Flock is targeting innocent people and

WhatsApp is trying to sue NSO group.

Apple is announcing new features that

allow you to automatically change your

compromised passwords and more.

All this coming up this week on This

Week in Privacy, so stay tuned.

Welcome back to This Week in Privacy,

everyone.

This is our weekly series where we talk

about what's happening in the Privacy

Guides community and this week's top

stories that we've seen in the data

privacy and cybersecurity space.

I'm Jonah and with me today is Jordan.

How are you doing, Jordan?

I'm doing good.

Really excited to jump into some of these

stories this week.

We've definitely got a great lineup of

stories to cover.

I totally agree.

Let's get right into the first one here.

This was reported by Times of San Diego.

They say a flock license plate reader

linked a San Diego man to a violent

crime.

He was five miles away.

Basically, the story starts out, well,

I'll read the beginning.

It kind of explains it.

When Hugo Parra was arrested last year on

felony charges,

his pleas of innocence fell on deaf ears.

San Diego police had a description of the

Alfa Romeo car he was riding in and

a witness who identified him during a

curbside lineup as the man who brandished

a handgun in Golden Hill.

They had also checked the city's automatic

license plate camera system run by the

private company Flock and got a hit,

substantiating the claim.

The problem, says attorney Alex Kuhlman,

was that Para was five miles away from

Golden Hill at the time of the crime,

and the so-called hit

from license plate reader was captured

before any police pursuit began.

The flock hit was obviously the wrong car

as it could not have been in both

places simultaneously, said Kuhlman,

who represents Para and the driver,

twenty three year old Ariel Beltran.

So basically the story

coming from San Diego,

is talking about this man who was accused

of a crime while the Flock license plate

reader system proved that he was nowhere

near the scene of the crime at the

time.

The article says that Paris spent nearly

one month behind bars missing Thanksgiving

and other family events before the assault

charges were dropped.

We've talked a lot about

lock and license plate readers on the

show.

So I think people who watch this regularly

kind of know about all of the issues

with flock.

But I think we wanted to include this

story because it kind of demonstrates how

none of these tools are ever going to

be used in your favor,

even when they clearly prove that

uh you've been nowhere near the scene of

the crime or anything going on that you

might have been accused of any of those

results are going to be disregarded by

police but if any shred of evidence can

be gleaned from them that might place you

at the scene of the crime they will

be used to

basically accuse you and ruin your life,

or at least that part of it.

So yeah,

that was the only thing I really wanted

to highlight.

It's just the demonstration, I think,

that all of this mass surveillance is not

worth the cost because it's so unreliable

in so many ways,

whether it depends on AI or whether it's

just

a system that isn't reliable like this one

and can't be trusted,

we are placing a lot of faith in

these automatic systems like license plate

readers and other forms of mass

surveillance in our society that don't

have a very clear benefit and get things

wrong a lot of the time.

Yeah,

that's basically what I wanted to cover.

I think we've kind of done flock stuff

to death maybe at this point,

but just an update for you.

Jordan,

was there anything in this article that

you saw that you wanted to highlight?

I feel like the most surprising thing in

this article for me was like,

if you read like further down in the

article,

there's like stuff about how like the

officers literally didn't even check any

of this first.

They were just like, oh,

it's a hit on flock.

And then they went and arrested this guy.

And apparently they literally took him to

like jail and everything.

Like they literally jailed him based only

on this information.

Like it's...

it is kind of ridiculous that maybe I

feel like maybe police are relying a bit

too much on this technology when,

you know, like you said,

it's not really that reliable in terms of

like actually detecting things and

correlating information.

But yeah.

Yeah.

It's a great question.

Like what they consider to be a hit,

because if they're just basing it on like,

is this car in the flock system?

That's not exactly proof of anything,

is it?

Not really.

Yeah.

And especially because like, I don't know,

the,

if that's all they're going on to like

actually arrest someone and put someone in

jail, like just to,

that's the only thing that they need.

I feel like that's maybe a bit ridiculous

that they're like relying so heavily on

it.

They even said like in the article,

it even says like, Oh,

we checked this guy's car.

We like looked through all of his stuff.

He had no weapons.

Like there was,

there was not really a whole lot of

evidence that this person was

like even immediately obvious evidence

that this person was connected to this

crime.

So that's why it's kind of surprisingly

ridiculous.

And I think the San Diego Police

Department is going to get sued pretty bad

for this because I don't think they really

had any evidence to arrest these two

people.

And apparently they're seeking at one

point five million in damages.

So I don't know.

I mean, yeah,

this has life-altering implications for

sure when you're convicted of a crime and

you're jailed for that long.

I think that's one of the most ridiculous

things to me.

I think being wrongfully accused of a

crime...

in general is a terrible thing to happen

to anyone.

But in the heat of the moment,

some of these things can happen with

police.

But to spend an entire month in jail

because of a crime you didn't commit is

ridiculous.

Spending more than one night while they

sort anything out is ridiculous because

You really should be innocent until proven

guilty,

and that is just not what we see

in a lot of cases,

and especially in this one.

That is quite a significant punishment,

I think,

spending an entire month or more in

jail um that the police just kind of

did arbitrarily this wasn't you know the

result of any sort of conviction or

anything it's it's too long of a waiting

period for sure especially again at the

hands of these very unreliable tech

systems that that we just cannot push all

of our judgment and accountability on

because again they get things wrong so

much of the time so

Yeah,

I hope his lawsuit goes through and he

makes some money because usually hitting

them where the money is might make them

change their minds.

But at the same time,

Even that's a bit challenging with the

police because they're taxpayer funded.

So what do they care, right?

But hopefully there's some accountability

and some changes that are made here.

And hopefully other places learn a lesson

from this as well,

because I think that we're going to be

seeing more stories like this throughout

the country and around the world as these

license plate readers and other systems of

mass surveillance like this get

implemented more widely.

So yeah,

it's just super unfortunate stuff.

And it's exactly the kind of thing that

people who have been against flock or

people who have been against mass

surveillance in general for an even longer

period of time have been

warning against from the very beginning.

It's a very predictable outcome, I think,

of these systems.

And, yeah,

now we're seeing the results of that,

which is crazy.

Maybe for people that, like,

aren't super familiar with what, like,

who and what Flock actually is, like,

how exactly is this, like,

is it like a camera system that has,

like, some AI detection, like,

algorithm or something,

or how exactly does that work?

Yeah, so they sell these to...

like cities and police departments as a

camera system that you can put up pretty

much all around your city to track cars

basically wherever they go based on their

license plates.

So it kind of maps out people's specific

locations where they traveled, et cetera,

and gives that information to law

enforcement or other people to basically

trace people anywhere in the city based on

where their car is going.

The way that flock systems work in general

is somewhat different depending on the

jurisdiction.

Law enforcement agencies or towns would

have the option to, for example,

share all of this data with a national

database, so like with the FBI,

for example,

so that they can all be linked together

and potentially trace people even outside

of that one specific flock system.

You can opt out of that, but

All of these flock systems still kind of

interconnect to the flock company's

servers,

and that potentially gives a lot of access

to third parties to all of this

information.

Yeah, it's just a very popular thing.

It's not the only solution.

There are other automatic license plate

readers systems that are being

implemented.

But Flock is kind of a big one,

and it's the one that has been in

the news the most recently.

We've seen a lot of stories about either

these systems being implemented in

different cities or pushback from citizens

of those cities

getting those flock systems removed.

We've seen a lot of examples where a

lot of money has been spent on

implementing these flock systems only for

the public outrage to be so great that

they have to go and undo all of

those changes,

which

is of course not great for the taxpayers,

but is important to keep in mind,

I think,

for any city council who is considering

implementing such a system.

The pushback against this sort of thing

from the general population when people

are aware of what's going on here is

pretty significant and universal,

that it's just not a great idea for

this system to be implemented and

we kind of need to avoid implementing such

things in the future.

And I think city councils need to take

a lesson there.

It's funny,

I think a couple episodes ago we talked

about a flock situation like that where

One of the city council members had a

very emotional reaction to their system

being removed from the town.

And they were like, well,

we might as well just let crime be

rampant in the area.

And that he took it so personally,

probably, I mean, to me,

only kind of speculating is an indicator

that he was probably getting some sort of

kickbacks from Flock or something to get

this stuff implemented.

So I wouldn't be surprised if there's a

lot of lobbying going on from Flock and

these other ALPR.

companies to get these systems implemented

in a lot of different cities,

unfortunately.

But we have seen time and time again

that local city councils are very

responsive to people who actually show up

and care.

So if this is something that there's even

a whisper about in your communities,

I think it's super important to make your

voice heard and voice your distrust of

luck and your dissatisfaction with any

sort of

ALPR system because it's a massive

invasion of your privacy being basically

tracked wherever you drive,

wherever you go in a city,

potentially revealing a lot of personal

information about yourself.

So yeah, the flock system is not great,

not great at all.

I guess one thing that kind of crossed

my mind talking about this,

like more at like the government level is

how does this even interact with like,

you know,

the fourth amendment and like all these

laws to like you know have actual privacy

does does privacy just not exist in public

if if they're just allowed to record every

place that they see your car like how

does that work exactly yeah i mean i

think this stuff specifically points to a

larger problem that we have with the laws

in at least in the us currently some

countries have solved this but it's not

super widespread but i think

basically when you're in sort of a public

space which would probably include any

roads because that's government property

they will say you have no expectation of

privacy and they can basically track you

or take your picture or do whatever sort

of privacy invasive things they they want

to do um

And that's all perfectly legal because,

again, you have no expectation of privacy,

according to them, which is, I think,

just a super unfortunate situation that we

have with the current privacy laws.

It's sort of related to this other problem

that we have with the Fourth Amendment

with the government.

relying on third party companies like data

brokers,

but to gain this information without

having to go through official channels

like getting a warrant.

But in this case,

since the systems are kind of operated by

these governments and law enforcement

agencies themselves,

that sort of like third party loophole

isn't being used as far as I know.

But I do think that accessing these

databases

should absolutely require a warrant.

I mean,

I think that even collecting this

information in the first place should

require a warrant,

but that's kind of tricky with the privacy

laws that I stated.

There just aren't a lot of safeguards in

place right now to protect people from

being surveilled in a mass way like this.

And I think that that's a big problem

with all of these systems and mass

surveillance systems in general.

are kind of giving up a lot of

privacy for dubious gains.

And it's really just getting rid of like

any sort of responsibility on law

enforcement's end to perform their own

investigations,

they can kind of offload this to these

computer systems who can trace anyone and

kind of get give results based on whatever

algorithms are in place,

which is not a very targeted approach at

all, which I think is really bad.

Yeah,

and I think also talking about this like

massive database that's, you know,

available nationally as well,

like we can kind of move into this

little,

I don't kind of wanted to use this

as backup to show that this is like

a really bad idea, but cops are,

they keep getting arrested for using this

technology without people's consent for

people that aren't,

for people that aren't actually criminals,

right?

So this story here from four or four

media cops keep getting arrested for using

flock to stalk people.

Who would have thought that that

information could be used for that as

well?

Yeah.

So basically there was a couple of police

officers who were using this flock tool to

basically track their ex-girlfriend's

license plate through the flock automated

license plate reader system database.

And apparently this officer used it sixty

nine times.

So, you know, I think.

This is data that is ripe for abuse

as well,

because all it takes is this data to

get leaked or like, you know,

for that to be like an API issue

where someone's able to access this and

they can basically find out where anyone

lives, right?

Because their cars are going to be driving

around.

I don't know.

I just think it's too much data and

it's centralized too much into like these

massive databases.

And yeah,

it's almost too much power to give people

And I feel like it's almost,

it's obviously not the same level as

facial recognition, right?

But it's like still like a similar thing,

right?

It's like just tracking you based on your

number plate instead of your face.

So, I mean,

it's definitely less invasive than that,

but it's like,

I feel like it could kind of segue

into that eventually if they're like,

you know, lobby hard enough or anything.

Yeah,

I think that that article is a good

example of the dangers of there being no

checks or accountability on these systems.

I mean,

you take a look at this sort of

reporting and you read about what this cop

was doing and his...

behavior was so egregious uh this the four

or four media article says it was so

commonplace that uh his colleagues noticed

him researching his ex-girlfriend's

whereabouts while the officers were

sitting in their police cruisers so he was

being pretty open about it and i think

that a lot of those cases which lead

to arrests um are going to be completely

ridiculous like that but a lot of cases

I think almost certainly there are a lot

more cases where this behavior is

happening,

but because they're not doing it in such

a stupid way, like this guy,

they're not being caught.

And this kind of thing is just going

to happen because there's really nothing

in place to stop them besides...

David Price- Maybe being reported by by a

colleague or being caught up in some sort

of manual audit at some point,

but in the moment,

all of these systems are just sitting

there waiting to be used by anyone who

has access to them so.

Yeah, exactly.

Like you said,

I think just having this power in the

first place represents a danger.

I think that people in general just can't

resist using this sort of thing if they

if they have access to it.

At least at least some people,

which is just another way that people are

put in danger by by these systems.

Yeah, exactly.

I guess we've kind of covered like that

quite thoroughly now.

I guess we can kind of dive into

this next story here from this one here

is about WhatsApp.

So if you didn't know already,

like it's kind of been an ongoing thing

that for the last three years, I believe,

WhatsApp has been suing NSO group because

they keep using their technology to hack

people's devices through WhatsApp.

So basically this new story is basically

an update to that.

WhatsApp says it caught new spyware

attacks linked to the NSO group in

violation of court order.

So basically there was a court order that

specifically said that NSO group could not

target people on WhatsApp.

And basically it was found,

WhatsApp found that there was

evidence that they were still doing that

um so here i'll just read straight from

this article last year as part of a

years-long lawsuit launched by whatsapp

against nso a court ordered the spyware

maker to stop targeting whatsapp and its

users whatsapp claimed that the new

phishing campaign revealed on monday

violated this permanent injunction and as

such filed a contempt order against nso um

Yeah, so this injunction, I guess,

stems from a twenty nineteen mass hacking

campaign by NSO that targeted more than

fourteen hundred WhatsApp users following

the discovery.

WhatsApp notified the victims and sued the

spyware maker.

And a jury ordered NSO to pay a

hundred and sixty seven million in

damages,

which was later lowered to four million.

Oh, my goodness.

That is tragic.

But, yeah, I think this this story,

if you're not familiar with NSO,

one of their basically the biggest

victims.

I wouldn't say the biggest,

but like maybe the most prolific Pegasus

spyware.

That's like one of their biggest products,

I guess.

And you know,

this is a company that is actually put

on a block, like a block list in,

in,

in the U S and they've even had

sanctions and stuff.

So, you know,

this is like a company that is not

particularly

good, I would say.

So this is kind of not that surprising

that there would be still trying to hack

WhatsApp users.

But I don't know.

Do you have any thoughts on this one,

Jonah?

Yeah,

so all of this kind of stems from...

Some rulings that Meta got in their favor.

It was back in just May of last

year.

They were awarded that, what was it,

a hundred sixty seven million dollars in

damages in the injunction against NSO

Group being able to hack WhatsApp,

basically.

And then in October,

the payment was reduced to four million,

like you said,

but that injunction against NSO Group

basically blocking them from targeting any

WhatsApp users was granted insulin effect.

So the fact that they are continuing to

do so anyways,

is just a blatant violation of that court

order, which is crazy.

So I guess we'll just see.

I guess we'll see what comes of this.

they are basically seeking to hold NSO

Group in contempt of court because they

are violating that ruling.

So will it make a difference?

I guess I don't know.

I kind of doubt it since it seems

like NSO Group is going to be flagrantly

violating all of this stuff anyways.

And I don't know how much exposure to

the U.S.

jurisdiction that NSO Group even has

because they...

are putting a lot of pressure on them.

This article, did you mention,

they are going to continue with their

plans to enter the American market.

The US government hasn't removed NSO Group

from that block list yet,

but apparently they are lobbying to get

that done.

Hopefully this represents a gigantic

hurdle for NSO Group to enter their

operations here because I think,

depending on who they're selling this to,

I wouldn't be surprised if their end goal

is to get these tools in the hands

of law enforcement agencies or local law

enforcement

in a similar way to these flock cameras

we were just talking about which would

represent a huge danger in in the name

of like supposed help with investigations

and stuff like that so yeah i mean

it's kind of all i have to say

it's a it's a quick story but at

least meta is not letting this go which

is which is something

Definitely a rare, rare meta W, very rare.

Um, but like,

I think this is also like,

they did mention in this article as well

that like, uh,

this spyware maker NSO group,

which is like an Israeli company, um,

did get acquired by us investors.

So like,

that does raise kind of some questions if

possibly, you know,

that does mean maybe this technology might

end up being implemented in the United

States.

But I mean,

I think it's also too early to tell

at this point,

especially considering that they're still

on the block list and they're still being

sanctioned.

So I think it's, yeah,

it would definitely be really terrible if

this did start rolling out,

like this technology,

because I feel like NSO Group has been,

I mean,

I think you could argue maybe that this

technology is good when it's used against

bad people,

but I also think it does end up

being used for bad things as well, right?

Like when you have this much power to

hack people,

it is going to be used for something

bad.

I'm not really super familiar with who and

what they use this technology,

NSO Group's technology on,

but I don't think that should be

used on anyone if possible.

I mean,

I feel like it also could be targeting

like journalists and all that sort of

stuff as well.

I'm not really sure though.

Yeah,

I think that's the main thing that we've

seen.

Journalists, activists,

politicians especially.

There's been, I mean,

we've seen examples of this happening to

politicians in Europe and other countries.

We've also seen

i believe we mentioned this in a recent

episode but ron wyden has been warning uh

senators and other congress people here in

the us that they are being targeted by

spyware on their phones and they need to

switch to more secure systems so this

stuff is pretty prevalent and a lot of

people are impacted even at even at these

higher levels uh by intelligence agencies

and other people who are using this

spyware so it is

it is a danger and these spyware companies

are basically developing all of this in

the open and selling it, which shouldn't,

shouldn't really be,

shouldn't be allowed at all, honestly.

Yeah, it is,

it shouldn't really be happening,

but unfortunately it is.

I guess also kind of like a follow-up

a little bit to the,

to the story where we talked about like

the Phlox, Phlox license plate readers,

there's this new story here from

massachusetts if you want to grab that one

yeah so some good news in this case

this was reported by tech crunch

massachusetts votes to pass a new privacy

rights bill that bans sale of precise

location data massachusetts lawmakers have

voted to pass privacy protections that

grant the state's residents new rights

over accessing and deleting their data

held by big tech giants the bill also

bans companies from selling their users

precise location data

Later on in the article,

they say the move makes Massachusetts the

latest U.S.

state to push for stronger consumer

privacy rights after years of documented

abuses by the wider technology advertising

and social media industries.

While the United States does not have a

nationwide privacy law,

unlike many of the world's major

democracies, U.S.

states have filled the void of legislation

by bringing their own patchwork of privacy

rules that apply to their states.

So I think at this point in time

in Massachusetts,

the lawmakers have passed this bill.

The article says that their Senate has

also advanced their own bill doing the

same thing,

and now those bills are basically going to

be combined in the Senate,

and then it'll be sent to the governor's

office.

So there is that whole process where the

governor eventually has to

approve this,

but the article says that it's expected

that they will sign it into law.

It's just not clear

when that will happen so there is a

bit longer but the article says that the

bill if it is passing the law is

going to apply to companies that handle or

process the personal data of more than one

hundred thousand consumers which will

mainly affect medium-sized startups as

well as silicon valley technology titans i

think in addition to the big tech

companies that will be impacted by this

Another major impact this is going to have

is on cell carriers because they have been

found to sell sort of this location data

to data brokers and other parties as well.

And hopefully this puts an end to that,

at least in Massachusetts.

I think that this is a really important

issue because

The data broker thing,

as I alluded to in that flock story,

is kind of a loophole around the Fourth

Amendment.

Basically,

all of these private companies are selling

data to data brokers,

and then those data brokers in turn are

selling all of that data to the

government.

And the government can say, basically,

since they're getting this information,

like a third-party company is voluntarily

giving it to them they don't have to

you know have a warrant in order them

to give the handover that information

they're saying that a warrant isn't

required to obtain all of the sensitive

information about people when normally if

they wanted to obtain that information

from the companies that process this

information directly they would have to

get a warrant in a court order to

tell like google for example to hand over

the data so the data broker thing is

a gigantic loophole in

Privacy laws,

at least in the US right now,

that definitely needs to be patched

because there's really no oversight

whatsoever when it comes to the government

using all of this data that data brokers

are collecting.

This data broker data is also used by

a lot of different companies for stuff

like targeted advertising,

which will lead to problems like

surveillance pricing,

which we've talked about in previous

episodes where companies will eventually

adjust prices for things based on all the

stuff that they know about you.

And geolocation data,

like where you're traveling, reveals,

again, a lot about where you're going.

This is not just from where you're driving

in your car, like with Flock,

but this would be data from your phone

and other technology sources that

can reveal even more information about you

than, than Flockwood.

And all of that data is,

is very revealing and very powerful.

I mean, we,

we know how revealing it is because we've

seen the privacy policies of like car

companies these days,

like spelling out all of this data that

they can get basically by,

by tracking the computers in your car.

And it's a ridiculous amount of,

of information that they are able to have

and

Yeah,

it's really just not something that should

be in the hands of all of these

companies kind of sharing it all around.

So stopping that from happening is a huge

win for people in Massachusetts.

And hopefully more privacy laws are

implemented or national privacy laws

implemented that stops all of this even

further.

Yeah,

I think this is like one of those

things where we're seeing like,

it feels like almost every year we're

seeing like more and more states like

adopting these privacy laws.

And like, you know,

maybe that does mean that there'll be a

push towards something national because I

feel like that is kind of like the,

that would be ideal, right?

It would be better if it was a

national thing instead of just like state

by state, right?

Or is it better to have things like

this or...

Yeah, absolutely.

It would be better to have a national

law that's more uniform.

That sort of thing is obviously harder to

pass, I think.

And in the meantime,

more states adopting this is is super

important.

So hopefully this sort of legislation in

other states gets passed forward.

But yeah,

having a minimum baseline across the

entire country would be it would it would

be a huge improvement because

There's probably companies who aren't

going to comply with state laws,

especially if they have not a huge

exposure to that state.

So making it uniformly applied to all

states in the United States would be a

huge improvement as well.

Definitely.

I think one thing that was kind of

surprising to me, though,

in this specific law that the TechCrunch

article talks about is the law would block

the sharing or sale of sensitive

information without a user's explicit

consent.

So you're saying, like,

I don't know if I'm reading between the

lines enough here, but, like,

does that mean that if you consent to

this,

then they can technically go ahead and

just sell the sensitive information?

Is that kind of what I'm reading right

now?

Yeah,

I'd be concerned about this a bit

because...

There aren't a lot of protections,

I think,

in place about people accepting terms of

service.

And like,

could this be snuck in there into these

things that people just kind of agree with

or agree to without reading them?

I think that's a concern.

That hasn't, in a lot of court cases,

really held up,

that you can just hold people to these

super lengthy terms of services that the

companies know most people probably aren't

reading in full,

but it's certainly going to make any cases

against these companies harder,

so I wouldn't be surprised if that's a

technique that they try to use here.

I think there's also an issue with...

A lot of the times when people consent

to their data being collected in this

manner or being sold in this manner,

it's because they don't have maybe the

context or the education about data

privacy, for example,

to understand all of the different ways

that this data can be used.

Because typically,

if companies are going to ask you to

opt into giving a permission on your phone

or opt into participating in a program

like this, they're going to highlight,

like,

the benefits and not highlight all of the

downsides that are taking place.

So then it becomes a question of like,

can people provide informed consent in the

first place when it comes to stuff like

this?

And I think in a lot of cases,

that isn't really the case.

These tech companies know far more about

how to exploit the data that you're giving

them than you know about what data you're

giving them.

So it is a huge imbalance

in that whole dynamic that I think is

dangerous.

So yeah, I guess to answer your question,

these laws do leave open a lot of

questions.

And again,

it's sort of a situation where we kind

of have to see how it all plays

out, basically.

Yeah,

it did seem like this law in particular

had people like Evan Greer from Fight for

the Future and the ACLU also saying that

this was a really good move.

Even if there might be things that aren't

super great about it,

there's still a little bit of a loophole

there.

it's definitely still like cracking down a

little bit, right?

Like,

I think we should try and get the

wins where we can.

Like if, if there's a,

if there's something that goes through,

that's like still offering some protection

to people,

that's better than something that's,

you know, just wholesale allowing it.

So that is still better.

Right.

Um, and I think this also, like,

it kind of touches a little bit.

If you look on this article,

it also touches a little bit on,

The author of this article mentions that

data brokers have basically relied on app

developers selling their users location

data.

People will just kind of allow access at

all times to their location to apps and

stuff like that.

And that's also being used to aggregate

into these data brokers as well.

So I don't know.

It would be interesting to see how that

also plays.

Because if someone...

if all this means is that then those

app developers just have to say like, oh,

do you explicitly consent to us selling

your location data?

I'm sure most people might actually say no

to that, but I don't know.

It definitely does raise questions about

that, but at least seems like,

this might have some impact at least on

larger companies.

Is this something as well,

like I see a lot of these laws

apply only to like larger like

organizations,

like medium organizations where it's like

a hundred thousand plus consumers.

Is this like a concern as well?

If it's like a bunch of small players

that are just doing this as well,

like is that kind of also a bypass

for this or?

Yeah, that's a great question.

I don't really understand why,

I guess I'm not really super familiar with

the data broker or data exchange landscape

when it comes to much smaller providers.

I don't know how common that is or

what kind of use cases they would be

doing if you have less than a hundred

thousand consumers worth of data.

What are you realistically doing with that

and who are you selling it to?

I don't really know.

I think a hundred thousand consumers is

maybe a little like that bar is a

bit higher than i would like it to

be i think it should be a bit

less but

I think there is some danger,

especially with small businesses,

that they would want to balance this

against because it's also very easy for

small businesses to be kind of accused of

violating all of these laws that they

didn't necessarily even know about and

then having to defend against that sort of

thing.

Even if they're not even doing this in

the first place, I think that would be...

that could be killer to a lot of

small businesses just being involved in

unnecessary lawsuits.

So I think that that is the reason

why we commonly see a lot of these

laws have some sort of bar where it's

only going to apply to larger

organizations, even the GDPR and the EU.

A lot of the provisions only are going

to apply if you have, I think,

more than like a certain amount of

employees, if I remember,

which is another way that this is commonly

done.

So

Yeah, I'm not sure if I totally agree,

but if you are not past that,

a hundred thousand consumer threshold,

you might not be doing mass surveillance

in the first place,

because when we're talking about mass

surveillance,

typically it's like this is going to

impact everyone in the community or this

is going to impact, you know,

people nationwide,

like millions of people are going to be

impacted.

So this does limit the impact of smaller

situations.

But I don't know

How dangerous that is.

I do think that the most prevalent cases

of this are going to be these big

tech companies, like the article says,

and putting a stop to that.

Regardless of what anyone else is doing

with this data,

that's still going to have a huge impact

on people's privacy.

So it's a good first step.

I guess what you were saying about it

being a good stepping stone,

I think that that's totally true.

We talked about that a bit when we

talked about the Surveillance

Accountability Act that Naomi Brockwell

drafted.

And I even asked Naomi Brockwell about

this, like,

do you think it's likely to get passed?

And she said, no, probably not at all.

And the reason is that this stuff is

still super important because it gets the

conversation going or it gives us...

a base to build off of with more

comprehensive privacy laws in the future.

I think governments are just slow,

whether that's because of bureaucracy or

whether that's because it's by design or

whatever.

They are just slow to take action and

prevent this sort of thing.

But establishing some precedent helps with

speeding things up in the future.

And just making people more aware of this

with laws I think helps with speeding

things up in the future.

A big reason that the Surveillance

Accountability Act was so important was

because it just gets things out in the

news that like, oh,

the government is doing this.

There's some efforts to stop it.

Even if those efforts aren't passed,

it's a conversation that we need to have

and that lawmakers need to have.

And that sort of,

just from an educational perspective,

is super important to have.

yeah,

any sort of privacy law being passed is

a huge improvement,

but there's certainly still a longer,

there's certainly still better paths that

this could go and this could be improved

pretty greatly,

but hopefully this leads to that

happening.

Yeah, definitely.

I think it's also important,

like we've kind of been pushing for this

for people to, you know,

contact your local representatives,

make sure you're doing like that

grassroots action and trying to get people

to

actually take this stuff seriously.

Um, because yeah,

it is definitely does seem like it is

a bit of an uphill battle, I guess.

Um, because there is so much,

like we've talked about it previously,

like with flock and all this like mass

surveillance stuff that's being rolled

out.

Um, so yeah,

definitely is important to do that.

Um,

do you have anything more you want to

add here or do you want to dive

straight into some site updates?

I think that's kind of it.

Yeah,

why don't you give us some updates on

what you've been working on on the video

side of things so far?

Yeah,

so I guess I'll also give an update

on what Nate's been working on too,

because we've kind of been also working

together on it.

But yeah,

Nate put together a Jellyfin tutorial,

because I don't know if everyone's seen,

but Plex is now upgrading the cost of

their lifetime Plex pass,

which basically gives you unlimited access

to all the

features of the Plex Media Server.

They're upgrading the cost to seven

hundred and fifty dollars US dollars,

by the way.

And that is kind of expensive.

It was like I think it's now two

fifty.

And before that, it was even less.

It was like I swear it would drop

down to like fifty before.

So it is kind of wild that they've

increased it so much.

In fact, a little bit greedy.

So we kind of wanted to, you know,

cash in a little bit on that and

put something out for people that are like

very frustrated with

plex doing all these silly things i think

plex has also kind of done some strange

stuff that's kind of diverged a little bit

from the people that use their product

like like including a bunch of streaming

stuff um not really focusing as much on

the media service stuff i think people are

kind of

looking for alternatives.

So that's what we're trying to do is

provide like a way for people to switch

away to something that doesn't even cost

any money.

You should donate,

but it doesn't cost any money.

Jellyfin is like an open source project.

There's no strings attached.

It's definitely less expensive.

of a good experience,

but if that is okay for you,

like if you can put up with that,

then I think it's definitely a good

alternative to Plex.

Um, so yeah,

Nate has recorded that this week and he

shot that over to me the other day.

So I've already started like doing some

basic edits on it.

Um,

that should be an interesting video to

look out for.

And we've also been working on a video

about passwords.

So that is currently out to members on

YouTube.

And I think we're just waiting on,

we've had like a lot of stuff going

on behind the scenes this week.

So we haven't had time to put that

on peer tube yet,

but that will be also up on peer

tube at some point.

Um,

that that's a video kind of going through,

I feel like there's a lot of

misconceptions about passwords and,

what is a secure password.

So that video was written up by Nate

with some help from Jonah as well.

And we kind of went through a lot

of the,

I guess,

misconceptions that people have and,

you know,

tried to give people good actionable

advice on how to create good passwords.

So that's definitely going to be an

interesting video that will go public.

I believe that will be going public on

Saturday at ten a.m.

Central Time.

So definitely look out for that going

public.

But right now it's available to members.

Yeah,

that's sort of everything that I've been

working on.

What about you, Jonah?

Yeah,

I just want to say about the Plex

stuff quick.

I hope that that does convince a lot

of people to switch to Jellyfin.

I think that all the Plex stuff,

especially the weird stuff that you

mentioned about them adding streaming

stuff and stuff like that is really

indicative of the VC funding issues that

we've seen.

Obviously,

Plex has taken on a lot of money

and now investors are hoping to cash in

on that.

And Plex doesn't really have a clear path

to doing so probably because you know,

what is it it just serves files on

your local server in theory,

but now they've spent all this time and

money on building features that nobody was

really asking for.

So

I honestly think if Jellyfin is a bit

too rough around the edges for people,

it's probably also worth looking into MB,

which an older version of that,

which used to be open source,

is what Jellyfin forked from.

I've been using both Jellyfin and MB

recently.

just because i don't agree with the

direction plex is going in at all and

i will say that the experience right now

on mb is significantly better they they

charge some amount of money for either a

subscription or a lifetime pass obviously

significantly way less than plex but i

think that it's a project

that plex users who are willing to use

these i guess proprietary alternatives

because plex they're already using plex

which is proprietary it's worth looking

into because i think mb is doing what

plex should be doing which is just being

focused on serving your own media and not

also adding in all of these other things

or taking on a bunch of vc funding

to add pointless features that nobody

asked for so

In the meantime,

if Jellyfin isn't going to work for you,

I do think it's worth looking into.

But in the long term,

I hope an open source solution like

Jellyfin really takes off and gets a lot

of attention.

And hopefully these changes will make it

so that more people are contributing to

Jellyfin because now you kind of need to

if you don't want to spend that absolutely

insane sum of money that Flex is now

demanding.

Anyways, yeah,

I'll share some other things that we've

been working on.

A lot of the time I've spent this

week has been redoing our server setup,

which is not super exciting,

but I'm converting it all into scripts and

code that we will publish on our GitHub

so there's more visibility into what we're

running and more people can make changes

to all of that stuff if there's any

sort of

emergency because right now we just kind

of have a lot of systems that we

need to get unified so i don't know

how many people are interested in that

sort of thing but if you are for

some reason probably hopefully by next

week we'll have a repo on github that

will be public that kind of

has all of that stuff in it.

So at least on my end,

for me personally,

that'll be cool because it simplifies a

lot of the stuff that I have to

do.

The other thing I've been working on is

more stuff for verified apps database.

And the app that we have on Android,

I've been improving that,

working on getting it submitted to app

stores,

and also just going through submissions.

So there's a few more apps in there.

We have a lot of submissions open right

now.

People have been really contributing.

I would definitely say if you would like

to help improve our services,

it would be really appreciated to submit

the apps that you have on your phone

as well so we can kind of expand

this database.

We are expanding it right now with apps

that we can basically verify from

different app stores,

but eventually we'll move on to verifying

stuff like APK files that you download

from websites directly or from GitHub or

what have you.

Yeah,

I'm just excited about that project

because I think it's a pretty useful

feature for people on Android,

especially if you're downloading apps from

the internet or maybe untrusted sources

because, for example,

you don't have access to Google Play

yourself,

either because it's not available in your

country or because you just don't want to

use

Google Play services in a Google account.

And you have to get your apps elsewhere.

This is a good way to check whether

those apps are legitimate, in my opinion,

and hopefully other people agree and find

it useful.

So yeah,

basically working on building that.

In other site news, mostly Fria,

but also the team in general have been

publishing

more news stories to privacyguides.org

slash news so a lot of the stuff

that we've seen that we don't have time

to talk about here on this show typically

gets published at privacyguides.org slash

news so that is a good place to

really keep up with a lot more news

stories in this space that we're aware of

in addition to what we post on the

forum and stuff of course from the

community so yeah definitely check out the

articles there if

That is something that's interesting to

you.

I would definitely recommend it.

All of the stuff that we work on

at Privacy Guides,

it's made possible by our supporters.

So if you like all the stuff that

we're doing and want to support the

project,

you can sign up for a membership or

you can donate at privacyguides.org slash

donate.

You can also pick up some swag at

shop.privacyguides.org if you want

something there.

Privacy Guides, of course,

is a nonprofit project,

we research and share privacy related

information.

And we facilitate that community on our

forum and matrix where people can ask

questions, get advice,

learn about staying private online and

preserving your digital rights.

So yeah,

I think with all those updates out of

the way,

let's talk about our next story about a

new Apple feature,

which is automatically going to change

your compromised passwords.

if I could pull it up here.

This was reported by Bleeping Computer.

The headline is, just as I said,

there's a new Apple feature here.

They say, at WWDC,

Apple announced an Apple

intelligence-powered feature that can

automatically fix weak and compromised

passwords.

Right now,

Safari and the built-in Apple Passwords

app can automatically flag weak duplicate

or compromised passwords.

Now, this is an AI-powered feature.

Apple says that the built-in password app

and Safari can now use AI to agentically

take action based on your behavior and

secure your passwords automatically.

This feature will launch with iOS for the

passwords app in Safari,

which can automatically update eligible

accounts to strong passwords.

I think that this is a cool development.

There's a lot of concerns about AI and

how this will be used.

For example,

I would certainly hope that this feature

in particular is going to be done entirely

locally.

Apple says in a blog post that the

latest models that they have run on device

and on servers using private cloud

compute.

But I would imagine something like this is

going to work on device.

It doesn't

specify very concretely in this article

from what I've seen how,

how this feature is going to work.

But so yeah,

that's something to look into.

But hopefully it works well,

and is reliable.

Because I do think this is a big

problem that people have when they when

they switch to password managers, it's,

they import all of their passwords,

and they're usually like all the same

passwords,

and then they have to go through and

update them all.

And that is

difficult.

So a one button way to fix all

of your passwords or to fix passwords that

are compromised in a data breach would be

actually helpful for a lot of people and

hopefully would improve their security.

I guess the main thing is I hope

this doesn't stop websites from adopting

even more secure alternatives like

passkeys.

I think that that's the ultimate fix

probably is to get much more passkey

support

implemented across websites.

We've seen a lot of passkey adoption so

far,

which has been super great because it kind

of guarantees all of the security by

design.

So I'm glad to see a lot more

sites adopting that than had adopted like

security keys, for example,

even mainstream consumer sites are adding

passkeys now because it's just an easier

and more secure way to secure your

accounts.

So yeah, overall,

I don't think this is a terrible idea.

I think for people who are using the

Apple Passwords app, it's pretty cool,

which I would imagine it's a lot of

people because it's by default.

It's not a password manager that we would

probably recommend at all.

We have password manager recommendations

on our website,

mainly open source ones like Bitwarden and

KeePass are the big ones.

And I don't know how likely it is

that they'll be able to add a feature

like this anytime soon.

But for a lot of people who are

just using the built in password manager,

I think that this will improve kind of

the baseline security for all of those

people.

Jordan,

did you have anything to say about that

change?

Yeah,

I think this is kind of indicative of

Apple's, like, control over this, like,

whole ecosystem, right?

Like,

it feels like not many other companies

would really be able to do this.

And, like, maybe if there's...

I don't know.

It's just that they have such, like,

ultimate control.

I think one thing I have seen is

a lot of people will have, like,

a bunch of passwords in Apple Passwords

because it literally will ask you to save

your passwords in there automatically and

people just do that, right?

And...

I imagine a lot of times,

at least the people that I've seen in

my life,

they'll have the passwords app and it will

just be a list of compromised,

compromised, compromised.

So I think if this just updates those

passwords automatically in the background,

it's not super clear how this works yet.

And I think a lot of things when

it comes to AI and Apple,

I think we need to definitely hold our

breath a little bit because

They don't seem to be super good at

rolling out this sort of stuff.

They'll promise something and then it

won't really happen.

I don't know.

I don't think this,

it was kind of frustrating looking at WWDC

last week or this week, I guess,

because there was such a focus on like

AI stuff and,

And we didn't really see that many

security improvements or anything like

that.

So this was one of the few things

that was able to be positive, I guess.

I'm not really sure.

I feel like as soon as you start

assigning tasks to an AI agent,

it starts to become a little bit sus.

They were saying on here that it was...

an agentic password manager.

Like, I don't really like that idea.

I don't like,

I don't like the sound of that.

Like,

I feel like that could possibly end up

being, Oh,

we changed your password to something

that's really bad.

Or we submitted your information

somewhere.

I don't know.

I'm not really super convinced by this,

but if it does just do what they're

saying and it's kind of, they just,

you know,

plugged on a bunch of AI buzzwords,

maybe it's a good thing for those people

that are using Apple passwords.

But yeah,

Yeah,

Apple's definitely been making quite a big

fuss about like...

oh,

Apple intelligence is going to be very

private and secure and not sending your

data anywhere.

So that still remains to be seen.

I think most people on our team are

definitely more against this technology

than for it.

But if this technology has to get

implemented on people's devices,

because of the trends in the industry,

I'd rather it gets implemented in a way

that isn't sharing it with massive AI

corporations.

So yeah, I don't know.

Yeah,

definitely a lot of questions that need to

be answered here, I think.

Yeah, definitely.

I think that's kind of all I have

to say, though,

if you want to take our next story

here.

Yeah, sounds good.

So this is a story...

from Canada.

So signal DuckDuckGo among firms weighing

Canada exit over lawful access bill.

So I don't know if people have been

following,

but basically there's been a bill called

Bill C-二,

which basically would force companies

inside Canada to retain metadata for up to

a year and allow basically for police to

access that information and obviously when

we talk about stuff like Signal and

DuckDuckGo that technology is not

particularly compatible with this right

it's uh these are technologies that are

that work on the least metadata collection

possible right and as soon as you start

like forcing these companies to retain

this metadata and to do this sort of

stuff it's

it sort of breaks the entire like privacy,

like aspect of these tools.

So quoting from the article,

in its current form,

Bill C-Twenty-Two would convert the

everyday tools Canadians rely on into

sprawling,

insecure surveillance apparatuses.

signals vice president of strategy and

global affairs told the house of commons

public safety committee on tuesday if we

are ever forced to choose between

betraying the people who rely on us and

leaving a market we will leave which i

think is really good that these like

companies are actually making a stand on

this um i think we've seen this before

especially like in the uk we've seen

people saying they're going to leave um

Similar things in other countries that are

trying to pass these like metadata

retention stuff, which is good.

And basically the argument for this is

adding these metadata retention things and

adding backdoors for the good guys can

always be exploited by cyber criminals and

expose a bunch of this metadata to people

that shouldn't have access to this.

And the solution here is don't.

No metadata.

Don't collect it.

It doesn't need to be collected, right?

That's why it's so frustrating when

there's these politicians that are trying

to get this stuff pushed through.

So yeah, another quote here, effectively,

the government through this legislation

seeks to insert itself into the networks

and devices of various providers.

So yeah,

it's kind of a bit of a problematic

bill.

I've seen this definitely popping up a lot

as being basically a

Pretty much,

it's basically a mass surveillance bill.

As far as mass surveillance goes,

this is basically a mass surveillance

bill.

Even companies like NordVPN said they

would basically remove service from the

country this past.

This is going to affect the VPN services

too.

Windscribe,

which is a Canadian-based company,

that would be interesting to see how that

would affect them because they are

based in Canada as well.

So like,

would they have to move countries?

Like,

would they have to change jurisdiction if

this passed?

That is not entirely clear.

Well, I did see, I like this quote.

It's later on in the article,

but Windscript did have a quote here.

Apparently they wrote on X,

we pay an ungodly amount of taxes to

this corrupt government and in return,

they want to destroy the entire essence of

our service to basically spy on its own

citizens.

Not happening.

We'll move HQ and take our taxes

elsewhere.

So it seems like they are definitely on

board.

They get out of Canada train if such

an invasive bill like

C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C

I think that is one of,

that's always been one of those sticking

points for people in our community is

like, oh, you're based in Canada.

Like Canada doesn't have the best track

record when it comes to this sort of

stuff.

And now I guess we're kind of seeing

this hasn't passed yet, but you know,

there's definitely a possibility that it

will.

And it's good to see that companies,

especially even ones that are based in

Canada are like literally saying,

we're going to just get up and leave.

That should be the response to this,

this sort of law passing.

Um, yeah,

there was some more people just saying

like, there was also the, uh,

there's also tail scale,

which is also based in Canada.

Um,

they were also saying that they would have

to think about, you know,

maybe moving jurisdictions as well.

Um, I think when,

when you start having all these companies

coming out saying that they would

literally have to,

they would rather move jurisdictions than

stay in your country, that,

that is kind of a clear sign that

what you're trying to propose is very much

not a good thing.

yeah i mean all of these backdoor

proposals are just fundamentally flawed

there's because there's no way to

implement these securely and i think you

quoted this earlier but um exactly like it

says in the article these companies have

like not only do they should they like

not do this for security reasons but they

have an obligation to all of their

consumers that

They're going to protect this data from a

cybersecurity perspective.

All of these companies have an obligation

to protect people from data breaches,

and this basically prevents them from

doing that.

It's not very clear to me why governments

don't really understand this when it comes

to certain tech companies,

but it seems obvious that this is going

to impact companies far beyond just tech

companies or VPN companies or whatever.

If there has to be a backdoor into

encryption like HTTPS, for example,

that's going to impact the security of

your bank account transactions.

Yeah.

not just like from the government,

but from hackers.

We have said this before and I'll say

it again.

All of these back doors are going to

be exploited because there's no way to

implement them in a way that only one

person like the government can access and

nobody else can.

So people will eventually,

maybe not immediately,

but there will always be some sort of

exploit or way that people can use these

back doors outside the government to get

access to all this data.

Even if in like a perfect fantasy world

that these governments seem to believe in

for some reason,

if we imagine that there's a backdoor that

only they can access,

I think the flock story that we talked

about earlier also demonstrates that the

government can't be trusted with this data

because we'll see government agents,

law enforcement officers, et cetera,

use their access to these systems to track

people unlawfully and completely abuse

the type of backdoor that a law like

this would implement.

So it's just an incredibly dangerous

situation that Bill C-二 is creating for

Canadians right now.

And it's something that anybody in Canada

needs to really take a step to take

steps to prevent from happening.

You need to make your voice heard once

again.

because this sort of thing again public

outreach and kind of these grassroots

efforts to block bills and other stuff

from happening it can be effective but

people really do need to get out there

and make their voices heard and this is

a particularly dangerous form of of these

of this kind of back door that should

not be be put in the law so

yeah canada watch out one really important

thing like you were talking about with the

grassroots like organizing of people this

has already been uh knocked back i believe

like there was already a previous bill

that was tried they tried to pass that

was like similar to this i believe it

was bill c-two i believe um the strong

borders act which also included a bunch of

like mass surveillance stuff and that was

also knocked back because of public outcry

so like

it does actually work in this case,

it a hundred percent does work.

So this article itself is saying,

you know, at the end of it,

it's saying like,

they're going to make a amendments to the

spill to make it so that it's not

going to break encryption,

which I think is a little bit ridiculous.

So what, what does that exactly mean?

You know,

they're saying that they wouldn't shorten

the retaining of metadata.

They would still keep it for a year.

so you know I think this is a

little bit ridiculous it's it shouldn't be

it shouldn't be passed definitely get get

in contact with your representatives if

you're in Canada and try and make sure

that you let them know that this is

a really bad idea and you know the

government has not really it sounds like

they might be talking a lot to law

enforcement which you know of course they

want more data to to be able to

you know do police work but

kind of flies in the face of you

know individual freedom for people in the

country and like access to these tools so

um yeah it's just a kind of an

unfortunate situation but if you're in

canada definitely try and get in contact

with your representatives there's a good

uh article from citizen lab in canada that

kind of analyzes this law in more detail

and explains why

This stuff is fundamentally flawed.

That's a quote from them, and it's true.

If you open up this Global News article

from our newsletter where we have all the

sources,

this analysis is linked at the bottom of

the article.

So I would definitely check that out as

well,

especially if you're in Canada and you

need to find more reasons to tell

lawmakers about why this sort of...

bill is absolutely unacceptable and can't

work and will really endanger everyone in

Canada, their privacy, their security,

their... Yeah, I mean,

their security online in general.

So give that a look if you're in

Canada.

And again,

you got to take action because this kind

of stuff is super,

super dangerous if it gets passed.

Anything else to add, Jordan?

I think I kind of... Yeah,

I think that's everything I've got to add.

We can dive into the next story here,

I guess.

All right.

This one is reported by Bleeping Computer

again.

Headline is,

over four hundred Arch Linux packages

compromised to push a rootkit in

InfoStealer.

More than four hundred packages in the

Arch user repository are distributing a

Linux rootkit in InfoStealer malware

targeting credentials and access tokens.

A report from the open source intelligence

community Independent Federated

Intelligence Network notes that a new

maintainer is spoofing a trusted publisher

on the AUR platform to push infected

packages.

Later on in the article,

they say that the Linux binary that's

being distributed through all of these

package build files has InfoStealer

functionality,

which targets the following types of

sensitive information.

GitHub credentials, SSH artifacts,

HashiCorp, Vault tokens, browser,

cookie databases, Slack data,

Discord data, Microsoft Teams data,

Telegram data.

They say AUR maintainers are working to

identify and remove all malicious commits,

but obviously this has a pretty widespread

impact on the entire Arch ecosystem.

In a message to the community,

in Arch Linux Package Maintainer,

urge users to report any malicious package

they find.

As a general rule,

it's recommended to only trust projects

with frequent updates and an active

community around them.

I think overall, in my opinion,

this is kind of indicative of the danger

that the Arch user repository has if

you're using it.

There are quite a few warnings on the

site and throughout their wiki that you

shouldn't just kind of blindly trust the

AUR with packages and what's being

installed because they are

user-contributed and really anything could

be in them.

And if there isn't any oversight because

it's a...

not a super popular package, for example,

this kind of stuff can break through.

But at the same time,

I think the Arch community and many Arch

users do kind of blindly install a lot

of these packages.

And there's even a lot of programs that

you can install that kind of treat the

AUR as just a normal package manager.

And you can install things without really

taking a look at them.

And I think a lot of people...

think it's easy for a lot of people

to kind of fall in this trap of

just treating the aur as a package manager

instead of um instead of really looking

through the scripts that they're

installing because it's just a matter of

time i think it's it's the reason that

a lot of people will agree to using

apps without reading the terms of service

or reading the privacy policy it's just

overly complicated setup for a lot of

people that they're just not going to do

in favor of an easy solution but in

the case of arch it will will cause

problems like this that i think will

impact a lot of people so one of

the reasons i'm not really a fan of

arch is kind of what i'm trying to

say a lot of other distros have

Real package managers and maintainers,

any Linux distro is kind of going to

be susceptible to this sort of problem,

but we definitely see it to a lesser

extent on distros that have

a more trustworthy and more locked down

system like the Debian package manager,

for example,

has maintainers who are who are more

trusted than just like anybody being able

to upload a package to the Debian,

for example.

So yeah,

kind of I think that's kind of my

thoughts on this.

Was there anything you wanted to

highlight, Jordan?

Yeah,

I think I just agree in general with

like your analysis there.

Like this is like the Arch user repository

is literally just packages that people

uploaded.

Like anyone, like literally anyone,

when we say like actually anyone,

it's anyone can do that, right?

So like it definitely increases the

chances of something like this happening.

And then, you know,

having all these packages that people have

installed that have got like maybe

thousands of downloads and, you know,

some maintainer,

in quotation marks,

comes and takes over this package build,

they can insert malware.

You are putting a lot of trust in

that.

And I think if you are using the

Arch user repository because you need to

for some reason,

I would definitely check every single time

you update packages through the Arch user

repository,

make sure you actually check to make sure

that the package build file is not

compromised,

which is not always super easy,

but I think at least having some vigilance

is better.

And like Jonah said,

it's better to use platforms like

different distros that have more

restriction on who can actually apply for

package maintainers and do this sort of

stuff.

You don't actually need to use the Arch

user repository on Arch Linux either.

So you could just

not but i mean i can kind of

understand those sometimes as packages

that you really need um yeah i think

that because it does have an official

package manager but i think that just the

scope of it on on arch is much

smaller than on like debian or fedora for

example and so a lot of people do

end up relying on the user repository as

well um for even like

some larger applications that you would

expect to just be included in an official

package manager.

It's also worth noting that this is hardly

the first time this has happened with the

Arch user repository.

We talked about this on the show back

in July of last year, I believe,

where malicious packages that were

impersonating different web browsers on

the Arch user repository were infected

with a different sort of malware.

Yeah, it's the I mean, these kind of,

I guess you could call them supply chain

attacks in general.

Or just this sort of malware distribution

thing on these user contributed

repositories of packages is a it's a it's

a big concern.

And it's probably one of the bigger issues

that's facing Linux on desktop users at

the moment.

So definitely something to be aware of.

And

Yeah,

hopefully that gets cleaned up and

hopefully not too many people are

impacted.

I didn't see an analysis of like...

which packages were included I believe

there's a list somewhere but I don't know

like how popular the packages used were

like how many people this could

potentially impact so yeah if you're an

Arch user I would definitely look at the

list of effective packages they also um

They've provided a report linked to in

this article,

which has some indicators of compromise.

So you could use that to look at

your system as well and see if you

were impacted.

But definitely something to worry about if

you've used the Arch user repository

lately.

So yeah, Arch users, I would say,

should look into this for sure.

Definitely.

I mean,

if that's everything we have to add on

that story,

I guess we can dive into some forum

updates.

In a minute,

we'll start taking viewer questions.

So if you've been holding on to any

questions about any of the stories we've

talked about so far,

you can go ahead and start leaving them

on our forum thread or in the comment

section on the live stream.

It's been kind of quiet this week,

so maybe we may not have any.

But if you do have something,

do leave it soon so we can see

it.

For now, though,

let's check in on our community forum as

always.

There's a lot of activity there,

but there was one interesting thread I saw

this week,

which was basically a discussion on using

Tor instead of Molvad Browser with Molvad

VPN.

So basically the discussion on that

specific thread was like,

if you're just browsing clear net sites,

does Tor really add that much more

protection,

especially if the VPN is paid for

anonymously?

Do you want to kind of dive into

this one a little bit, Jonah?

yeah so and i believe we cover a

lot of this on like the page about

mullved browser for example and also just

our vpn overview and how it differs from

tor i think for a lot of people

you know using mullved browser with

mullved vpn is probably a perfectly

safe setup to use.

Whenever you're using a VPN,

you do have to trust that VPN provider,

of course,

which can be a problem or cannot be

a problem depending on your specific

situation and threat model.

I think a lot of people do use

VPNs and trust them and using mobile

browser in conjunction with that VPN is

going to provide

Good fingerprinting protection,

if that's the sort of thing you're

concerned about with the websites you

visit, especially, I think,

as Mulved Browser continues to become more

and more popular and you're using Mulved

VPN,

you do have a decent crowd to fit

in with where at least you have some

protections in place, which is good.

Tor, on the other hand,

there's pros and cons to it,

but the biggest advantage is that

you don't have that trust model you there

because there's clear separations with the

three hops you have you know your guard

node at the beginning which is going to

know your identity but not what you're

accessing and then you have the exit node

which will see what you're accessing but

not who you are and the middle node

which

separates those two and keeps the data

separate so they don't know who the other

node in the chain is.

So from that perspective,

it does provide a lot more

protection of your anonymity, for example,

than a VPN would provide.

On the other hand,

Tor notably is much slower than using a

VPN.

I think that's a big problem that Tor

has.

Another problem that Tor has,

which is maybe a bit less talked about,

is

Unlike generally VPN providers,

since anybody can contribute in exit node

and that exit node is kind of responsible

for your connections to websites and your

DNS lookups and things like that,

there have been cases where Tor exit nodes

uh either hijack your connections or

redirect you to malicious sources this is

especially the case if you're pretty much

downloading anything over http instead of

https there's kind of general uh i guess

malware running on these exit nodes which

will hijack that just because they can be

contributed by

any users.

So we've seen attacks, for example,

against people who are downloading

cryptocurrency related applications where

these exit notes will serve malicious

copies of those downloads for you to

for you to download and get hacked as

a result.

That's probably less likely on a VPN,

especially a trustworthy VPN,

in our opinion, like Movad.

HTTPS, of course, prevents that,

so that's something you should always look

at when you're using Tor Browser.

If you are using HTTPS everywhere and

you're blocking HTTP connections,

then that is much less of a concern.

You don't have to really be worried about

it because in that case,

your connection really is end-to-end

encrypted.

There is still the case where like exit

notes can get some metadata about your

connections,

which may or may not be an issue

typically that impact is very small,

but it is something to keep in mind

if you're accessing clear net sites so.

Yeah,

I think that kind of covers what I

have to say.

Does that make sense?

Yeah, that makes sense.

No, I think you covered that great.

I think, yeah,

there's definitely benefits, right?

But I think this brought up a really

interesting discussion,

which you didn't touch on yet,

which is multi-party relays.

Because like you were saying,

there is the risk of a Tor exit

node being compromised and

you know,

being able to maliciously redirect

connections, right?

When we talk about like a multi-party

relay,

like I think the one that most people

think of is like iCloud private relay,

where there's two trusted parties,

but both of those trusted parties don't

like...

uh share the information right like

there's an ingress proxy an egress proxy

and then it goes to the website um

so instead you're not trusting like a

random operator of a server right um which

is definitely an interesting i i don't

think it offers the same privacy

protection like as tor right but it's

definitely like a little bit of a

interesting middle ground which offers

decent performance and also offers some

additional privacy compared to a

traditional vpn

yeah i the only two that i'm aware

of is icloud private relay that you

mentioned and also obscura vpn and obscura

staff members and their ceo are on our

forum so there's some threads if people

have questions about it you can ask there

but that one works with mullved an obscure

vpn might be a very good option to

use in conjunction with mobile browser

because your exit node is going to be

and so you're going to be blending in

with even regular Molved users as well as

obscure users on Molved browser.

So it is an improvement in the trust

model for sure.

It lacks the middle relay that Tor has,

which kind of separates your identity from

the ingress node and the exit node,

which basically comes down to you deciding

whether you trust the ingress node and the

exit node

collaborate with each other.

In the case of iCloud,

you have to trust that Apple and either

Cloudflare or Fastly or whatever,

they have multiple providers on the other

side.

You have to trust that they're not going

to be sharing data and kind of linking

your traffic together.

In Obscura's case,

you have to trust that Obscura and their

servers aren't going to collaborate with

MOLVAD and share data with each other to

kind of correlate that.

I think these are reasonable assumptions

to make, even if Obscura,

which is a much smaller, newer company,

for example, wanted to get this data,

which I really don't think that they do.

But the other side of that would also

have to agree to collaborate,

so that would also assume that Malvad also

wants to conspire to get your data,

and I think that's very unlikely.

I think it's definitely a good a good

option.

But again, compared to torts,

it's still a trust based model,

even if it's relatively safe to put your

trust in it,

whereas tours model is kind of

untrustworthy by design,

and you have that technical separation

that makes it harder to tie all of

that together.

So

Yeah,

I think the multi-party relay stuff is

interesting.

I believe Free has written an article

about multi-party relays,

and it's something that we are, I think,

generally still looking into,

but there's a lot of threads on the

forum about that sort of thing that I

would definitely recommend people take a

look at if they are concerned about any

of this stuff.

Because, yeah,

I think at the end of the day,

I do consider...

mall-led browser and a VPN to be a

very good option for a lot of people.

And there are inconveniences of Tor

browser that I think are resolved by

mall-led browser for a lot of people,

which is good.

Yeah,

and also I don't feel like you can

use both.

You don't have to use only Tor or

only Molvad.

You can actually use both of them.

And I think we also,

you've talked about this quite a bit,

Jonah,

but having a VPN going while you're

connecting to Tor is actually,

there are some benefits of doing that as

well.

So that's not a concern either,

as long as it's set up correctly, right?

Yeah, yeah, that should be the case.

OK, yeah.

So I don't know.

This thread was kind of interesting to me.

There was a lot of discussion about the

differences here between these two

software projects.

But yeah,

I think definitely check it out if you're

kind of also a bit confused,

because Nick kind of jumped in a couple

of times and clarified some things there

and made sure people were kind of

understanding the benefits of Tor.

yeah it was uh an interesting thread there

um that's kind of everything that i saw

on the forum that i didn't really see

any any other big threads unless there's

something you want to highlight um yeah

that's a good question i don't think i've

seen too much on the forum this week

i've been kind of checking it uh

what's the word, sporadically,

because I've been spending too much time

trying to redo all of our server stuff

this week, which is fine.

But yeah, taking a look here,

I don't know if there are any that

really stick out to me.

I think this is a good time to

remind people we definitely can take

questions if anyone has any,

do kind of a Q&A.

If not, then we won't do that.

But if you have any questions or want

to know about anything either we talked

about or privacy related,

this is the time to share it in

the chat.

Yeah,

I'm not seeing any comments on our forum

thread this week.

It was a bit later this week just

because we've had, yeah,

there was some hectic stuff going on.

But, yeah, hopefully that worked out okay.

And I didn't see any comments in the

chat.

We had a couple of people saying, like,

hi.

So, hi.

If you're still watching.

Not any questions here, really,

that I'm seeing.

Another story.

I think this came out in the last

week.

You'll have to remind me.

I didn't catch all of the show last

week.

But Brave just launched Origin Browser.

I think that was only...

like on Saturday, if I remember correctly.

So that's something that happened in the

last week,

which is something to check out because we

talked about Origin Browser,

Brave Origin before on the show,

and it's a pretty cool development from

them, I think.

Yeah, it's definitely, yeah,

it'll be interesting to see if maybe

that's something that gets recommended on

privacy guides.

But I think it's definitely something

we're still looking into.

I know some team members have already said

that they've like bought it and they're

trying it out.

So if we get more like comments,

I guess, from the community,

maybe that's something that could get

added in the future.

But it is definitely an interesting thing,

right?

Like having a paid browser, right?

in the recommendations.

I don't know if that would ever...

I guess there's technically no restriction

on that, I guess.

I guess to their credit,

it is free on Linux, which we do...

I mean,

we would recommend people switch to Linux

anyways.

So there is that option for you.

I think we'll probably add it as just

a note in the Brave section.

I don't really know if it has a

lot of advantages over normal Brave for

most people,

at least from a privacy perspective,

but

if you like a more minimal browser or

if you're the kind of person who likes

ungoogled chromium for example this might

be worth checking out because it's a much

more minimal version of brave and unlike a

lot of those chromium forks and in other

browsers it's being

maintained and kept up to date in a

very reliable way whereas a lot of like

on google chromium builds don't don't even

have like automatic updates for example

which is super important to have in

something with the attack surface as large

as a web browser so yeah if you

want a really minimal browser i think it's

i think it's worth checking out definitely

and it does seem like they have taken

the time like they've taken the time to

do the payment system in a way that's

not like

connecting it back to your identity or

anything as well.

So like they definitely have thought it

out pretty well.

I think that's basically always been the

concern in the community that I've noticed

is like people complaining about Brave

having so much bloatware attached and all

these features that are like unnecessary

and like it's increasing the attack

surface.

I think that is not particularly...

That's not really a huge issue,

I don't think,

but maybe there's people that really,

really despise it popping up every so

often when they add new stuff.

So that is a solution for you,

I guess.

And yeah, I don't know.

It's definitely going to be interesting to

see if they end up adding any Brave

Origin specific features,

but it's probably not.

Looking like that will be the case.

We did get a question here from Canabida.

Hello, Canabida, a regular on the stream.

And a lot of people talk about Zen

browser.

Are you familiar with that?

Any opinion from privacy perspective?

I'm going to throw this to you, Jonah,

because I feel like you know.

Yeah,

I've said it a few times before on

the stream,

but I have been using Zen browser for

a while and I quite like it because

it provides a lot of features that other

browsers aren't providing.

I will say, speaking of Brave,

I've talked to some people at Brave

recently and they say that they're working

on bringing a lot of these Zen browser,

Arc browser sort of features over to

Brave,

which I'm pretty excited about because I

do run into issues

In Zen browser,

sometimes of websites being less

performant or not working exactly the same

as they do in chromium,

which is a bit annoying.

So I have ended up using both brave

and Zen browser a lot of the time,

but some changes are coming.

Some of them are already available in like

brave nightly builds, for example,

with like better sidebars and workspaces

and

Website containers,

which I'm really excited about.

That's the main feature I really like in

Firefox,

and bringing that over to Brave is just

a good option for people to have.

But yeah, overall, personally,

I do like Zen Browser a lot,

and I think that they...

have been keeping up pretty well with

updates and they have a good privacy

policy.

It's something that I think not a lot

of other people either on the team or

in the Privacy Guides community in general

have taken too much of a look at.

So it's not something that

I've that I've really gone in depth on

or that other people have to my knowledge

so I can't really say for sure like

just from a privacy security perspective

where Zen browser lands so I would

hesitate to like say you know everyone

should switch to Zen browser or anything

but yeah personally I use it and I

have used it for a while and I

like it and I just think it's worth

supporting because I like all of these

Firefox forks that

are doing things correctly and

professionally and implementing regular

features,

but are also being developed by people

other than Mozilla,

which I've spoken quite a bit about in

the past.

I think that they are just kind of

mismanaging the organization and the whole

Firefox project,

and I think it's really unfortunate.

And so supporting these other projects,

I think, is very cool.

So, yeah,

that's what I have to say about it.

yeah it's definitely i think zen browser

is like definitely taking a lot of

inspiration from arc browser which was

really popular at one point and then they

kind of dumped that project and said oh

we're moving on to making this ai browser

now um which i've been testing out like

the last week and it is it doesn't

really live up to the same like uh

it doesn't live up to like the same

standards and like it doesn't have the

same features as arc does it's kind of

like a stripped down version

I don't know.

It's quite unclear what is going on with

the browser company as well.

I think they got purchased by Atlassian as

well,

and it's like the whole project is kind

of a little bit up in the air,

whether this will be something that even

the new browser that they're working on

will even stick around.

They keep making quite large changes to

that as well.

But yeah,

I've definitely really enjoyed Zen

Browser.

I used it quite a bit as well.

But I think more browsers should just have

this feature built in by default.

Like it should just have vertical tabs

implemented in the same way that Arc does

it.

Because I don't know,

it's just a no brainer.

It just works so much better.

Like I feel like no one's implementing it

quite the same.

And apart from Zen, basically.

Zen and Arc are basically your two only

options if you need

the same setup, right?

I know Firefox and Brave both have

vertical tabs,

but it's like a gimped version of what

you can find in Zen browser and in

Arc browser.

But it would be interesting to see Brave

if they actually do commit to this and

they add those extra features that Zen

browser has.

I think the main thing that I miss

from Arc browser is the ability to have

profiles on the bottom and you could just

easily switch between browser profiles and

it segments your data and extensions and

stuff.

I don't know.

As far as I know,

there's no browser that does that.

So I guess, yeah,

it is kind of a tricky situation if

you care about those.

Zembrowser almost does that, I will say.

But they don't segment extensions.

Yeah, it uses the container tabs,

which is, I'm OK with that.

That's OK.

But I don't know.

I do feel like having separate profiles,

it did enable a bit more customization,

which

I don't know.

It's kind of unfortunate they stopped

working on that project,

because I do like Zen Browser.

It is basically the replacement for Arc at

the moment.

I believe Brave is doing their version of

containers with a multi-profile approach

similar to Arch.

Don't quote me on that.

I haven't looked into Brave's

implementation and what they're testing

right now too much.

But if that's true,

and I hope that's the direction they go

in, that will be pretty exciting.

um i didn't actually know arc was uh

acquired by atlassian that's that's funny

i haven't looked into arc in quite a

while but yeah it's i i don't really

understand the direction that that whole

company is going but any arc users who

really liked arc i would definitely say i

mean if you were going to trust arc

which is like a proprietary service by

like a big company uh

zen is zen is going to be better

than arc from a privacy and security

perspective even if there is some reason

that zen isn't as great as like the

browsers we recommend um it's still you

know worth checking out for arc users at

the very least because it'll be I think

it'll generally be an improvement outside

of a couple a couple features like the

ones that you mentioned yeah definitely I

definitely would recommend at least giving

it a shot

Another news story on the forum that I

remembered seeing this week,

I just saw Proton release their

ProtonDrive command line interface for

Linux.

So finally,

some support for ProtonDrive on Linux,

officially.

Still,

the command line version doesn't do as

much as their typical desktop clients,

but it's a huge step forward.

I hope some people on Linux find it

helpful.

I hope that this also is able to

be used by Rclone, for example,

or other Linux projects that have sort of

implemented a ProtonDrive interface.

interface already,

but built around unstable APIs that Proton

hasn't really published.

They're just kind of doing it on their

own,

but Proton could maybe break it at any

time.

Maybe this will provide a more stable

approach to connecting to Proton Drive

from a Linux machine that other projects

can make use of as well.

Linux support is always, I think,

laking behind with anything Proton does,

unfortunately,

but at least they finally got around to

doing something for ProtonDrive.

I think it'll make ProtonDrive a bit more

usable for people who otherwise have a lot

of Proton storage they can't really make

use of right now.

Yeah,

it definitely sucks for people that are on

Linux that have been like kind of,

I feel like it's definitely been somewhat

neglected.

I think it's definitely gotten better.

Like if you've tried the ProtonVPN Linux

client, it's actually really good now.

It used to be like a web wrapper

thing, but they made it better.

So I don't know.

It's good to see them actually at least

pull through on some of their promises.

I know they've been kind of saying this

was the first step towards getting a

ProtonDrive client on Linux.

But I think what's going to happen is

the open source community is just going to

be like, fine, I'll do it myself.

And then they'll just like, you know,

make, make these projects, make like a,

an open source implementation of like

ProtonDrive or something like that before

Proton actually releases something.

So yeah, I would like, you know,

have it work with rsync or rclone, sorry.

And yeah, I don't know.

It's definitely, it's definitely positive.

Hopefully that's,

a thing that we get to see,

you know, in the next year,

I hope a Linux client for proton drive.

It's good to see that at least trying

to support it.

Cause it did feel like for a long

time,

they were kind of radio silent on it.

And then, you know, people were like, oh,

you're working on it.

Right.

And then proton was like, oh, we're not,

we haven't started.

So that was definitely a bit of a

shock for some people.

um another thing i want to highlight kind

of from kind of inside updates but uh

posted on a forum one of our team

members uh just wrote a guide for people

in the netherlands to set up uh something

called address secrecy which is a privacy

protection you can you can get there i'm

not personally super well versed in

things in the Netherlands,

so I'm not the right person to ask

details about this.

But if you are in the Netherlands and

you want to check out this post on

our forum in the community Wiki section

that comes from one of our team members,

I would definitely say check it out.

Again,

if you're in the Netherlands and if you

have questions about it,

you can ask them about it and they

will know far more than either of us

will.

But I just want to highlight that that

was posted because it is a pretty

comprehensive guide to all of that stuff

in the Netherlands with links to how you

can set that up and who it's for.

So just another cool thing that got

posted.

Excellent.

Yeah,

I did see that you did post the...

It does look like the Passwords video is

on PeerTube now.

So, sorry.

Yeah, for members.

For members, yeah.

So, that is out now.

If you go on the forum,

you can find the link to watch that.

Yeah.

So, definitely check that out.

It'll be going live publicly at ten a.m.

Central Time in the U.S.

So...

Yeah, should be a good one.

Got another question from Turnip Fanatic.

Does Zen Browser have the same fingerprint

in Firefox?

No,

it's definitely different from Firefox.

So that is something to keep in mind.

I don't know personally how...

good the or if they do any sort

of fingerprinting protection like to

distinguish you from other zen browser

users or if you will look kind of

similar to other zen browser users but

generally in firefox without like

hardening protections you're not going to

get much fingerprinting protections in the

first place you can block some tracker

scripts with just an ad blocker of course

but

no kind of technical means um unless

you're going to be switching to something

like mullved browser so yeah i definitely

wouldn't use zen browser if you need

fingerprinting protections but i also

wouldn't use really any browser besides

mullved browser or firefox if

fingerprinting is of

large concern to you because even even

like regular firefox for example is not

going to provide very strong protections

brave provides some protections but

they're done in a different way that i

would consider a bit less robust than what

Mulvad and Tor are doing,

but some people disagree with that,

so it's kind of up to you what

you think.

But yeah, Firefox browser, Zen browser,

I wouldn't trust either of those with

super strong fingerprinting protection,

so that's something to keep in mind.

I do think Firefox did at some point,

they did actually, they do have,

I think it looks like November last year,

they did add.

So if you use a strict mode,

it actually does have like an enhanced

tracking protection thing,

which does have some anti-fingerprinting

protection.

So, I mean,

if you're going to use Zen Browser,

I'd just say crank all the settings,

like put everything on maximum possible

thing.

Because because yeah,

Zen browser is going to inherit all of

those settings that Firefox has,

of course,

so you can enable like enhanced tracking

production and stuff like that,

which will improve things to some extent

for sure.

Yeah, but I think you're right.

It's definitely nowhere near the same

level of protection as like Moldad browser

or Tor, right?

It's like less protections that are going

to have less of an impact on the

browsing experience,

but also offer some additional privacy

stuff.

And as far as I'm aware,

like Jonah said,

like Brave is kind of ahead on that

as well.

So at least, you know,

if you decide to use Zen browser,

you'll get some of those benefits from

some of those settings in Firefox itself.

So yeah.

definitely enable those if you do decide

to use it.

That would definitely help somewhat.

Yeah.

I think in the absence of any other

questions,

we can probably start to wrap things up.

I don't see anything on the forum or

in chat.

We also do have a members-only Signal

community.

We're happy to take questions there as

well.

We haven't gotten any questions there

today, of course,

but I need to be better about...

notifying that group that these streams

have started so maybe next week i'll let

them know uh ahead of time that they

can join the forum and ask questions there

but that is an option for sending in

stuff uh because we'll check like signal

during the show and in that group and

see if anything is coming in addition to

the chats in in forum posts here so

you have a lot of ways to

interact with us on the stream if you

if you want to say anything um otherwise

are you fine to wrap things up jordan

or is there anything else you want to

talk about here yeah i think we can

wrap things up now um yeah we've kind

of covered everything that's on the agenda

this week

Sweet.

Well, thanks, Jordan.

Yeah, I'll end this here then.

If I can find my notes.

All of the updates on this week in

privacy,

we share them on the blog every week.

We email them out on the newsletter.

So you can sign up for that newsletter

or you can subscribe to the blog with

your favorite RSS reader.

If you want to stay tuned and read

all of the sources.

of the stuff that we talked about in

this episode.

For people who prefer the audio version of

this,

we also offer a podcast which is available

on pretty much all podcast platforms and

through RSS if we haven't submitted it to

your podcast app of choice for some

reason.

These videos are also synced to PureTube

after the fact,

so if you want to catch this away

from YouTube,

you can always follow our channel there as

well.

Again,

Privacy Guides is an impartial nonprofit

organization that's focused on building a

strong privacy advocacy community and

delivering the best digital privacy and

consumer technology rights advice on the

internet.

If you want to support our mission,

you can make a donation on our website

at privacyguides.org slash donate.

To make a donation,

you can click the red heart icon located

in the top right corner of the page.

You can contribute using standard currency

via debit or credit card,

or you can opt to donate anonymously using

Monero or with your favorite

cryptocurrency.

Becoming a paid member of Privacy Guides

will unlock exclusive perks like early

access to video content and priority

during our

Q&A if we get a lot of questions.

You'll also get a cool badge on your

forum profile on our forum and the warm,

fuzzy feeling of supporting independent

media.

So with that out of the way,

thank you all for watching and we will

see you next week.

Bye, everybody.