Will the Pixel XI support Graphene OS?

Is your Firefox install compromised?

Will Signal allow a way to register

without a phone number?

All this and more coming up on This

Week in Privacy, so stay tuned.

Welcome back to This Week in Privacy,

our weekly series where we discuss the

latest updates with what we're working on

within the Privacy Guides community and

this week's top stories in data privacy

and cybersecurity while taking questions

from viewers like you.

I am Nate,

and with me this week after a bit

of an absence is Jordan.

How have you been, Jordan?

Good.

Just been super busy with video content on

the back end,

but really excited to hop back on here

with you to discuss the latest privacy and

security news.

Yeah,

there is a boatload of stuff happening

with videos that we will definitely get to

later on in the episode,

but it is good to have you back

for sure.

Um, I guess with that,

we'll go ahead and jump right into our

first story, which is about the new pixel.

And, uh,

I believe you're going to be taking that

one first, Jordan.

So I'll turn it over to you.

Yeah, let's dive into that.

Um,

so this story here is about Google's new

pixel, eleven series devices.

I'm quoting from this.

Google says the tensor G six delivers up

to twenty five percent faster browsing

and fifteen percent faster app loads

compared to last year's Tensor G-Five.

The Tensor G-Six is the updated system on

a chip in the Pixel-Eleven series of

devices.

The chip pairs with an upgraded image

signal processor with a new TPU,

and Google says it's fifty percent more

powerful than the previous generation,

enabling features like a hundred and

twenty times pro zoom,

instant night sight on the pro models,

and this new

This TPU chip also drives Gemini Nano,

Google's on-device AI model,

which the company says now runs with

higher quality and lower latency.

But the most important thing that we

wanted to highlight from this story is the

Tensor G.

works alongside a new Titan M three

security processor built for post quantum

cryptography,

which Google describes as protection

against emerging highly advanced digital

attacks.

And the company adds that the Titan M

three has earned common criteria

certification at the same level that's

used for SIM and bank cards.

The chip also handles quantum safe secure

boot and runs trusty Google's trusted

execution environment on all four phones.

So this is always a thing that happens

every time Google announces a new device.

I guess we should dive into the most

obvious thing and the question that we

have as this week's episode is,

Will this support Graphene OS?

So I guess I'll throw this back over

to you, Nate,

and we can kind of discuss this a

little bit.

Is this, you know,

what's the timeline going to look like for

this?

Do you think it's something that we can

expect soon?

What are the updates that Graphene OS has

shared so far?

Yeah, so I guess I'll...

I guess I'll lead with the answer,

which is, honestly, we don't know.

For those who may be just joining us

or haven't heard, Google last year,

I think it was, mostly last year,

made a lot of

changes to their policies that kind of

shoot all android developers in the foot

or at least um android roms like graphene

calyx lineage which is uh they slowed down

the number of releases that they're

publishing for uh the aosp project um

they've i think they slowed down the

number of security patches too but i could

be wrong about that um they uh

they stopped publishing the pixel device

tree specifically.

So basically now they have to like reverse

engineer all the hardware changes.

And then on top of it,

they made a lot of the development closed

source.

So it used to be that they did

all their merge requests and everything

up,

or I may be using the wrong term

there, merge requests,

but they did all their development stuff

in the open.

So people could kind of see like, okay,

they're working on this,

they're working on that.

We could also push back if we're like,

hey,

why are you adding this feature that

sounds sus?

now instead they're doing it all closed

and then just every so often they're like

all right here's an aosp update publicly

so it's still technically source available

in open source it's just now we don't

get to see what they're doing until

they're done and between all of that uh

graphene at the time pixel ten was the

newest one and they were basically like

look you know we'll support the pixel ten

but we don't really know what the future

is going to hold because of all this

and

Um,

they said that they want to keep trying

to support pixels as much as they can,

but between that, and there's also,

it's worth noting,

there are other hardware changes to the

pixel, uh, to the pixel XI,

aside from just like the tensor and the,

the Titan chip.

Um,

the most notable one that I've seen people

mentioning is they switched the modem.

It used to be a Samsung Exynos,

I believe.

And now it's like a MediaTek something.

So yeah, it's, I mean,

even Graphene themselves have basically

said like, look,

we're not going to know until we actually

have a Pixel XI in our hands.

And then we can like kind of take

a look at it and see.

I think you shared,

if I can go find it,

you did share in our chat from the

Graphene forums.

It was like there when they were keeping

people updated.

Yeah, so here it is on screen here.

I've got the link here.

If you want to take a look at

that.

Yeah.

Okay.

Yeah, so if we look here,

it's kind of a timeline of the events

that happened to get this support for the

Pixel X,

which I guess we can kind of extrapolate

somewhat to the Pixel XI.

So if you don't know,

the Pixel X was announced on August,

August, August, August, August, August,

August, August, August, August, August,

August, August, August, August, August,

order and confirm that it supports

unlocking.

So, you know,

at this point it's been not even a

week yet.

So we don't really know what the outcome

of that's going to be.

If the devices will be unlockable,

we can assume that it might be,

but obviously the GrapheneOS team hasn't

actually gotten the devices yet.

So if you scroll all the way back

up to the top, January,

is when it was considered stable.

So a couple of months, four months,

pretty much what we're looking at here for

the Pixel X.

So I would not be buying a Pixel

XI if your immediate need is to run

Graphene OS because from their previous

experience doing this,

it took four months.

It may take less.

It may take more.

We don't really know because like Nate

said,

it's all stuff that's like

not information that we know at this

point.

And also like, you know,

they have to reverse engineer that.

And one other thing I quickly wanted to

share as well is GrapheneOS did do a

post on Twitter and they said,

the PIX-Eleven hasn't been released yet.

We aren't going to have an idea about

how long it will take until after we

have access to devices and the code.

We'll post about it on our feed when

we have information to share.

No need to ask us for updates since

we'll make posts about it.

So that's kind of the current situation,

unfortunately.

which is kind of,

it's good to know that they're going to

post updates,

but we don't really have a huge amount

of information at this point.

Yeah, for sure.

And one other thing that's worth noting,

for those of you who are not following

us on any of our social media,

we did actually push out a quick short

about this whole thing.

Google, or excuse me, not Google,

Graphene has that whole...

their partnership with Motorola now.

And so that could really play into this

either way.

Um,

It could be that because of that

partnership,

they're able to get their hands on certain

software resources like AOSP.

Maybe they can get a copy of AOSP

from Motorola early,

and that will help them speed up the

timeline.

Maybe they're able to take advantage of

some of their expertise.

I don't know.

Or maybe they'll just hit a point where

they're just like, screw it.

If Google's going to make it this hard,

we've got this other manufacturer that

we're working closely with,

and we have

complete insight into the whole process.

We really, really don't know.

But yeah,

I just wanted to make sure that's a

mention too.

It's part of the math, I would think,

but we don't know what part of the

math.

Yeah, fortunately,

I don't think we have to wait too

long for the pixels to ship.

They usually the preorder, I think,

is usually just a couple of weeks before

they start shipping.

So hopefully by the end of the month,

we'll we'll have an update.

But yeah.

Yeah, I guess kind of somewhat off topic.

But what do you personally think of the

devices?

Is this something you're going to be

preordering?

Are you going to be upgrading this this

year or no?

Um, probably.

So my wife and I both have the

pixel six a,

which I think stops getting support in

July.

I was looking at the pixel eleven.

So I'm the kind of person that I

like to buy the newest one just so

that way I've got like the longest amount

of security updates and stuff.

And then I'll run that into the ground.

So I'm probably going to get the eleven

a whenever they announce it.

Although my wife jokingly,

I sent her the eleven fold and I

was like, oh, we should get you this.

And she was like, unironically, yes,

that looks so cool.

I would happily buy that.

So I think what we're going to do

because we don't really have a thousand

dollars to drop right now.

I think what we're going to do is

probably wait until the twelve fold.

So like next year's phone and then go

ahead and order that for her and I'll

just get the eleven a.

Because I don't really care.

I don't need my phone to do a

whole lot.

But she likes to play some games.

She has ten billion pictures of the cats.

Like all that kind of stuff.

So she could use a little bit nicer

of a phone.

How about you?

The main thing for me.

So I do have.

I kind of have a bunch of phones.

Because obviously we need to do testing.

On different devices and things.

But the device that I do have.

Is a Pixel Nine Pro.

And I think the funniest thing.

About the Eleven Pro.

is that it starts with twelve gigabytes of

RAM,

which is less than the nine and the

ten.

So you're actually getting less RAM on

this year's model unless you pay more.

So I don't know.

I was not really impressed.

Let's just say that is a little I

know that RAM prices are getting high and

stuff,

but like if you're decreasing the amount

of RAM,

on a pro device, um, year after year,

then I dunno, that's,

that doesn't leave a very nice taste in

my mouth, but yeah,

I've got five years of,

of security updates left,

so I'm not in any rush to,

to go and upgrade.

And I've never really had any issue with

performance or anything.

Um,

so I am not going to be upgrading,

uh,

unless Google does something like really

cool, like, you know,

there's like some really massive security

feature that they add, which, you know,

the, the,

the Titan M three security process is

really cool and stuff,

but it does seem like it's not,

you know,

a massive leap in security that that would

be worth spending my goodness,

a thousand dollars or more on a new

phone.

Um, so, you know,

I'm always trying to get them secondhand

and not, um,

Not give Google money because, yeah,

Google, not a great company.

But, yeah,

so I guess we could also talk a

little bit.

You did put together like a short this

week kind of describing a lot of what

we talked about this week as well,

if you want to dive into that a

bit.

Oh, yeah.

I mean, there's not really much to say,

to be honest.

Let me see if I can pull it

up real quick here.

But yeah, I just...

Every once in a while when there are

these big announcements,

like the graphene thing or the...

excuse me,

the graphene siding with Motorola thing or

this announcement,

we try to make sure that we get

some kind of video out pretty quick.

There wasn't really a lot about the

privacy and security this time around.

Like you said, the Titan,

it's got the post-quantum cryptography

stuff on it,

but that's kind of future-proofing and

getting ahead of the curve.

It's not something that everybody needs to

run out and buy right now.

There wasn't really enough to justify a

whole video, but yeah,

we did put out this...

this short here,

which is not on this channel.

I'll have to go find it.

But yeah,

we just put out a little short video,

kind of giving people a quick rundown of

all this new stuff.

So I don't know,

that's a I don't think there's too much

to say about that one.

Yeah,

I guess we can just cover this comment

here from Dag Overhaul.

Pixel XI looks like a downgrade from the

Pixel X, lol.

Yeah, it's like what I was saying.

The Pixel X looks like it might be

better in some aspects.

It's obviously we don't really know the

specifics yet on performance and things

because...

you know,

I think it's only being given to like

people that are media and, you know,

they're obviously going to have tainted

opinions cause they've gotten a free

product from Google.

So let's wait and see, um,

what that looks like.

But Google's never had good performing

devices and, oh yeah.

So here's the, um,

here's the short we put out, um,

that Nate put together.

So, uh, yeah,

if you want to share that with people

in your, in your life about this,

about this new release and that'd be cool

too.

Um,

Yeah, I think it's some interesting news.

We wanted to cover it kind of as

the highlight this week because I feel

like everyone in the community is probably

going to be having this question.

So yeah,

so Dag says it's twelve gigabytes of RAM

versus sixteen in the Pixel X. Yeah,

that's what I was saying.

It's like it's actually wild.

It's kind of ridiculous that that's

something they decided to do.

Yeah, for sure.

NotThatPrivate asked,

what post-quantum cryptography algorithm

does the M-III use?

From what I can tell,

it doesn't look like they've disclosed

that yet.

I think they're still planning to publish

a lot more technical details.

This was just kind of the initial get

people interested, which is also why,

like you mentioned,

there's probably some tech YouTubers that

have this and stuff,

but they kind of focus on the hardware,

the performance, and everything.

Yeah.

Um, it looks like the open Titan chips,

um, this comes from the AI summary.

So I apologize if this is wrong.

It says the open Titan chips,

which is Google's open source route of

trust currently use Sphinx plus also known

as SLA SLH DSA or FIPS two Oh

five for post quantum and secure boot with

future extensions planned for lattice

based schemes like dilithium and Kyber.

So, um,

if that helps a lot of the,

the more technical stuff goes way over my

head,

but

Yeah, I think just keep an eye out,

and I'm sure they'll be releasing more

details in the near future.

Yeah,

I guess we can dive into some quick

forum threads here.

There were some people asking some

questions and saying, you know,

some comments.

Do you want to just grab one of

those real quick?

Yeah, sure.

So we posted about this on the forum,

discuss.privacyguides.net.

There's a good place to go and ask

your questions in advance if you won't be

able to watch the stream.

And we had a couple of comments

speculating, again,

on whether or not Graphene will support

it.

Um, but, uh, yeah, I mean,

it's mostly just that.

So one person said that they think

graphene will support it.

And they cited,

I think the same quote that you cited

earlier from Twitter where they said it

hasn't been released yet.

We don't have an idea how long it'll

take.

Um, somebody else said, I think not.

Uh, somebody said,

I'm crossing my fingers that the eleven

will be supported.

Titan M three and graphene could be a

match made in heaven.

So, um, yeah, that's kind of it.

Sweet.

I think that'll take us into our next

story here.

And we're going to talk about the White

House

is potentially allowing cybersecurity

firms to do offensive hackbacks,

which is new.

This is never beneficial before.

So on Wednesday,

the National Security Presidential

Memorandum was signed that instructs the

National Coordination Center to establish

a program that would allow private

security companies to apply for approval

to hack foreign cybercrime organizations.

Let's see,

the program will be overseen by executive

directors designated by the justice and

Homeland security departments and security

firms participating in the program will

undergo vetting before entering into

contracts with one of the two departments.

Additionally,

the memorandum requires procedures

ensuring operations comply with US

constitution,

federal law and international obligations.

Participating companies will have to

maintain a bond or escrow of at least

a million dollars that will be forfeit

forfeited if they don't comply with

contractual agreements.

And they must also immediately stop

operations if they discover activity

exceeding approved limits,

including unintended target of US citizens

or US based systems and notify the

National Coordination Center.

The White House said the program is

intended to disrupt foreign criminal

organizations involved in ransomware

attacks, phishing campaigns,

financial fraud.

extortion schemes and impersonation scams.

And it added that us consumers have

reported losing more than twenty point

eight billion dollars with a B to cyber

enabled crime in twenty twenty five.

So this is this is a bit of

a departure.

Because up until now, I mean, yeah,

like nobody has ever authorized

like this.

That's kind of what they're calling it.

And I don't know.

This is just really...

It's hard for me to put into words.

It's one of those things where it's very

aggressive and it's very...

I mean,

I think there's a lot of questions here.

Like for one, this kind of blurs,

or I should say further blurs the line

between government and private companies,

right?

We already have so many issues with all

these defense contractors and surveillance

contractors,

Flock and Palantir and all these data

brokers.

And there's already like a very blurry

line, especially in the military, right?

Between like private contractors and

government.

And when you have a private contractor

acting on behalf of the government,

that's definitely a

not cool.

Um,

I have questions personally about

differentiating cyber crime from state

sanctioned activities.

Like this is companies are notoriously

cautious about, um,

about attributing cyber attacks to other

countries.

And some of that is a political thing.

Like you don't want to accuse somebody of

something unless you're a hundred percent

positive, but also at the same time,

it's just, it can be really hard.

Like code is code and there can be

little indicators

based on patterns,

but it's really hard to definitively say

like this company or this group was behind

this attack.

When an organization comes forward and

attributes a cyber attack,

it's a pretty big deal actually.

And especially I'm thinking of like North

Korea, for example, which for the record,

I'm not defending this,

but North Korea largely funds themselves

by like Bitcoin theft and scams and stuff

like that.

Like their government has been so heavily

sanctioned.

That's the only way the country can make

money anymore and stay afloat.

And so that just feels like a gray

area to me where it's like, okay,

if North Korea hacks Coinbase and steals a

bunch of Bitcoin,

is that a cybercrime or is that a

state-sponsored attack?

And are they allowed to hack back or

not?

Because it does... I mean,

I didn't read the memorandum itself.

I probably should.

But this article didn't say anything about

attacking state operations.

It said trying to deter cybercrime and

disrupt cybercrime.

So like...

I don't know,

that just feels like a really big gray

area to me.

And the other thing that they noted in

here is that this could cause perverse

incentives.

Like a million dollars for most company is

not really much.

I mean,

we see companies get fined millions of

dollars for privacy violations and it's

just a cost of doing business for them.

So this whole idea of like, oh,

you have to put down a million dollars.

That's like telling me I have to put

five dollars in as a deposit to get

somewhere.

Like, oh, five dollars in,

five dollars back.

I don't even care.

It's five dollars.

Keep it.

Like, I'm not that hard up for money.

So

Yeah.

And what was it at the very end?

One of the people they interviewed said

that they described it as a perpetual

motion for billable threats.

So the idea is that private firms might

have a financial incentive to create or

exaggerate threats to justify their

contracts,

which we already see that happening a lot.

So yeah.

Yeah.

And this is,

I'm assuming you added this here, Jordan,

but at the end of the notes here,

we have like,

why is this still important for people

living outside of the United States?

Which is a really good question.

And I think it's just because this really

raises,

this raises the possibility of something

going wrong.

If a private company attacks a

Um, let's say they attribute it to,

I don't know,

China and they hack a Chinese company and

China says, no, we weren't behind this,

whether they mean it,

like whether it's true or not,

if China insists,

like we are not behind this,

that could escalate things.

And it's just,

the world is so closely interconnected now

that.

everything i mean we've been seeing it

play out for the last couple years right

it's like everything that especially big

countries china russia uk us everything

that we do has knock-on effects to other

countries around the world so it's just

one of those things where like i i

feel like there's so many opportunities

for things to go wrong there's so much

and especially in the cyberspace you can't

physically see where you're at right i'm

gonna digress real quick um darknet

diaries did an episode where he talked

about he's done a lot of episodes where

he talked about um

pen testers.

And one of them that stuck out to

me specifically was they were hired to

test a hospital.

And they talked about all the different

systems they got into.

And one of them,

they didn't know what the system was,

but they wrote it down in their report.

And they mentioned like, oh,

we got into this system.

And that particular system,

as soon as they said that,

everybody was like, wait, what?

Which one?

Hold on.

We'll call you back.

And it turned out they had hacked into...

I think it was like a laser machine

being used for surgery,

like actively being used in a surgery

while they were in the system.

And thankfully they didn't do anything.

Like they just went in and they were

like, all right, make a note.

We got into this,

move on to the next target.

And,

but that just kind of shows that like

when you're in cyberspace,

you're looking at an IP address,

you're looking at a server name.

You can't tell if that's in Beijing or

Moscow or Uganda or Germany.

Like you don't know necessarily right off

the bat.

So I think there's just a lot of,

a lot of room for things to go

wrong here for people to get caught up

in crossfire for uh tensions to escalate

um yeah i don't know that's that's kind

of my take on this thing i don't

know if i missed anything on this story

that you had any more thoughts on but

yeah no i don't really have anything to

add but i think it's uh definitely an

important discussion to have um

And I guess I would say,

what can people do about this?

Is this something that people can have a

say about?

Or is this something that's kind of just

been decided without any review from the

public?

I don't know, to be honest with you.

I would imagine...

maybe somebody who's a lawyer can correct

me.

I would imagine that this is probably

going to get challenged by somebody in

court, um,

just for being like reckless and scary and

possibly like some kind of international

illegal thing.

Not like we seem to care about that

these days, but I don't, I don't know.

I don't know what the average person can

do other than just the usual advice we

would give to anybody, which is, you know,

try to keep your stuff updated,

try to keep your stuff, uh,

good passwords and stuff.

Try to keep your stuff as relatively

hacker proof as possible.

Um,

I don't want to sound paranoid,

but maybe a little disaster prep.

I mean,

we've covered so many cyber attacks that

take down, you know, hospitals,

fuel pumps,

just kind of having like enough basic cash

and food on hand to get you through

a few days is really not a bad

idea ever for anybody.

Because you never know if a cyber attack

will bring down the payment systems or

whatever.

So

I don't know.

I don't know if we, the people,

have a whole lot of options here.

You could maybe try contacting your

representatives and being like, hey,

this seems bad.

Can we not do this?

But I don't realistically know if there

are any laws being violated here.

Right.

Okay.

Yeah.

I guess we can dive into some site

updates here.

I'll just dive into some of the stuff

I've been working on and then Nate can

go and explain some of the videos we've

published this week.

So we've got upcoming videos here.

We've got a tier list,

a password tier list video that's coming

up.

Nate has been editing that and it looks

like it's pretty much ready to go.

We just have to do a little bit

of final checking.

There's a video about

creating a Bitcoin wallet without

connecting to the internet,

completely cold, instead of, you know,

using some sort of generation method.

And the reason why we wanted to talk

about that,

we use diceware system instead of,

you know,

using a chip to generate that wallet seed

phrase,

because

There was a recent issue that we did

do a post on the privacy news section

of our site about cold wallet, I believe,

cold card, cold card, hardware wallets.

And basically the generation system that

they used was predictable,

which allowed basically anyone to

access the wallet seed phrases so

obviously that is extremely bad and that

was a complete disaster so Jonah was like

well there's a way to fix this right

so he put together this video on how

you can use basically a dice a word

list and how you can basically create a

really secure seed phrase that

is a hundred percent random instead of

being predictable,

like with the terrible situation that

happened with cold card.

So that's going to be an interesting one,

which, which should be out on,

I believe two days from now.

So definitely look out for that.

And yeah,

that's kind of what we've been doing in

terms of I've been working on some things

on the behind the scenes stuff,

working on thumbnails,

stuff like that for videos.

We've kind of trying to be debugging the

flock video a little bit.

We're not really sure why,

but it didn't seem to reach too many

people.

So we're trying to work out

why that was the case and kind of

be messing around with that too.

Okay.

So there's also some,

there's a release this week as well for

the site, which had some updates.

We updated the foundations and

organizational donors on the website,

removed a spam link,

and there was a fix to the Yubico

UTF on Linux page.

So yeah,

that was kind of a small amount of

updates this week on the site.

And there was some articles as well that

Freya and Nate have been working on.

So

There was one about a zero-day

vulnerability in Windows from Nightmare

Eclipse,

severe Zoom vulnerability allowing

malicious meeting participants to take

over your device,

Californian city declares state of

emergency after cyber attack,

and there was also one about an

system takeover.

So yeah,

let me throw it back to you, Nate,

and you can talk a little bit about

the videos that we've been publishing and

that are coming out soon.

Yeah.

So, um,

we've been kind of pushing out a lot

of videos in very short order, uh,

which is exciting.

Very cool for us.

Um, we put out one, uh,

we've been advertising this one for

awhile.

There was a, uh,

we did a video about bull run,

which was the NSA's attempt in like the

nineties, eighties nineties,

two thousands, I think to either, um,

what did we say here to either hack,

cooperate, interdict or influence.

basically everything and all the different

ways they tried to compromise encryption

on the internet.

That went out last week,

but now it's finally out to the public.

So everybody can go watch it.

Definitely go check that out.

Um, very proud of that video.

And then also, yeah, this is the, uh,

the flock one that Jordan mentioned.

Um, we're not really sure why,

but for some reason it really,

really did not perform well.

Um,

which is sad because this is an issue

that everybody's, uh, you know,

I think I mentioned last week that it

was on a John Oliver episode and like,

this is an issue that has hit the

mainstream.

And for some reason the video just didn't

do very well.

Um,

So I don't know if you have any

ideas, let us know for sure.

But in the meantime,

you can head over to neat.tube and check

it out.

Or there's also a link in the newsletter,

of course,

and you can check it out for yourself,

share it with your friends and family.

There's actually a national week of action

against ALPRs starting Sunday and going

through Saturday.

So this video was kind of released to

coincide with that and kind of hopefully

get people interested and fired up for it.

But I think that's noalprs.com for more

information on that.

But

Yeah,

that is pretty much all we've been up

to in terms of videos.

I mean,

pretty much all we've been up to.

It's a lot.

It's a lot for a week.

We've done a lot this week.

But yeah,

all this is made possible by our

supporters.

You can sign up for a membership or

donate at privacyguides.org.

Or of course,

pick up some swag at

shop.privacyguides.org.

Privacy Guides is a nonprofit which

researches and shares privacy-related

information and facilitates a community on

our forum and matrix.

where people can ask questions and get

advice about staying private online and

preserving their digital rights.

Now, as a reminder,

as you're watching the stream,

go ahead and leave any questions you have

for us in the chat.

They can be related to the stories or

they can be random privacy and security

questions.

Actually, on that note,

I'm going to go back real quick to...

laptop here left a couple questions when

we were talking about the White House

story.

You said,

why would it stop being bad just because

the state is doing it?

It's not that it stops being bad.

It's that then that becomes an attack.

If we go after,

if there's a private hacking group in,

I'm just picking a random country and I'm

sorry.

If there's a private hacking group in

Cambodia that's going around doing scams

and hacking into people's Facebook

accounts and

And we take them out.

That is distinctly different from like

attacking a government.

If the government of Cambodia is breaking

into people's Facebook accounts,

it's just politically,

it turns into a very different thing.

It's the difference between like taking

out a mugger versus taking out a soldier,

which is still,

there's still a lot of like,

I don't know.

I feel icky,

like operating in other people's space,

but my point being,

it doesn't necessarily stop being bad.

It's just,

it's a whole different can of worms.

And yeah,

You also said our IP address is allocated

more or less regionally.

You might be right.

I don't know.

That goes above my head.

I'm just saying it's not as obvious as

like if you're flying over a physical

country and you drop a physical bomb,

it's a little bit harder or at least

– I mean obviously missiles can hit the

wrong target.

We've seen that a lot in the last

twenty-five years.

But my point being is like,

it's not like you're flying over one

country and you drop a bomb and it

lands in a completely different continent.

Like, I don't know.

It just it feels to me like there's

a lot more room for things to go

wrong on that.

But I could be wrong.

I don't know.

But speaking about being wrong,

I think we're going to move on to

our next stories,

which we have a few stories about

companies acting shady,

starting with surprise, surprise, Amazon.

And I'm going to let Jordan go ahead

and take this one away.

Yeah, let's do that.

So this story here is Amazon will train

on Twitch streamers content by default

unless they opt out.

So I think we should start by saying,

just in case you don't know,

Twitch is owned by Amazon.

They're basically the same company, right?

It kind of makes sense, actually, because,

you know,

Amazon has such a large presence in the

hosting space, I guess.

They have Amazon Web Services, which,

you know,

kind of makes sense why they would be

able to run such a service like this.

So this is kind of a very controversial

change.

I think a lot of streamers are going

to be disabling this because, you know,

obviously,

why would you want your content to be

used to train AI?

I'm not really sure.

It doesn't really benefit you exactly.

So just, I guess,

reading a couple of quotes from this

article here.

In a stream on the official Twitch

channel, Twitch head of community,

Mary Kish and chief product officer,

Mike Minton,

addressed a live audience of nearly three

thousand aggrieved users,

many of whom were posting anti-AI

sentiments in the chat.

Why is it not opt in?

That's what everyone is spamming in the

chat.

I get it.

Let me opt in versus making me opt

out, Minton said.

Well, there's an honest answer.

If this was opt in,

nobody would opt in.

And that's honestly the answer.

So I think that kind of highlights the

main issue that we have with this, right?

Like this sort of thing is

something that is kind of becoming an

issue right a lot of these ai companies

will do this well they'll say you can

use our services but you have to opt

out and the opt out is kind of

hard to see it's not really super obvious

that it's possible um i think this does

the same basically the same thing right um

And quoting again from the article,

in some cases,

this created confusion among streamers

about whether their content had already

been fed to Amazon without their

knowledge.

When one user asked if their videos had

already been used for training,

Minton responded,

I don't actually know the answer to that

question because I don't know what Amazon

has done in terms of model training and

what they've used and not used.

So obviously that is extremely concerning,

especially because, you know,

They should have not been doing that if

you didn't opt into that.

I guess they could technically do that

based on their terms of service,

but not really great.

Kish noted that Twitch is not unique in

its use of user content for AI training.

Meta, for example,

uses public content from its platforms to

train its own AI models,

meaning that if your Facebook and

Instagram accounts are public,

then your data has probably already been

used for Meta's AI training.

And if you live in the UK,

you can opt out of Meta's training

If not,

the only way to opt out is to

use the private setting,

which isn't feasible for creators who

monetize their accounts.

So I guess throwing this back to you,

Nate,

this is like one of these obvious things

where it's like, why is this opt in?

Shouldn't this be like, I mean,

why is this opt out?

Why isn't this, you know,

the other way around?

It doesn't really make a lot of sense.

What's going on there?

Yeah, I mean,

it's exactly like this guy said,

this Kish dude.

They know that most people would not opt

in.

And to their very, very tiny defense,

I don't think he necessarily meant that

maliciously.

I think he just meant it's a fact.

Most people don't change the defaults.

um most people seem to even forget that

a lot of their accounts and devices have

settings uh and most people just don't go

looking for that kind of stuff they just

they get a phone or they get an

account and they just hit the ground and

start running and you know especially with

things like this like yeah they'll tweak

the profile picture and the banner and the

bio but they're not going to go into

the privacy settings that's just they

don't even care about that

So, yeah, if it was opt-in,

nobody would opt-in just because people

never change the default settings.

But that is also like the malicious side

of it is they know that nobody changes

the default settings.

So if we make it opt-out, most people,

even when they hear about this,

they're just going to be like, eh,

whatever.

It's too much work to click three things,

which actually, to be fair,

I think I saw somebody say somewhere that

–

they weren't able to do this on their

phone in the mobile app and they had

to actually like log in on the desktop.

So they're kind of making this as

obnoxious as possible,

although somebody else responded to them

and said the mobile app isn't designed for

stream or for creators.

It's designed for audience and this

applies to creators.

So but yeah, I mean,

that's the simple answer is like people

don't change the default settings.

So if they make it opt out,

most people just never bother to log in

and and fix it.

But yeah, I guess another thing is,

you know,

is there really anything that, uh,

people can do that?

Are there alternatives?

Like, is there even another platform?

I feel like, you know,

what have we got?

We've got YouTube.

Maybe I feel like YouTube would also be

doing kind of some stuff with AI training

data as well.

So it's like,

it almost feels like this is becoming like

an industry standard thing.

Like you said, with meta and,

and all that, what do you,

how are you feeling about it?

Yeah, it, it really sucks.

Um,

My wife actually sent me a TikTok about

this the other day.

That's where she heard about it.

Oh man, this real quick,

this announcement was a train wreck.

The TikTok that she sent me was like

a person.

No, for real.

It was a person like commenting on,

on all these different,

the parts that were in here and like

how amazing it was that they're just like,

Oh yeah,

we don't know if they've already trained

on your data.

And they didn't mention it in the article,

but at one point somebody asked them like,

is the official Twitch channel going to

opt out of this?

And the, what's her name?

The Mary Kish.

She was like,

Yeah, I think so.

Probably.

And it's just like, wait, what?

It's opted and you're going to opt out.

But yeah, it's it's I mean, it's tough.

Laptop here said your featured link is

this StreamYard thing.

But yeah,

StreamYard only gives you like a hundred

views.

And I don't think there's a free tier,

actually.

I think we're paying even for this tier.

Um,

it only gives you a hundred people and

it's,

I feel like the issue is discoverability,

right?

Cause like, honestly, yeah,

there's a ton of options.

You could stream in discord.

You could stream in on zoom.

You could stream in a, you know,

signal you could street,

like there's a million other places,

but yeah,

The reason people use social media at all,

the reason we use Twitter and Blue Sky

and YouTube is the discoverability.

Like, we're trying to reach new people,

especially with our message of privacy.

And when you're a Twitch streamer,

you're trying to reach new people.

So...

I don't know.

There's so many things working against

people, right?

There's, like, the network effect of,

like, again, yeah,

you could set up your own PeerTube

instance and stream off that, but, like,

who the hell is using PeerTube?

And then that becomes a self-fulfilling

prophecy and a feedback loop of, like, oh,

I'm not going to set up PeerTube because

nobody's there.

Well,

nobody's there because nobody sets up a

PeerTube.

And it's just – it's tough.

There's really no easy ways out, I think,

especially when we talk about video

because, like,

video is –

so massive and like i guess the nice

thing about streaming is you don't have to

keep the old replays um so that helps

but like youtube for example if you're

gonna make like a pure tube channel with

all your youtube videos like video storage

adds up quick and gets really expensive

really fast so it's uh it's not great

yeah laptop it's called the network effect

so

Yeah, all right.

I guess we can dive into this forum

post here, which you can grab,

because I know you definitely had some

thoughts about this one.

Yeah, all right.

So one of our forum updates we're going

to focus on here is about ProtonVPN.

ProtonVPN got accused this week of running

price sensitivity testing,

AKA AB testing on their customers.

And the reason that this particularly

became an, well, I mean,

there's a couple layers to this, right?

Well, let me just read.

Okay,

I'll read two posts here that kind of

sum this up.

So the person who originally posted this

said, since Friday, August seven,

twenty twenty six.

So we saw this actually after we streamed,

I think multiple Redditors have reported

that they are seeing different prices for

Proton VPN plus suggesting that Proton is

running price sensitivity testing on their

customers.

also called AB testing.

And they've got some screenshots here.

They said proton is formally denied it.

They've got a screenshot of that.

And they said, but when,

when scribe is calling them out on Twitter

for lying by providing evidence.

And there's a screenshot of when scribes

and they linked to all this stuff too.

Um,

so this turned into a whole discussion.

Apparently you can actually see, uh,

what is it?

I think this came from a wind scribes

tweet.

You can actually see in the code where

it says there's like an AB test.

And if you're getting content a or content

B, um, and, uh,

we did pin at the top of the

post here, protons response.

Um,

so this came from somebody on Reddit who

I believe works at proton and says, uh,

They said this topic went very strange,

very fast.

So let me expand and clarify.

Proton VPN is nine ninety nine a month

or eighty three eighty eight a year.

We used to have an introductory offer for

two years at four forty nine per month.

There's been a two year intro price of

two ninety nine per month.

It has been running for a while on

some back to back campaigns.

That price ended in July and since then

it has been three forty nine a month.

um they say that there were some like

legitimate pricing errors in the

screenshots but they said uh at the end

of a long-standing sale period we often

try an a b run of the old

and new pricing on the website during the

transition to see if anything has changed

as explained to answer the speculation

already and as confirmed by others who

independently checked it there is no

adaptive pricing as in it does not vary

by browser operating system etc and it is

one hundred percent randomized

So for the past several days,

some people will still have seen the

older, cheaper two ninety nine price.

I had been of the impression that the

A.B.

was already concluded and there must have

been some cashing going on.

But it's actually due to end on Monday

when one hundred percent of people should

see the three forty nine price.

He says there's no denial that we were

doing an A.B.

evaluation.

And then.

Yeah.

So basically they're saying, like, yes,

we were.

Doing.

A, B testing,

but we weren't doing it based on user.

It was completely random.

I could go to their website right now.

Allegedly, the test should be over.

But theoretically,

if the test was running,

I could go to their website right now

and see one test.

And then if I close my browser and

clear my cookies or whatever,

and I come back later the same day,

I might see a different test.

So...

I think, I mean, personally,

I have a lot of thoughts about this,

yeah.

But I mean,

I think I'll throw this one to Jordan

since you've been kind of throwing some

questions my way.

Do you think there's any concerns over

this kind of stuff,

even if it's randomized?

Like if they're not tracking you and

they're not doing it based on your data,

because usually that's what companies try

to do, right?

They try to, the surveillance pricing,

like we think you'd be willing to pay

a little bit more,

so we're going to give you the higher

price.

But if it's completely randomized,

do you still think that's kind of a

problem?

I think that this is one of those

things where it's like,

obviously this is because we know now that

this wasn't based on people's information.

This is not a privacy issue per se.

This is one of these things where it's

like, is this a good business practice?

Is this ethical?

Is this something that we want a company

like this to be doing?

Is this a good practice that they should

be doing?

And I think, you know,

not to pull out the slippery slope

argument, but once you start,

we've definitely seen Proton adopting more

mainstream marketing tactics,

for instance,

like running Black Friday sales,

running advertising campaigns to get

people to sign up for discounted plans and

stuff like that.

And people have been very vocal in the

community about how they don't like this,

like having banners in their inbox,

especially if they're like a paying

customer.

Some people have,

very strong feelings about that.

I think it's tricky because Proton is one

of those companies where they make all

their money from people buying

subscriptions.

And there are so many people that don't

buy subscriptions and it's kind of tricky

for them to be able to, you know,

stay afloat if they don't have that

constant stream of subscribers.

But I think the fact that they were

using, you know,

some sort of AB testing is obviously it's

not a privacy concern,

but it is one of these things where

it's like,

This feels a little shady.

It's one of these things that we don't

really like when it comes to marketing

tactics.

I think the most important thing here is

to not jump to immediate conclusions and

assume that Proton was being malicious in

this aspect.

I think Jonah had an incredible response

on this thread, by the way,

if you haven't read that.

His kind of take was A-B testing

objectively isn't adaptive slash dynamic

pricing nor price discrimination.

So this is like basically what he said

is it's basically effectively the same as

a targeted or limited time sale.

So...

you know, it's interesting.

I think Jonah had probably the most

level-headed response in that thread.

I think it's important to be a little

bit more discerning and not to jump to

conclusions immediately because this

wasn't as big of an issue as I

think people are making it out to be.

Personally,

I am not really a big fan of

Proton's whole marketing strategy when

they come to, you know,

promoting their products and their

pricing.

I think it's a little rough to be

paying

I was on the visionary plan,

but paying for the visionary plan,

still not getting everything in the proton

suite.

And I still, you know,

had some things that weren't included.

But I think it would also be kind

of annoying if, you know,

you're on the unlimited plan,

which is like two hundred bucks every two

years or whatever.

And, you know,

you're getting banners telling you to

upgrade and stuff like that.

I can see why some people might have

issues with that.

this sort of tactics,

but at the end of the day,

it doesn't compromise the privacy of the

product.

So it's not a huge concern from that

aspect.

So I don't,

I'm not sure if it really matters that

much.

How do you feel about it?

Are you kind of on the fence or

are you also kind of not a fan?

I mean,

I agree with you with the marketing.

Like I pay for the duo plan for

me and my wife.

And yeah,

we still get emails occasionally about

like, Oh, upgrade to the family plan.

And it's like, have what?

Just four accounts sitting around doing

nothing.

Like,

We don't know anybody that's willing to

take us up on it, man.

I'm sorry.

But yeah, I agree with you.

I don't know.

I think I think I'm with Jonah.

Yeah, I forgot about that response.

That is a really good response.

But yeah,

it's like it's it's if it's completely

random,

if it's not profiling you based on browser

or location or any of that kind of

stuff, in my opinion, I think that's fine.

I think it's the same as a sale.

Um,

as long as it's not targeting specific

people.

And even if it's not targeting Jordan and

Nate, you know,

if it's targeting brave users or Mac

users, or cause I,

I think airlines do that or somebody does

that.

They're like,

if they detect you're on a Mac,

they'll like raise the prices a little bit

online.

Cause they're like, Oh, you're on a Mac.

Clearly you must have money.

And it's like,

or maybe it was a gift.

Maybe I got it refurbished.

Like maybe I got it on a student

discount when I was in college.

Like, come on, man.

That's, that's crazy.

So, um,

yeah i i don't personally mind as long

as it's not actually based on any real

data and if it's totally randomized um i'm

a little disappointed to see wind scribe

kind of jump on this and attack other

privacy i i really don't like seeing

privacy projects attack other privacy

projects because to me it feels very

self-defeating like we're all the example

i like to put it in is like

if we talk about like putting it in

terms of real life security

Everybody shuts their door,

locks their door when they leave their

house, right?

If you leave your house,

you lock your door.

And yes,

that's inconvenient when you come home

with an armful of groceries and you have

to fumble with the key and unlock the

door.

But we all agree, like, why not?

Like, it's low cost.

It's very relatively low effort.

Like, it's not as convenient,

but it's safer to deter somebody.

And in the digital world,

most people are basically like leaving the

door wide open, unlocked,

opening all the windows and then hanging a

sign in the front yard that says gone

to Dubai for two weeks.

Like, and for some reason, you know,

for some reason we're busy like

complaining about, Oh,

you ran a marketing campaign.

And it's like, dude,

we're all trying to get people on the

same, like at least me, we're like,

we're just trying to get people to like

care at all to like shut the door.

And I don't know.

I just don't like seeing privacy

companies, uh,

attack each other like that.

If you want to attack the non-privacy

companies,

if you want to attack WhatsApp and stuff

like that, like go for it.

But

I don't know.

That was in poor taste, in my opinion.

But I digress.

Yeah,

I think it'd be better if people were

using Proton.

Then they'll be like, oh,

I don't want to use Proton.

Their marketing is so bad.

I'm going to go back to Gmail.

And it's like, well,

that's just not a good idea.

It doesn't work.

So I don't know.

I do think that it's important to hold

these companies accountable,

but also it is a little disappointing and

unprofessional when we see

like these organizations kind of taking

pot shots at each other.

I am not a fan,

but obviously that's up to these

organizations to work out in their

marketing and public image.

And it really does not to linger on

it too long,

but what ends up happening is for people

who...

especially if they're on their own and

they don't know who to trust,

they end up, like you said,

just quitting and going back because if

everything's like, oh,

don't use Proton because it's got this

minor thing wrong with it.

Don't use Mulvad because of this.

Don't use Windscribe because of it.

Like eventually they hit a point where,

like you said, they're just like,

screw it, I quit.

I'm just going back to what I was

doing because every time I use something,

somebody comes along and tells me that

sucks and I shouldn't be using it.

And it's just,

especially without knowing their threat

model.

And it's one of those things where like,

if they don't have somebody that they can

go to, like I have friends and family,

they hit me up all the time and

they're like, hey,

are iPhones really that private?

And it's like, well,

I know this person is never going to

use graphene.

So honestly, yes,

I'd rather you buy an iPhone instead of

like a crappy LG phone or something.

And it's just, people don't have like, if,

if you make it too hard,

they're just going to give up.

And yeah, it's,

it's not cool to see that happening in

the space.

I digress.

I'm getting off topic, but yeah.

So that was the thing.

And, uh,

just remember not to jump to conclusions

and, um, uh, uh,

another company,

it was another company laptop did another

company attack proton or a customer.

It was wind scribe, uh,

picked up this story and, um,

basically called out proton and said, no,

you are doing AB tests.

Here's the code.

But again, it's, you know,

it wasn't adaptive pricing.

That's which you can still say you don't

like AB tests.

That's fine.

I'm not telling you not to say that,

but I just want to make that clear

that like they weren't tracking people

based on browser or location or anything

like that.

It was just randomized what price you saw,

but.

I digress.

With that,

we're going to jump into a story about

Mozilla,

who had to issue new GPG keys following

an exposure, which is never fun.

That always sucks.

Let's see,

Mozilla announced on Monday that it had

issued a new GPG signing subkey used for

some Firefox and Thunderbird artifacts

after the previous key was accidentally

exposed in a GitHub repository.

The exposed key was used to sign Firefox

and Thunderbird artifacts,

such as Linux tarballs, RPM packages,

and checksum files.

An unencrypted copy was inadvertently

committed to a GitHub repo,

but it was a private repository accessible

only to a small group of Mozilla

developers who already had access to the

key via other means.

Mozilla said that our review of available

audit records found no evidence the key

was accessed by an unauthorized party.

Nevertheless,

they decided to revoke the exposed key and

issue a new one.

And in addition,

they said that they had added protections

to prevent similar incidents in the

future.

They do say that most users do not

need to take any action.

Users who manually verify GPG signatures

will have to import the new key and

revoke the old one.

And in addition,

those who use Firefox RPM packages may

need to take some steps,

which that might include me because I'm a

cubes user and everything's based on

Fedora.

So I should click that link.

And Mozilla has shared detailed

instructions right there.

Um, so yeah, I think, uh, um,

I will say this is a little bit

of a disappointing lack of transparency in

my opinion.

Um,

it sucks that they didn't really seem to

give a whole lot of details about how

did this happen?

How long was the key exposed?

Um,

I don't remember if they gave details

about what they did to prevent this from

happening again.

Um,

Um, but I,

I guess I will give them a lot

of credit for like coming forward with it

and being proactive.

I mean, it was like a private repo,

right?

So in theory, there shouldn't be any risk,

but still just being like, uh,

let's just be safe and rotate it.

Like I do respect that, but, um,

Jordan, to throw this back to you,

I think the first question that I think

a lot of people would have is,

do you think this is a reason for

people to reconsider using Firefox?

Is this like an oh crap moment that

shows negligence or anything,

or do you think this is just kind

of like things happen?

I think we've got to give Firefox a

decent amount of props here because they

did exactly the right thing.

There was a mistake.

Mistakes do happen.

There's always going to be mistakes,

but it's the way that they handled it,

which I think is the most important part,

which, like you said,

immediately rotating that GPG key is the

most important part.

And they did that.

They notified everyone.

They did exactly what they should have

done in that situation.

If, for instance, we found...

that they did leak that key and then

they just decided to do nothing about it,

then that's where we would start having

issues where I would be like, OK,

maybe you should probably not use Firefox

because they seem a little negligent.

But, you know, mistakes happen.

They fixed it.

They've done everything in their control

to notify everyone.

And, you know,

that's basically the best case scenario in

a situation like this and i think it's

it's always good there's always going to

be issues uh especially when it comes to

like you know supply chain attacks where

um someone can you know get access over

packages and stuff like that um i think

it's always important to be proactive and

be aware of what's happening but i think

in this case

It sounds like most users don't have to

be too concerned about anything apart from

the RPM packages and also people that

manually verify the GPG key,

which I'm sure if you're one of those

people,

then that's probably something that you'll

have to look into yourself.

But for everyone else,

nothing you have to do.

I think this is a good

Uh, this is good that Mozilla was, uh,

open and transparent about making a

mistake and fixing it properly.

So that's basically the best case scenario

in my opinion.

Yeah.

Supply chain attacks are really a whole

different animal.

Cause you know,

we always tell people to like,

make sure you use official outlets,

like get things from the official source

and whatnot, but like.

If it's a supply chain attack,

what can you do?

You really just have to hope that the

company is doing everything in their power

and they're quick to respond and kind of

sucks.

But yeah.

Before we jump into our next story,

actually,

we did get a quick question in the

supporter signal chat.

This person said,

for transportation in general,

is there anything we can do to be

more private about where we go?

And they said that, for example,

if you live in an area with public

transit, trains, metro, subways, buses,

all these things often ask for some

identifying information,

such as your name and phone number,

but usually lack the rigorous verification

processes that places like airports

enforce.

Like, you know,

usually nobody checks my ID when I get

on a bus.

A lot of the time they don't even

check if I paid.

They said,

is it a good idea to travel under

different names and use aliases wherever

you can, or are there problems with that?

And what are some other strategies we can

use to combat surveillance when traveling?

I mean, I'm not a lawyer.

I kind of view travel more from a

data breach perspective, you know,

because a lot of the time,

especially nowadays with things moving

into apps,

a lot of the time it's like you

don't,

physically,

like I'm pretty sure back where I lived

in Texas,

you couldn't even pay in cash for a

bus ticket.

I could be wrong.

Um, but whenever I took the bus,

I usually used an app.

And so at that point it's, you know,

using a, my pseudo number,

using a simple login alias, um,

trying to use a VPN,

just trying to think like if this app

has a data breach,

what information will it be able to

reveal?

I think I didn't even have to give

it location information.

I think I could just tell it what

bus stop I wanted to look at.

But, um, yeah,

I don't know.

That's kind of how I look at it.

Cause also I don't want to sound

defeatist,

but a lot of buses nowadays also have

cameras and your phone's tracking your

location.

So I don't know.

I feel like that's kind of overkill to

use aliasing information.

And I do wonder if there would be

any legal repercussions there.

Like it's one of those things where if

something goes wrong,

is it going to cause more problems that

your ticket doesn't match your ID?

I don't know, but yeah.

I also don't do a lot of public

transit because I live in America and

unfortunately our public transit is not

that great.

I would love to do more public transit,

but it's just not always feasible.

Do you have any thoughts on that question,

Jordan?

I would say there's,

I can't really comment on like,

I've never heard of any public transport

needing an app.

So try and avoid using an app if

you can.

I'm not sure if that's always possible,

but if you can avoid using an app,

I would say avoid that.

A lot of public transit systems that I've

used have always had a card that you

could use and you can top it up

with cash.

I'm not sure if that's also about,

like you'll have to do research into that

because a lot of places they'll have

different options available because,

you know, there's people that are like,

don't know how to use a phone or

don't have a phone.

So what do you do then?

Oh,

I guess you can't use the bus or

like, you know, it doesn't,

there's always,

they have to make some different options.

So

definitely look into that um i think the

most important part is also just um try

not to uh

share data with these transit companies if

you can.

Don't download the app,

don't give it your phone number,

don't give it your address,

don't give it all that information.

Try and minimize the amount of data that

you're sharing with those companies,

or if it's a public system,

then the government.

So I think that's also an important thing.

I think

I'm kind of a little bit biased,

but I do a lot of cycling and

no, no,

no personal information required to do

that.

Walking also no personal information

required, obviously, you know,

that is, like Nate said,

it kind of depends where you live,

if that's an option or not.

If you live in, you know,

a rural town,

I'm sure that's probably not as viable,

but that is another thing.

And I think, you know,

there's also so much information that you

can share when you're driving a car too,

like we've talked about with Flock, right?

You know, when you're driving around,

there's cameras everywhere,

recording your car,

recording your number plate.

It's also not a great

option either it's pretty terrible cars

are kind of terrible for privacy as well

they share a bunch of information so it's

just trying to like do harm reduction um

where you can

And obviously everyone has different

requirements because some people need to

drive, some people can't drive,

all sorts of things.

So it's just about reducing what you can

and not, like Nate said,

not going overboard because as Nate said,

there's cameras in the public transit

system.

There's all sorts of tracking that happens

through that as well.

And I'm sure somebody could work out

who you are, if they see, oh,

this person taps on it this time,

and then they just check the security

cameras and they can see it's you.

So, you know, there's, there's, um,

there's always a trail when it comes to

public transit.

And anytime you step out your front door,

you're basically going to be recorded.

So just take that in mind.

Um,

I guess we can jump here into the

next story though.

This is kind of a group of stories

this week, and it's about signal, um,

Signal making a bunch of new updates.

So this week I'll talk about the first

one and then I'll hand it over back

to Nate.

So this one is more linked devices are

on the table and the Android tablet.

Now you can easily link another Android

phone or Android tablet to your Signal

account.

We're also expanding linked device support

on iOS.

So you can link an iPhone to your

Signal account in addition to our ongoing

support for iPads.

look for Signal iOS version eight point

two two and Signal Android eight point two

in the app slash Play Store near you.

So I think this is one of these

things that we've all been like basically

begging for Signal to do.

And it was like,

one of these things that's so easy for

them to do as well.

And it's like a no-brainer for them to

enable this.

I think the most interesting thing about

this is that previously, you know,

a lot of people were complaining that they

would have to use MOLLE

instead of the official Signal app to be

able to link another Android device to

your account.

And now that feature has been expanded

officially to the official Signal app,

which is really important.

And it's better to be using the official

Signal app if you can.

just to reduce the amount of trust you

have to have in different projects.

So it's really cool that they've been able

to release that as a new feature.

Do you have any thoughts on this one,

Nate?

No, I just, yeah,

I think it's really cool.

I mean,

obviously everybody's in a different

situation,

but my first thought was at my last

job,

I used my iPhone as a work phone.

And so I would have my Android was

my personal phone.

And then my iPhone would have like teams

and all that crap on it.

And the only reason I had to carry

around the Android was because of signal,

because my wife exclusively uses signal.

And there was a period where I,

Um,

basically I got some feedback that I was

on my phone too much.

So I was trying to be on my

phone less and I had to go make

like a separate signal account for the

iPhone so that my wife could text me

there.

And it's like,

it'd be really cool if we could just

like, if this had existed at the time,

it's like,

I could have just put signal on my

iPhone and been good to go.

And so, yeah,

I think this is really cool.

I'm also thinking of the infamous time

that my phone exploded.

And I remember sitting there and going,

how do I recover my,

my signal account now?

And, uh, you know, thankfully it was,

it was pretty easy cause I had all

the, I knew the pins and everything, but,

um, yeah,

to just like have that backup and

everything is a definitely super,

super cool.

So, um,

before I jump into the next one real

quick, laptop said,

what's wrong with Molly?

There's nothing wrong with it or actually,

actually I'll turn that one over to you

since you're the one that said it.

Um, what's, what's wrong with Molly?

Um, obviously, you know,

when you're trusting a third party,

like with, with your,

with your signal chats and stuff.

So it's adding another party that you have

to trust, like in addition to signal.

Um, and also Norli has been,

unfortunately,

they've been a bit slow on keeping up

to date with signals updates.

So like,

that is also a concern from a securities

perspective.

It adds a bunch of interesting new like

privacy and security features,

but it does seem like, um,

you know,

it's definitely a risk analysis thing.

If the chats that you're having on Signal

are really important and secure and stuff

that can't leak,

then obviously you want to reduce the

amount of exposure that you could possibly

have.

So I think another important thing to have

to talk about in this story is just

the expansion of risk that happens when

you add linked devices to your Signal

account.

I think there's less risk when it comes

to adding a mobile device as a linked

device.

Whereas if you're adding a desktop device,

that's where we do have more concerns.

We've had stories in the past where the

local database on the Signal desktop app

was not encrypted or it's easier to access

on a desktop because it doesn't have as

robust permission system to restrict

access from malicious apps.

So every linked device you're adding is

increasing the attack surface.

That's one another thing to discuss as

well when it comes to this.

And like I said,

the MOLLE using MOLLE is going to increase

the attack surface because there's adding

another device and you're also trusting

another group of people to to manage that

app, which.

Is.

isn't the only party you have to trust

more or less because of the end-to-end

encryption, the client, I mean.

I mean,

there's the Signal developers and then

there's the MOLLE developers.

So you're trusting the Signal developers

to develop the Signal app.

And then Signal is based on, no, sorry,

MOLLE is based on Signal,

which then they also have to add code

on top of that.

So you are trusting MOLLE and

signal developers at the same time so

that's an extra party you have to trust

to make sure that they are not inserting

any malicious code for instance because if

your client is compromised then this this

the end-to-end encryption doesn't matter

because you know it's only end-to-end um

so that's why it's important um hopefully

that makes sense

And also, real quick,

I'm glad you mentioned the device raises

your threat model thing.

That is a good point.

But I just want to point out,

it's not even necessarily a malicious

thing.

It's just you have to trust them to

implement it correctly.

I don't know why this example just popped

into my head,

but if there's a Christmas gift,

and let's say I'm going to give...

I don't know.

Let's say I'm going to give my sister

a Christmas gift or let's say my wife

wants to give my sister a Christmas gift

and she wraps it up and hands it

to me.

And then for some reason,

I deliver it to my sister.

You have to trust me not to open

it.

Or in this case,

like for some whatever reason, again,

I don't know why this example popped in

my head.

For some reason, I decide to rewrap it.

You have to trust me to wrap it

right the same way that she did.

Like it's just it's more people involved.

It's more chances for something to go

wrong.

Even if it's not malicious,

it's just people make mistakes.

Yes, Mali is open source,

but are they auditing every single

release?

Is there somebody out there who's combing

through every single release?

Are there multiple somebodies?

Because the first person who combed

through it could have missed something.

It's just you're always...

there is always a level of trust involved.

Um,

you're never going to completely remove

trustless is kind of a buzzword in my

opinion,

because there is no such thing as

trustless.

You're always trusting someone somewhere,

but the idea is to remove as much

trust as possible.

So, um,

Yeah,

Dag here did mention that Mali can encrypt

local logs on the device, which, yeah,

I mean, Mali does some cool stuff.

And we're not saying don't use it.

It's just keep in mind those are the

trade-offs.

You're introducing another party into the

mix.

On that note,

we'll jump into the next quick Signal

update,

which is that Signal is introducing

automatic key verification.

Um, this is pretty cool.

So, uh,

this is supposed to compliment the

existing safety number system.

It's not supposed to replace it.

Uh,

it works through a system of verifications

performed by you,

your signal connections and third-party

auditors that together provide the same

assurance as manually verifying safety

numbers.

Unlike safety numbers,

these verifications are done independently

and do not require an in-person meeting or

secondary communication channel.

This system of verifications ensures that

the association between a phone number or

username and its public encryption

key is globally consistent and transparent

to all participants.

This protects against scenarios where a

key is swapped out without the owner's

knowledge.

For example,

a malicious party compromised signal and

associated a different key with your

connection's phone number.

There are technical details in the blog

post if you want to learn more.

I'm not going to go into them because

I'll skim here real quick and you can

see it's very detailed.

I actually do need to finish reading this.

They do try to break it down into

understandable terms,

which is super awesome.

And I do want to finish reading it,

but I'm not going to read it all

here.

They said to see it in action,

go to a Signal Connections profile,

hit view safety number and tap the verify

automatically button under the automatic

key verification.

The button will show a green check mark

and encryption verified when the feature

is available and verification succeeds.

Over time,

this verification combined with the ones

continually performed by your Signal

Connection and third party auditors

ensures the consistency of a Signal

Connections key across Signal ecosystem.

Uh,

I did try to test this out personally,

um, with one of my contacts,

I'm guessing they haven't updated yet

because it didn't let me, uh,

it was like grayed out.

Um,

I also have an issue where I'm usually

pretty good about actually like doing the

safety number thing with people just for

fun.

So I kind of had to dig through

and be like,

who have I not verified yet?

But, uh, yeah.

Um, that's what I've got here.

Uh,

I don't know if I have any thoughts

on that one.

Um,

Yeah,

I don't really have any thoughts on that

one.

Again,

it's just it's not a replacement for the

safety numbers.

Do you have any opinions of that one,

Jordan?

No,

I think this is just signal bolstering

their ability to verify contacts and

stuff.

I think it's always important to give

extra verification stuff,

especially because I'm not verifying every

single person in my contacts,

but I think it's also good to mention

what

why would you want to verify your

contacts?

Why would you want to do that in

the first place?

What benefit does this give, I guess?

And I guess that would be if somebody's

account gets taken over,

you can tell that their account's been

taken over because their safety number

changes.

That's one thing.

Um,

it basically allows you to know that the

person you're talking to is actually the

person that, you know, on the other end.

Right.

Um, so this automated like, um,

key verification system is, uh,

I guess just like another additional

layer, like you said,

it's not something that's going to replace

the safety number system, but it's like,

you know,

if something is going on with that,

if like there's an issue with the

encryption, then it's going to notify you,

I guess.

So I think that is,

is also important to have that.

It does kind of, I guess,

make me wonder if there's going to be,

further changes to how the the key system

works maybe uh is this like something that

they're gonna improve on more in the

future um i'm not really sure but i

think a lot of people are don't like

i see some people in my contacts who

their safety number constantly keeps

changing and it's like you know i think

if this system is able to kind of

keep it so that at least I know

that this person is going to receive the

message, like it's, I don't know,

it's just,

it's another thing that can help, uh,

verify that.

Right.

So I don't know.

I'm not really, um,

I'm not really super hyped for this

feature, but I think it's a good, uh,

increase in, in safety for some people.

Yeah,

it's definitely one of those behind the

scenes, not super sexy.

Like I'm not sitting here like, oh yeah,

but I'm just like, oh, okay,

that's interesting.

That's cool.

So yeah, I hear you.

It's not the most exciting thing out

there,

but it is cool to see Signal constantly

improving like that.

Yeah,

I guess talking about Signal constantly

improving,

there's another update here from Signal.

Signal is working on registration without

a phone number,

but what form will it take?

So this article here is from this

unofficial website called aboutsignal.com.

And basically what they've done is they've

put together this article that

basically shows every point where Signal

is working towards removing the phone

number requirement.

There's been hints in GitHub code that

Signal is exploring support for

registration without a phone number,

which, oh my goodness, if this happens,

I'm going to be so happy because that's

like one of the biggest issues that some

people have with Signal, right?

It's like, oh,

I don't want to give it my phone

number.

This is obviously a honeypot.

It's like, well, if they remove it,

then what's the argument at that point?

There is no argument.

And I think, you know,

I think this is exactly what we want

Signal to be doing.

We want them to be closing every single

loophole that pushes people away from this

app because we

We want people to have the most secure

communications possible.

I guess here's a rundown of what the

changes look like.

There's a commit here that said,

don't allow or set registration lock on

accounts with no phone number.

Add utility methods for getting country

region codes for accounts that may not

have phone numbers.

Add support for pessimistic locking of

phone number lists accounts.

Do not allow accounts without phone

numbers to perform P&I key operations.

Basically,

all those commits together show that

Signal is making backend changes to

support accounts without phone numbers.

registration without a phone number will

be optional.

So if someone is still wanting to use

their phone number to sign up, they can.

I think everyone in the privacy community

is not going to be using a phone

number.

So that's cool.

One issue that I did see with this

that is probably the most frustrating

thing is it looks like you can't convert

a Signal account that uses a phone number

into one that doesn't use a phone number,

at least from the information that we have

already,

which is

I think might become a bit of an

issue because if you're like me,

you probably have like a hundred signal

contacts or whatever,

like fifty signal contacts.

And if you have to start a new

account,

you're going to have to re-add every

single signal contact that you have on

your new account,

which is kind of a pain.

There's no easy way to do that.

So that's probably my biggest concern with

this.

It's going to be kind of annoying to

have to recreate your signal account.

I'm not really that bothered by this,

the phone number requirement.

So maybe this is just going to push

people that were kind of resistant to

using Signal over to using that.

I'm not sure.

But yeah,

I guess this is one of those things

that's like, Nate, you were saying before,

like, oh,

this isn't like a really cool and sexy

change.

This is that.

So how do you feel about it?

I feel pretty good about it.

One thing we should add is that this

article links to another article from

August seventh that's titled signal login

colon operational or optional registration

without a phone number will require one

time payment.

That's really it.

There's no information in the article.

It's just, again, speculating.

We don't know.

Presumably it will allow like Apple Pay,

Google Pay for convenience,

but we don't know if they're going to

allow like Monero or cryptocurrency or

something as an alternative.

Yeah, I think overall, I mean,

I'm definitely a fan of this.

Me personally, I think I'm a little bit...

paranoid again having had my phone explode

and like so much of my life is

in signal i'm kind of okay with like

yeah i'm just gonna leave my phone number

there as a backup just in case i

don't think my threat model is so high

that i need to get rid of the

phone number but yeah it is it does

kind of suck that you won't be able

to remove a phone number um i do

wonder if uh i wonder if that's like

a technical thing that there's just like

really no way for them to pull it

off or maybe that'll be something they do

down the road i'm not really sure but

um

I don't know,

the phone number thing has never bothered

me too much,

but also I recognize my privilege of

living in America where I can have as

many phone numbers as I want and I

don't have to show ID to get a

SIM card and stuff like that.

I think...

I think Signal did the best they could

to protect that information in the sense

that like phone numbers are hashed.

So the government can't go, hey,

give us a list of phone numbers or

like, you know,

give us a list of these people.

But there's nothing stopping the

government, again,

going back to countries where you need to

turn over ID to get a SIM card.

There's nothing stopping the government

from going, hey, here's a phone number.

Do you have this as a user?

And they can confirm or deny that,

which is unfortunate.

It's also,

they say that it's the goal is to

prevent spam.

But again,

Spammers don't care,

so what's to stop them from just creating

infinite VoIP numbers and creating Signal

accounts?

I don't know.

I've never really had a spam problem on

Signal,

but I've heard that some people have,

so I don't know how effective that

actually was.

I don't think it's fair how much heat

Signal took for this.

Like you said, people are always like, oh,

it's a honeypot.

I think people confuse anonymity and

privacy way too much.

Signal never promised you to be anonymous,

but it is private.

It protects you, but

Uh, still, I think this is a win.

I think for people who don't want to

turn over a phone number for any reason,

whether it's a perfectly sensible one or

just paranoia, it doesn't really matter.

I think that's great that they have this

option and I just hope that they will

support some form of private payment

option because otherwise I,

I think it's kind of a hollow victory.

If it's like,

you don't have to hand over your phone

number,

but now you have to pay through the

app store,

which is even less private than that in

most cases.

So yeah,

I think those are kind of my only

thoughts.

Yeah, totally fair.

It'll be interesting to see how this ends

up rolling out.

I'm assuming that we'll probably get

something in the beta slash alpha channel

at some point where we'll be able to

check out this and definitely make sure to

get subscribed here on YouTube or whatever

platform you're on.

And we'll have updates on that as it

rolls out.

But yeah,

that's kind of everything on that one,

unless you had anything more to add.

I just wanted to mention what Jonah said

here.

But yeah,

everyone hates three month for this.

He's got a point if, if, I mean,

to be fair,

I guess signal offers the alternative,

right?

Like you can use a phone number,

but yeah, a lot of people,

I haven't seen so much hate for three

month because they charge,

but I've seen a lot of people point

out.

It's like, yeah,

it's a tough sell to get your family

to spend five dollars on a messenger or

whatever.

So I don't know if there's pros and

cons, but yeah, he's,

he's got a point there.

Uh, speaking of anonymity,

what do you think is the best messenger

to use with a pseudonym?

Um, I mean,

I think I have a thought on that.

Do you have a thought on that one?

I mean, I have a thought.

Yeah.

Why don't you start us off here?

Probably, probably simple X.

That was the first thing that came to

mind for me is SimpleX doesn't require any

information to sign up.

Decentralized.

Actually,

one thing I do like about SimpleX that

I... Oh my God,

I would kill for Signal to introduce this

is SimpleX does...

different profiles that are all managed if

i understand it correctly i haven't used

it a ton but there's like different

profiles but they're all managed in the

same inbox so like i could add you

on simplex as nate and then i could

add like my wife on simplex under my

real name and i'd use them both from

the same screen but you guys would both

see a different identity which is just

like holy crap that is amazing if if

i'm understanding that correctly i might

be wrong but um

Yeah, no,

it's interesting because I have this

problem.

I won't go super into depth about it,

but I don't go by the name that

I use on here in real life.

And sometimes I have to add people on

Signal and I'm like, oh, yeah,

so that's like my name,

like not like the name that you should

call me,

but like that's another name that I use

and people are kind of confused.

And it's good when it gives you that

option.

to basically have another name appear or

like you said that would be really cool

if you could just have it like be

able to choose how you appear to that

specific person um that does sound really

cool actually I really hope that that's uh

that's something that Signal could add

because it's an issue with Signal I know

like

I don't know if you want to talk

about it a bit,

but I noticed you definitely do have an

interesting strategy regarding that on

Signal.

And I've thought about doing that because,

like,

sometimes I don't want to share what my

real name is with people,

and it's kind of one of those issues.

I guess we should just quickly,

before I swap it back to you here,

though,

we should probably discuss what are our

recommendations for

right now on privacy guides so like you

said there's SimpleX which does offer the

ability to do that so that was probably

the main recommendation that you could use

for that as far as I know none

of the other recommendations really give

you that option

So yeah,

basically what Nate said is SimpleX is

going to be your best option,

the only option really in our

recommendations.

So definitely at least test that out.

I've used SimpleX before.

It works quite well.

I think it's definitely not on par in

terms of usability to Signal.

So maybe you can talk a little bit

about your interesting strategy that you

use.

If you want, it's up to you.

No, that's fine.

Yeah, so my thing on Signal...

Cause for a while I had like a

personal one and a new oil one.

And then for some reason,

I think I just wasn't,

I think actually what it was is like,

as the privacy side of my life has

slowly become more of a main important

part.

Um,

I wanted more like instant access to

things like, uh,

especially when Henry and I worked

together on surveillance report.

Like I didn't want to wait until I

got home at the end of the day

to get messages from him.

So I started using my personal signal

account a lot more for,

for new oil stuff.

And, um,

I think there was even like something else

I started using it for.

I can't remember,

but I started using it for another thing.

And I,

I am that psycho who uses different names

in different parts of my life.

So I'm very open about the fact that

Nate is not my real name.

And I use different names for like music

and writing and stuff.

And so I hit a point where, yeah,

I had like all these different signal

accounts, like,

or like different parts of my life

converging in signal.

And the way I decided to get around

it was to just make my display name

was the man with many names.

Um, because I did realize I'm like, yeah,

most people know, uh,

especially once they get to know me,

you know, I'm like, yeah.

So I have this, I work in privacy.

I go by Nate.

And like, when I tell people, it's like,

yeah, I have multiple names,

which weirdly people are not surprised by.

I don't know what that says about me,

but, um,

It's a, yeah,

it just hits a point where it's like,

people are just kind of used to it.

Like, oh yeah, the man with many names.

Cause they know it's true.

He has so many names and it, uh,

yeah, that's how I got around that.

But I mean, a lot of people,

you know, put a nickname or X or,

you know, anonymous or whatever, um,

as the display name,

but it's definitely not as,

as robust of a system as the profile

thing from simple X,

which laptop here said,

I think you actually have to switch

screens for profiles,

but I still think it's easier with

it's still an easier implementation than

like having signal and Molly or having

like different graphene profiles or,

you know,

all these different ways of doing things.

So.

Yeah.

It's been an issue that I've been running

into where I've got like,

two Signal accounts.

And then I'm like, oh,

but then I can't talk to someone using

another one because it's got that name on

it and it's got things that would reveal

other information that I don't want to

share.

So it is kind of frustrating if you're

stuck using something like Signal.

It's like, oh,

if it had that as a feature,

that would be great.

But it's just not something that Signal

supports right now.

So you're kind of stuck with using SimpleX

Chat,

which

do recommend on our site so definitely

check that out if that's something that

you um jonah said just make all your

names start with the same letter and your

signal profile can just be n or something

yeah yeah but then the problem is i

like to randomly generate my names that

way there's no um there's no like

You know how it's like people aren't as

random as they think they are.

So if you try to like randomly come

up with passwords,

they're probably not going to be as random

as you think you are.

And I don't know.

I just, I'm, I'm weird about it.

I literally just use a random name

generator.

So I'm kind of at the mercy of

what that comes up with.

I know I'm a, I'm weird.

You know what though?

It's working.

Like I said,

like a nine out of ten times people

are just like,

they don't even bat an eyelash.

So yeah.

And I've,

I've had multiple people in different

situations be like,

who does this person know yet?

Like they'll meet somebody new,

like a friend or something.

And they're just like,

what name do they know you as?

Um, laptop,

does simple X have multi-device yet?

Not exactly.

It has, um,

like they have to be on the same

LAN and you can like scan a QR

code and connect them.

Um, but technically yes.

So, yeah.

Let's see.

If anybody has any last questions,

go ahead and drop them now.

I'm looking at the privacy guides.

I'm looking at the forum thread.

No new questions in there.

And I've had the signal chat open as

well.

I mean, if nobody has any questions,

I'll go watch the latest episode of Silo.

Damn, yeah.

I'm not seeing any questions in here

either,

so I feel like we can start wrapping

it up.

Just a reminder, though,

if you are a member,

Privacy Guides member,

that we do have a signal group and

you can ask questions there.

If you don't want to share the question

publicly or anything like that,

definitely consider asking.

posting in there if you're a member and

you want to hear what we have to

say about a topic then feel free to

do that oh looks like we got a

question here from terracotta pie should i

be concerned with linkedin requiring me to

verify my id with persona after changing

my email um it depends right like i

think

It obviously sucks because Persona is a

really suspicious company.

Every single age verification or ID

verification company is pretty suspicious.

And I think Persona has been shown to

be linked to some weird stuff.

And not particularly surprisingly,

it obviously has concerns about data

privacy because you have to submit your ID

to them.

So I think...

It depends on how much you need LinkedIn.

I think there's some industries where it's

like if you don't have a LinkedIn,

you're basically never going to get a job.

So if you have connections through

LinkedIn that are really important,

then obviously you need to make a decision

based on that.

I think LinkedIn is one of those

platforms that I think it really depends

on the industry that you're in and you

know having professional connections is

important right if you want to find a

job so it's kind of up to you

I personally

have given LinkedIn my ID.

So I don't know,

I think you got to,

you got to weigh up,

you got to weigh up the downsides and

benefits for that yourself.

And if it's,

if you don't really have that many

connections and you're not really using it

that much,

then maybe it's time to let it go.

But if you do need it for like

professional connections,

then I would say it's probably a good

idea to

uh to do it unfortunately it kind of

sucks they're forcing your hand so jonas

said watch silo live on stream i'll do

it man i was gonna say what if

we uh what if we do it in

the the supporters chat in the signal chat

i'll just stream it there so you know

sign up for a membership and you can

watch silo with me every week

Um, yeah, I just,

I just want to echo what you said

about the, um,

like sometimes you got to do,

I I'm with you.

Like, I don't even have a LinkedIn.

Thank God I haven't needed one, but I've,

I've met people that say that same thing.

It's like, yeah,

no LinkedIn is where I found like my

last four jobs.

Like it's,

it's really critical to my industry.

And unfortunately at the end of the day,

you have to make sure you're taken care

of.

Like,

I mean,

I guess if you want to go live

out of your car or be homeless because

you just don't want the data brokers to

have an address, that's on you.

But seriously, jokes aside,

if your privacy is so extreme that it's

holding you back from getting a job,

advancing in your career, finding love,

having a family,

having stable mental health,

and I'm being a little bit joking but

also serious,

that's when it's gone too far.

Yeah.

Um, yeah, if you don't need LinkedIn,

if you don't need to give them your

ID, then please don't.

But if,

if that's the only way you're going to

be able to like keep food on the

table, then by all means,

you gotta do what you gotta do.

So, yeah.

But, uh,

let me check the forum post again.

Nothing yet.

I do like that the forum automatically

updates every once in a while.

There have been a couple of comments since

we started.

And they're not questions.

They're just comments to other users.

But I like that I don't have to

refresh the page.

I just pull it up,

and it's automatically like, boom,

new comment.

I think that's pretty awesome.

But I think that's all we got.

I guess we'll go ahead and call it

a stream.

So all the updates from this week in

privacy will be shared on the blog every

week.

So sign up for the newsletter or subscribe

with your favorite RSS reader if you want

to stay tuned.

For people who prefer audio,

we also offer a podcast available on all

podcast platforms and RSS.

And this video will be synced to PeerTube.

Privacy Guides is an impartial nonprofit

organization that is focused on building a

strong privacy advocacy community and

delivering the best digital privacy and

consumer technology rights advice on the

internet.

If you want to support our mission,

you can make a donation on our website

at privacyguides.org.

To make a donation,

click the red heart icon located in the

top right corner of the page.

You can contribute using standard fiat

currency via debit or credit card or opt

to donate anonymously using Monero or your

favorite cryptocurrency.

Becoming a paid member unlocks exclusive

perks like early access to video content

and priority during the Q&A.

You'll also get a cool badge on your

profile in the Privacy Guides forum and

the warm,

fuzzy feeling of supporting independent

media.

Thank you so much for watching and we'll

see you next week.

See you next week.