

for that.

So

Definitely interesting.

Good thought.

Yeah.

So it's been kind of a slow week,

or like this week,

with people leaving comments.

But if anybody has any last minute

questions, be sure to let us know.

Yeah,

we definitely tried something a bit

different with the highlight story this

week.

We kind of wanted to see if people

would be interested in something that's a

little bit different.

We kind of try that some weeks,

like some weeks we know that the highlight

story is going to like be a banger

and everyone's going to click on it.

But, you know, we do try things.

We want to try and, you know,

experiment a little bit.

We don't want to keep doing the same

thing over and over again.

It's not fun for us.

It's not fun for you.

So we're trying our best with different

things.

And we want to make sure we don't

stagnate, right?

We're always trying to reach new people

with privacy messages and that requires us

to try new things.

Oh man,

the million dollar question from Yumi.

Why can't we agree on which standards to

use?

I mean, it's...

in my opinion,

it's because there are usually pros and

cons like, okay.

Every once in a while,

you definitely get somebody who's just

like stuck in their ways and they just

don't want to grow and adopt.

But I think a lot of the time

there are like situations where, um,

I know this isn't a standard,

but just to talk about something that I

actually know about,

we'll take SimpleX versus Signal.

They're both really good choices,

but they're different use cases and

they've got different advantages.

SimpleX has the whole decentralized

architecture and it's supposed to be a lot

more censorship resistant without having

to set up a proxy,

which we made a video about that.

At the same time,

it's missing a lot of the features that

the quote-unquote normies would come to

expect and

you know,

it can be harder to get your family

onboarded.

Like,

I remember that was a big thing when

Mastodon kind of had their fifteen minutes

is everybody was like,

I don't know what instances are.

I don't know what server to sign up

for.

Like, I'm really confused.

And, you know,

it's things like Signal don't have that

problem.

You just download it and start using it.

And so there's a lot of the time

standards are

built for certain use cases but I would

venture to say that a lot of the

time they can also especially when we talk

about tech and this kind of stuff they

can apply to multiple use cases and so

there's like advantages and disadvantages

so there's not always a clear like well

this one is obviously better it's like no

it's obviously better in certain ways and

you know this other one is obviously

better in certain ways but humans are

incredibly emotional creatures and so

sometimes we uh have a hard time agreeing

on this kind of stuff I think that

would be my guess I don't know if

you have a better answer

yeah it's kind of frustrating it's like

every every single thing we've got has got

like some some argument about standards

happening like which you mentioned like

mastodon oh mastodon i don't like that

it's like the standard is so bad like

the fed the federated protocols are so bad

i prefer blue sky i prefer uh what's

the other one nosta i prefer blah blah

blah like it's

yeah people have always kind of argued

about this stuff um you know i think

there's not many protocols that we could

argue are like actually standard at this

point like email comes to mind like

everyone is like kind of on board with

that unfortunately it's like the worst

it's really bad it's a really crappy

protocol but everyone uses it so i mean

i guess it doesn't really matter if a

protocol is actually good or a standard is

actually good it doesn't mean that it's

going to be

adopted um i think it also is just

a legacy thing too but like same with

phone numbers it's a standard everyone's

using a phone number and it's not a

good way um i guess also here there

was a question from mike uh last name

with about session session is about to

close shop soon um i know nate you've

definitely got more experience with this

so you want to handle this one

Yeah, I mean,

I actually found this out from Kerry from

Firewall's No Stop Dragons, but actually,

thankfully,

Session is not shutting down right away.

They were able to get enough support,

not as much as they hoped for,

but they will be able to continue

developing past July eighth.

A smaller team will continue development

into twenty twenty seven,

focusing on strengthening the project and

building a foundation for its long term

future.

Um, so yeah, they say,

although procedures,

shutdown procedures have been canceled,

the shape of the project is still changing

considerably.

The project will now be led by Jason

Rhinelander,

longtime chief software architect and

member of the session technology fund.

Uh,

currently donations received are enough to

support critical infrastructure to retain

Jason as developer and possibly to add one

other full-time developer.

There's also still a small team of

volunteers contributing to other aspects

of the ecosystem.

So, um, session will continue to exist.

It's just, they've unfortunately had to

dramatically stripped down their team.

Um, which is really, really unfortunate.

And, uh,

Yeah, I mean,

they're still they only raised just shy of

two hundred thousand dollars and their

goal was one million,

which they did explain.

This is right on the front page,

by the way.

If you go to get session dot org,

you can read the appeal up top and

it'll take you to this page.

So, yeah,

they definitely do still need donations.

If you believe in session,

if you are a fan of them,

please donate.

They do still need it.

They're not out of the woods yet,

but thankfully they are not shutting down

as of this point in time.

Yeah, it's really unfortunate when we see,

you know,

I think it's really hard for a lot

of these projects to get the funding that

they need.

And, you know,

unless you're like the big player,

which currently right now is Signal,

they get a lot of donations.

But like all the other projects,

I'm not really sure what SimpleX's deal

is.

I believe they did take on venture capital

funding,

so they're probably going to work out some

way to monetize their product eventually.

Raya is definitely more of a

community-based project,

doesn't see as much development as Signal.

You know,

we've got all these different messengers,

and if you do, like, personally,

I'm on Signal every day.

I'm sending messages.

I'm on voice calls for, you know,

hours at a time.

Like,

I think this is an important opportunity

important thing to do, right?

If like you use a product or use

a service and you get a lot of

value from it, then, you know,

maybe consider donating because it is

expensive to run all this infrastructure.

And I don't know,

I've always had kind of a soft spot

for Session because they've been an

Australian based company originally.

And I don't know,

I was kind of sad to see that

this happened because I thought they had a

thought they were receiving enough um

through cryptocurrency donations but it

seems like they have kind of been

struggling so i don't know this is kind

of sad but i hope that they can

work out some other sustainability like

some some other way to sustain their

project because it's never been an app

that i've used a lot but it's always

been nice to have that extra option like

a lot of people were like oh i

don't like signal because it requires a

phone number

Here's session.

Doesn't require a phone number.

Or here's simple X.

Like there's other options for people.

It's better to have more options than not.

So if session does go away,

we're going to be kind of stuck with

the only one I can think that really

compares is simple X.

Simple X is kind of session adjacent,

but it has a different direction,

certainly.

Agreed.

All right.

I think that might be all we got

this week.

You think it's time to close out?

All right.

All right.

All the updates from this week in privacy

will be shared on the blog every week.

So sign up for the newsletter or subscribe

with your favorite RSS reader if you want

to stay tuned.

For those who prefer audio,

we also offer a podcast available on all

podcast platforms.

And again, RSS.com.

This video will be synced to PeerTube as

well.

Privacy Guides is an impartial nonprofit

organization that is focused on building a

strong privacy advocacy community and

delivering the best digital privacy and

consumer technology rights advice on the

internet.

If you want to support our mission,

you can make a donation on our website,

privacyguides.org.

To make a donation,

you can click the red heart icon located

in the top right corner of the page.

You can contribute using standard fiat

currency via debit or credit card,

or you can donate anonymously using Monero

or your favorite cryptocurrency.

Becoming a paid member unlocks exclusive

perks like early access to video content

and priority during the This Week in

Privacy livestream Q&A.

You also get early access to our show

notes and the stories we might be

covering,

and a cool badge on your profile in

the Privacy Guides forum and the warm,

fuzzy feeling of supporting independent

media.

So thank you guys so much for watching

and we'll be back next week.