Muse is Collecting YOUR Data (Even if You Don't Use It)

Leaked internal documents show that Meta's Muse AI agent is building dossiers on your friends, family and you, even if you've never used it before, Kagi is ending Orion browser development on Linux and open sourcing it, and AI glasses are facing their first major government crackdown. Join us for This Week In Privacy #74.

Episode sources:
https://www.privacyguides.org/livestreams/2026/10/09/muse-is-collecting-your-data-even-if-you-dont-use-it/

• (00:00) - Intro
• (00:36) - Start of podcast
• (01:12) - Meta's Muse Is Building Dissiers on Your Friends and Family, Even If They Never Signed Up, Internal Files Reveal
• (17:20) - Forum Discussion: How do I know I can trust an app?
• (34:38) - AI glasses face their major government crackdown
• (45:57) - Forum Discussion: Google randomly disabled one of my accounts
• (53:29) - Site updates
• (57:50) - Kagi End Orion Browser Development for Linux, Will Open-Source It
• (01:09:00) - Forum Discussion: Do I really need a VPN all the time?
• (01:17:27) - Hackers obtain counterfeit TLS certificates for Google and other large services
• (01:28:35) - Outro

★ Support this podcast ★

Creators and Guests

Host

Jordan Warne

Digital Producer

Host

Nate Bartram

Digital Producer

What is This Week in Privacy?

A weekly live podcast from Privacy Guides - We cover updates on what we’re working on, privacy news from around the industry, and anything our community wants to share.

Privacy Guides is a non-profit, impartial organization that is focused on delivering the best online privacy advice and building a strong privacy community.

Meta's Muse AI collects data even on

non-users,

Kagi's Orion browser is being handed over

to the community,

and attackers successfully imitated

Google's TLS certificates.

All this and more coming up on This

Week in Privacy number seventy-four,

so stay tuned.

Welcome back to This Week in Privacy,

our weekly series where we discuss the

latest updates with what we've been

working on within the Privacy Guides

community and this week's top stories in

data privacy and cybersecurity while

answering viewer questions.

I'm Jordan and with me this week is

Nate.

How are you, Nate?

Hi, I'm good.

How are you?

I'm doing good.

I'm definitely excited to jump into some

more privacy and security news this week.

Why don't we jump right into the highlight

story this week?

Yeah, sounds good.

So I'm taking the highlight story this

week, which is about Muse, Meta's AI,

that I'm a little bit tired of hearing

about, to be honest,

because it seems like it's everywhere

right now.

But it's, you know, it's everywhere.

It's the big deal, apparently.

So this comes from the International

Business Times in the UK,

and it says Meta's Muse is building

dossiers on your friends and family,

even if they've never signed up.

Internal files reveal.

So Muse, for those who don't know,

is Meta's new AI agent.

I believe it is currently Apple only.

I know it's on Mac.

I think it's on iPad and iOS.

Don't quote me on that,

but I'm pretty sure.

And they say that it's grown rapidly since

it launched at the beginning of September

with more than four million people using

the assistant in some way at least once

a week, which...

To me, it doesn't seem like a lot,

simply because, again,

I've been hearing so much about this

thing,

and apparently it was the top of the

app charts for a while and stuff like

that.

So when there's like, oh,

more than four million people, I'm like,

that's it?

But yeah, four million people.

I guess that's all it takes to get

to the top of the app charts.

But anyways,

so there was an AI safety researcher here,

Karen Joshi,

who extracted Muse's internal instructions

and shared them with Wired.

And it says that,

and Time apparently also analyzed this

stuff.

This article says,

Time's analysis found that Muse's internal

instructions call for updating profiles

roughly every hour,

using information about people mentioned

in chats, messages,

and emails the assistant can process.

The profiles can include how users met

their contacts, shared interests,

disagreements, and quote,

tensions and alliances within their social

circle, which is...

Wonderful.

Wired separately reported that Muse's

instructions call for creating a page for

every person in the user's life,

including family, partners, friends,

colleagues, collaborators,

and people the user follows.

As a result,

people who have never used Muse could

still appear in a user's relationship

profile if information about them is

available to the assistant.

So the thing I thought was funny,

it says here also,

Muse is also instructed to infer users'

goals, including ones they, quote,

have not said aloud.

The internal instructions reportedly show

that it can identify which prompts work

best for individuals.

It says, for example,

this user responds better to short nudges

after ten p.m.

When asked about the processes,

a Meta spokesperson did not dispute the

findings,

instead citing the company's blog.

The spokesperson said,

Muse remembers what matters most to you,

including information about others that

you choose to share,

so it can be a helpful personal assistant.

um and then there's a little thing here

where meta claims that uh muse is designed

with privacy in mind because meta doesn't

know what privacy is they say that each

muse runs on a dedicated virtual machine

with users controlling which information

and services the assistant can access

according to the company muse does not

share conversations or data stored in a

user's vm with its advertising systems and

individual vms are isolated from one

another however time found instructions

stating that muse agents cross across many

vms teach each other through shared

lessons which raises questions

Meta told the outlet that these learnings

are de-identified before being used to

improve Muse and the information is not

directly shared between individual VMs.

Apparently later this year,

Meta keeps saying they're going to

introduce Muse confidential VMs where the

entire VM,

including user data and conversations is

encrypted using a key only the user holds.

They said in September that this would be

introduced later this year.

And as of October seventh,

it is still not yet available.

And personally,

I have not seen any headlines countering

that.

So, yeah, I mean,

this is kind of a pretty short article,

but kind of a kind of interesting because

I don't know if Jordan remembers this,

but I know back in twenty sixteen during

the whole Cambridge Analytica thing,

there was a really big scandal or part

of the scandal was that Meadow was

accused.

Back then they were Facebook.

They were accused of keeping what they

called shadow profiles on individuals.

So, yeah.

And it's funny because Facebook admits

that they keep these,

but they don't call them shadow profiles

because that's a little too creepy for

them.

And basically they say,

if I sign up for Facebook and I

give Facebook access to my contacts,

it reads all my contacts.

And the idea is that if somebody joins

Facebook and all their friends are on

Facebook,

it already knows who to say like, hey,

you should add this friend,

you should add this friend.

But back when I had Facebook,

it was definitely super creepy because

there would be people that like,

I talked to once that would pop up

and I'm just like, dude, that's,

that feels like I'm stalking you

unintentionally.

So yeah, I don't know.

Do you,

I did have some discussion points written

down here,

but I don't know if I have any

specific questions.

Do you have any thoughts on this that

I haven't addressed yet?

I mean,

I think this kind of goes hand in

hand with,

the aspect that we kind of need to

focus on when it comes to like these

AI agents, which is,

I think people kind of overshare,

like they share a lot of information with

these AI agents and, um,

that sort of can create these shadow

profiles as well, because, you know,

if you're talking about people in your

life, if you're, you know,

sharing information about other people

with these AI agents, you're,

you're kind of invading their privacy too,

because, um,

you're sending that information to Meta.

We don't really know what they do with

the information that you actually share

with them.

A lot of these AI companies,

say that they don't use the information

directly for training or like by default

it's used for some training purposes or

whatever.

So, you know, there's that aspect as well.

I think the worst part about AI is

a lot of things that you think are

deleted are not deleted because they're

stored inside this AI model that's been

trained on data, right?

So for instance, like, you know, if I...

if I ask an AI agent about myself,

if I ask it, who am I?

If I tell it, who is Jordan Warren?

Who is that person?

It will know who I am.

And even if I delete every single thing

off the internet,

that will still exist there, right?

So I think this is one of these

issues with these

these AI models is, you know,

they kind of are just a black box

that stores all this information.

You can't really delete the information

from them, right?

And I think a lot of people were...

You know,

in our previous episode where we talked

about AI agents,

some people were a little bit bothered

that we kind of dismissed using AI agents

entirely.

You know,

I'm not going to admit that I'm not

biased.

I am biased.

I don't like AI.

I'm a creative.

Like, I work on creative projects.

Like, of course I don't like AI.

I'm sorry if you don't like that fact,

but that is just my personal stance.

But, you know,

if you're using these tools, you're,

you know,

you are definitely giving up some privacy,

like Nate said, with, you know,

they're building profiles about everything

about you based on the content that you

share with these people.

with these agents.

There's definitely more private ways you

can use AI, which, I mean,

we could talk a little bit about that

perhaps, but I think, you know,

anything from meta,

anything that's like from these big AI

companies is not going to be respecting

your privacy.

We would definitely move people more

towards local AI models instead.

Yeah, the local AI though, I don't know.

I could be wrong,

but I don't know if any of them

do the agent thing yet.

I mean,

I guess OpenClaw has been around for a

minute and I guess that can be

self-hosted,

but I don't know much about it.

So I'm not really qualified to speak on

that.

But yeah, it's interesting to me.

I feel like we're moving into,

and we'll talk about this more in our

next story as well,

but we're moving into this unfortunate era

where

Our privacy, I feel like,

is almost out of our hands more than

ever.

And I hate to say that because I

don't want to be defeatist.

But, you know, we've always... I mean,

there's always been tension in the privacy

community,

which this is something I'm going to throw

to the audience in a minute.

But there's always been tension about,

like,

how to get the people around you to

respect your privacy wishes.

Like, I remember... I'm very fortunate.

My family has always been very respectful

of my privacy stuff when I got into

it.

And I remember my mom visited me one

time and...

Uh,

this was in Texas and I have a

bunch of family in Texas.

So she didn't just visit me.

She also visit other family.

And, uh, when she got back,

she sent out, um, pictures to everybody.

And she very specifically said in the

email that went out to the whole family,

she's like,

please do not post pictures of Nate on

Facebook.

And I didn't even ask her to do

that.

She just did that by herself.

But, you know,

I bring that up as an example of

like, there's always been that, like,

how do you, you know, tell your parents,

like,

please don't put pictures of the grandkids

on Facebook and, and, you know,

asking people like,

don't use my real name or whatever and

stuff like that.

It's now it's getting even worse because

now we've just got random people in the

street walking by with, you know,

meta glasses or what was the Apple watch

thing we talked about a couple of weeks

ago where it's like,

If it just randomly scoops up other

conversations you're having throughout the

day.

And now this, which again,

this is something that Facebook's been

doing.

I'll circle back to that in a second.

But we're hitting this point where it's

like, I don't even have to use Muse.

But now if I talk to somebody that

does,

my conversations could end up scooped up

and part of that data collection,

which is...

scary and um real quick i do want

to touch on that another thing i wrote

down here as a thought is that um

one of the things that made cambridge

analytica um so sensational at the time

back in for those who don't know real

quick recap basically there was this

company they do um analytics for i think

mostly for elections and political stuff

and one of the ways they collected user

data was they made this little quiz that

you could do on facebook

But unbeknownst to users,

not only was it collecting their data,

but it was also collecting the data of

all their friends.

So if I took the quiz and me

and Jordan are friends on Facebook,

it would also collect Jordan's data,

even if Jordan never did the quiz.

And one of the scandals was people were

just like,

why the hell does Facebook have this much

data?

Because that's when everybody realized

like, oh, my God,

Facebook has an ungodly amount of data.

But it was also that it was the

fact that it created this web.

So even though I think it was only

like a few thousand people took the quiz,

they got data on millions of people.

Because of that web.

And this is that all over again.

It's almost...

This didn't dawn on me until just now,

but it's almost like Meta looked at that

and was like, damn, that's a good idea.

How can we do that?

But yeah,

it's like it's that all over again,

where if one person uses this,

the amount of data that Meta can collect

through all of their secondary,

third contacts is just...

astounding so even though it's what did we

say at the top like four million people

have downloaded this thing uh no i think

my light's dying um even though like four

only four million people have downloaded

this thing but i mean they could get

data on easily tens of millions of people

maybe hundreds of millions um just because

of that that network effect so i don't

know um yeah i think i think i've

rambled on that sufficiently do you have

any thoughts on that that i missed

I do think, you know,

when we see all these things like,

you know, Meta's AI glasses,

like the thing you talked about with the

Apple Watch a couple of weeks ago,

it is like a normalization of all this,

right?

Like, it's like, you'll be fine.

It's fine.

Like, it's fine.

You're in public, you know,

it's perfectly fine.

Or like, you know, we're just, you know,

this is just an AI agent.

It's just, you know, it's fine.

It's collecting all this information.

Like,

this is kind of like boiling a frog

or whatever.

Like, people are just like kind of,

moving to accept these things.

And, you know, we shouldn't be,

we shouldn't be accepting,

accepting this as something that's normal,

something that's like, right.

So I hope that

This doesn't end up becoming more

normalized.

I think AI agents,

some people seem to think that they have

a lot of good uses.

And maybe there's a way to do things

in a way that's not as privacy invasive

and that runs locally.

But that is something that we probably

should look more into.

We do have an AI chat page on

our website.

So there is some interesting stuff on

there.

But I do think it is something that

we need to revisit.

I'm not sure if anyone on our team

is particularly experienced with these AI

tools,

so we might have to get some community

feedback on that and investigate more a

little bit to see if there is something

like an AI agent that you can run.

So, yeah.

Yeah, I was going to mention that.

I know Free has been keeping an eye

on,

there is a community discussion about

updating the AI page.

So yeah,

if anybody's a little bit more experienced

and has some educated opinions on that,

because yeah, I don't use, I mean,

thankfully, I'm a fully abled person.

And I say that because in the past,

the one example that comes to my mind

is I used to trash talk smart lights.

And I'm like, who needs a smart light?

Like,

how hard is it to get out of

bed and flip the light switch?

And then I actually had somebody write in

one time and they weren't mad.

They were actually really nice.

But they were like, hey, just FYI,

like I have like a condition in my

eyes where my light sensitivity changes

day to day.

And so literally some days I wake up

and the lights are fine.

And other days it's like painfully bright.

And it's wonderful that I can just lay

in bed and like turn it down on

my phone.

And I was like, oh.

Damn, you're right.

So I think I think a lot of

these devices are wonderful for people who

are differently abled.

But I say all that to say, like,

yeah, for me personally,

it's like I'm too much of a control

freak that like I would never download any

AI agent,

even if it was totally private and came

from somebody I totally trusted.

I would never download it and be like,

yeah, go buy me a plane ticket.

Go go like.

Um, write this blog post,

go email my sister.

Like, no,

these are all things that I want to

do because I want to make sure that

I'm getting the best price.

I want to make sure I'm getting,

you know, the, the saying the right words.

It's just, uh,

the idea of like handing that over to

somebody scares me, but.

One last thought I'll say real quick in

response to something you said is that,

yeah, the normalization thing,

it's frustrating because they keep saying

like, oh, it's private, it's private.

Like it's on device or we de-anonymize

things.

Like that was the whole thing here with

Meta, right?

It's like, oh,

they de-anonymize data before they share

it.

But we've talked about so many times how

data can be so easily de-anonymized.

I think I kept saying de-anonymizing,

but they anonymize the data.

And so much data can be so easily

de-anonymized.

And it's like, it's pretty meaningless.

Like I think, what is it?

I think it was like twenty three and

me or one of those DNA companies.

They're like sharing DNA for research and

they're like, oh,

but we replace the person's name with like

a random number identifier.

And it's like,

how does that de-anonymize me?

Like if you replace Nate with any other

identifier, it's still me.

It's still my DNA.

It's yeah.

So it's it's they're trying to make people

more comfortable with it for sure.

And I just I don't buy it.

I'm not fully convinced myself either.

So.

Um, yeah,

so I guess I'll turn it over to

the audience.

Uh, what are some ways I, you know,

I mentioned like that this is becoming an

issue where it's becoming harder and

harder to get other people to respect your

privacy.

And unfortunately we're depending on other

people more often.

So, um,

if you guys have any things that have

worked really well for you, I mean,

for me,

it was as simple as just talking to

my family and like, Hey,

I'm really into this now.

I'm really private.

I also have a presence on YouTube and

I don't want people finding me and like,

you know, harassing you guys.

Um, if you could respect that.

But if anybody has any other advice on

how you've approached that conversation

with friends and family,

definitely let us know in the chat.

Real quick,

before we move on to our forum post,

I don't think we had any questions in

the forum yet.

But I know somebody on Twitch here said

that they love my ears.

Thank you.

I'm at one inch, if anybody cares.

I know some people are really upset by

them, but that's fine.

Somebody asked Messi or Ronaldo.

I'm...

I'm a Luddite.

I don't watch the real football very

often.

I don't know if I have an opinion

on that one.

Do you watch football?

I don't,

but I think if you say either one,

you're going to make a bunch of people

angry.

So that one, yeah.

The one that you like is the one

I like too.

Exactly.

Fair enough.

Yeah, that's all I got on that story.

Unless you have anything,

I think we can move on to the

forum posts.

Yeah, no, that sounds good.

It doesn't seem like we have any, yeah,

no forum,

no questions on the forum post yet.

So if anyone has any more questions for

us,

definitely leave those and in the chat

too.

But yeah,

moving on to this forum discussion.

And we had a question from Anon four,

six, four, four, two,

who basically said like, you know,

how do I know I can trust an

app?

Yeah.

And they said,

what decides for you whether you can trust

an app or not?

A big trust bonus is if apps are

open source.

But this opens two questions for me.

How do I know that the source code

itself is safe?

And if there was no audit and no

contributor amount and the contributor

amount is not very high,

how do I know that the final app

file is actually corresponding to the

source code and that nothing was added in

between?

So I think when it comes to this

sort of thing, well,

I can speak personally for what I look

for.

Generally, when I look at an app,

I kind of want to see like a

decent amount of if it's on GitHub,

which I assume this app that you're

looking at,

because you said you're kind of looking at

if they're open source.

But if the app isn't open source,

you can check for reviews,

you can check for independent people

verifying that the app is actually good or

recommending the app itself.

It's kind of hard when it's closed source,

I think,

because you can't see contributor history,

you can't see release history.

Generally,

what you want to look for is blog

posts,

a long history of releasing releases for

an application.

But I would also recommend

not really looking super...

If something doesn't seem like it has a

lot of internet presence and much content

written about it,

that's probably another red flag.

But yeah,

when it comes to open source stuff,

checking to make sure that there's a lot

of... If there's a lot of GitHub stars,

that can also be manipulated.

So don't rely entirely on that.

I would check...

the commit history, you know,

is there consistent amounts of commits?

Is there a long history of people,

different people making commits to the

repository?

Are there a lot of contributors?

And like, yeah, Foundog said here,

reproducible builds address some of these

concerns.

So when it comes to your second question,

you know,

how do you actually know that the final

app file is actually corresponding to the

source code and that nothing was added in

between?

So yeah,

you can use reproducible builds to

basically know that the build that you're

downloading is corresponding to the source

code, which FDroid does do.

And a bunch of Linux distributions also do

that too.

So that is one benefit.

I believe Arch Linux and NixOS both do

that.

And I think a little bit on Debian

now, but it's becoming more common.

So that's one way you can tell whether

the application is legit.

The other thing is, you know,

a lot of applications will give you the

SHA-to-fifty-six like checksum,

which you can like verify the

the integrity of the application that

you're downloading to make sure it's like

actually the application that the

developer has provided.

So that's another thing.

But yeah,

that's kind of everything that I look for.

What about you, Nate?

Is there any other things that you

personally look for?

Yeah,

I don't know about things that I look

for because, yeah,

this is something I think about too

because I know I say this all the

time, but I'm not a developer.

I took – there's an app that's kind

of like Duolingo that I'm sure is abysmal

for privacy that I use to do –

I think I did a basic Python course

and –

Now I'm in the middle of JavaScript,

I think.

I actually kind of put it down and

haven't touched it in like six months.

But even then,

I wouldn't actually say that I know

JavaScript or Python.

I'm not very tech savvy.

I know enough now to look at it

and go like, yup, that's code.

But yeah, so I think about that too,

is how do I know that these are

legit?

And how do I know I'm getting the

right thing?

as somebody who can't just look at the

code and read it.

And yeah,

I think reproducible builds are definitely

a pretty big one.

Some people, Foundog here also noted,

but some people in the forum also noted

that this is actually something that AI is

good at.

I mean, AI doesn't... AI is not conscious,

obviously, so like...

AI is good at it, and it... Sorry.

AI is good at it in the sense

that it can, like,

look at it and be like, oh,

here's all these security holes,

and then you could try to ask it

to explain, like, well,

how worried should I be about this?

What could this person do?

Like, blah, blah, blah.

But yeah, it's...

I know Kerry Parker has talked about that

a lot,

about how good AI is becoming a code.

To be honest,

I don't know if that applies to any

of the privacy-focused ones,

like Lumo or Leo, for example.

I don't know if any of them are

any good at it.

I did try to have Leo troubleshoot,

Braves Leo.

I tried to have it troubleshoot something

on my website, and it failed.

sucked horribly.

It could not get it,

but that could have been user error on

my end.

I don't know.

But my point being is like, yeah,

AI could potentially do it,

but AI is really very technical and

doesn't

I guess what I'm trying to get at

is like,

it doesn't really know how to put it

in plain English for you specifically.

That requires a ton of back and forth

for it to understand what your concerns

are, what your threat model are.

So it's not as good as like giving

it to somebody you trust who knows how

to read code.

And they're like, oh yeah, this is fine.

Go ahead and use it.

And which even then, you know, probably...

probably not cool to do that to the

people, you know,

to constantly ask them like, Hey,

can you audit this for me?

So I don't know.

It's, it's tricky for sure.

But I think that is a good, um,

like, yeah, if there's consistent updates,

um, that is actually one thing I know.

I know this is an unofficial policy at

tech lore.

I think it's an unofficial policy here at

privacy guides too,

is to not list things that are too

new.

Um,

like brand new services because they just,

they had, they don't have a track record.

We don't know if the developer is going

to quit doing it in six months or,

um, you know,

if it's full of security holes or

whatever.

So, um,

Yeah, it's tricky for sure.

But I think trying to get that feedback,

trying to do some research,

see if anybody else has talked about it,

what have they said?

Yeah, it's tough for sure.

I feel you on that one.

There's always the forum.

You could always go ask in the forum.

Please don't spam us with every single

project out there.

That's not what it's for.

But if you find something that you think

has promise,

it's a good place to get some feedback.

I think it's becoming much more of an

issue at the moment because every single

person thinks

thinks that they're like a software

developer with AI.

And there's like,

I will not mention how many projects have

been trying to get like posts on our

forum,

but it's in the tens to one hundredths

amount.

So, you know,

there's lots of people who are making

software now.

So I think this is probably a more

important thing to be thinking about too.

Like a lot of this,

I've seen this one going around this week,

actually.

There's this application called

Photocraft,

and it's basically a recreation of

Photoshop in Rust.

And it is almost entirely built with

Claude,

and it has only just come out in

the last week.

I might have heard about that.

I've seen something like that in my

headlines,

but I haven't looked at it too closely.

Yeah,

so it is kind of like fully vibe

coded and all of that.

So it's, you know,

when we see stuff like that,

first thing I was like,

who's the main contributor?

The main contributor is Claude.

So, you know,

obviously that's probably not the best.

That's probably not the best.

And also it just released like a week

ago.

Like it's...

It's not great.

Found Dog said,

I've heard it's horribly buggy.

I'm not surprised.

It's entirely built with Claude.

Every software developer I've talked to

says that all these AI tools,

they make functional code,

but it's not good code.

And I think that's the main issue with

trusting these AI models with programming

is they can achieve something that works,

but it doesn't work

as well as it should,

or there's issues like that.

But I think that's also another concern

that people should have is, um, you know,

check,

check to make sure that everything that

you're using is written by humans,

ideally, um, like nothing against the AI.

model coding stuff.

But as far as we know,

that can introduce security holes.

It can be buggy.

It can cause other issues.

So that's another thing to check as well,

especially because there are so many

projects now that people are making

because these AI models

They rapidly speed up software

development.

So it basically means, you know,

you can build an entire app as a

single developer within a week, you know,

like it actually has sped things up to

that ridiculous amount.

So anyway, suffice to say, you know,

just be careful with what you're

downloading, what you're choosing to use.

Oddbyte says they make functional code,

but you need to learn how to code

the AI to make the AI code good.

Yeah.

Okay.

Well, anyway, so let's,

I guess we can move on to the,

to the next topic here,

unless you have anything else to add,

Nate?

No, not really.

I was just going to throw it over

to the audience.

If you guys have any thoughts on how

you vet apps that might be helpful.

Again,

we're talking specifically about apps that

like don't have audits.

They don't have a lot of eyes on

it.

So it's kind of like, well,

maybe this is good.

Maybe this isn't, I don't know, but yeah.

We did have a couple questions in the

chat we could look at,

unless you want to take the next story

first and then circle back to those.

Naya, let's cover some of those questions.

What do you see that pops out?

So we got one from Burning Seas who

said,

what are our thoughts on Cape Mobile and

going from post-play to a model like Cape?

And then just wanted to say thanks for

the work that we do.

So thank you so much for that.

I know Jonah has a whole video where

he interviewed one of the people from

Cape.

I don't know.

I guess I'll weigh in on this one

because I just remembered you probably

don't have access to Cape.

I actually have been using Cape and I'm

not gonna lie.

I did it mostly for the price in

the sense that like right now they have

this like early adopter price thing.

And then also if you get enough referrals.

So both me and my wife are not

paying for phone right now because of the

Cape referrals.

So that was my main reason for switching.

I've had pretty good experiences with it.

I'm also in a major urban area where

there's a lot of cell towers nearby and

everything seems to work pretty well.

I will say every once in a blue

moon, because since I work from home,

I'm trying to get a lot better about

staying home and saving money and not

like, oh,

let me run out and get a coffee.

When I do run out sometimes,

because I haven't left the house in like

three or four days,

sometimes it doesn't seem to like...

grab the cell tower.

Like I have to like put it in

airplane mode and turn it back off or

something.

Um,

so that's kind of my only complaint is

every once in a while I have to

like get it off air or get it

into airplane, get it off.

And then the cell signal comes back.

But, um, otherwise like, yeah,

it works really well.

I've always got signal.

I know, um,

my wife moved from mint to Cape and

she said that her signal has gotten

noticeably better.

So, um,

Yeah.

Found Dog said it seems expensive as a

European.

Honestly, even as an American,

it's very expensive.

But again, when you do the referral thing,

it brings the price down,

which is the only like I would not

pay full price for it.

I can't afford that,

to be honest with you.

But yeah, I don't know.

I mean,

it's also one of those things that a

lot of the privacy stuff is happening

behind the scenes.

So I don't really get to see a

lot of the privacy stuff, but.

Yeah, and then the other question we had,

I think that's Cutie the Cookie said,

I'm fully switching to Signal,

but I'm having trouble getting people to

join me.

I,

unfortunately RCS is doing away with this,

but I know back in the day,

my wife used to be amazing at getting

people on signal and her trick was, um,

cause you say the,

the people say they have nothing to hide

and they don't care.

She didn't focus on that.

Like she didn't focus on like, Oh,

it's this encrypted messenger.

And there's like no metadata and blah,

blah, blah.

She focused on like,

we can do group messages.

We can do bigger attachments.

We can do gifts.

And this is really useful because we're at

the,

the

Um,

let's say socioeconomic level where some

of our friends have iPhones,

but some of our friends have Androids and

we're Android people ourselves.

So, um, that was,

that was the big get for her is

like, oh,

we can finally have a good chat

experience.

Yeah.

where we get all the little quality of

life stuff.

But yeah,

now that RCS is coming out and kind

of bridging that gap, I don't know.

I think it probably matters a little bit

less because RCS is also encrypted.

I mean,

there's still metadata concerns for sure,

but I don't know.

I'm not very good at getting people to

switch.

So I don't know if you have any

advice on that one.

Um, I don't have, I mean,

I just think you need to not be

too pushy about it.

Unfortunately, you know,

don't try and push it super hard.

I think when you start trying to like,

be like,

I'll only talk to you on signal.

That's like where that's where the,

that's where it stops working.

I found just like gently mentioning that

you're on signal and that's where you,

that's where you text most people.

And that's where you respond the fastest

is a good strategy.

I always think back to this episode of,

um,

Michael Basil's podcast and he mentioned

one way that he gets people to get

on Signal is he just takes a really

long time to respond if it's like on

SMS or any other app and then on

Signal he responds instantly.

So then it's kind of like you're training

them to message you on Signal instead or

get people to

I don't know,

get people to realize that you're more

available on a different app, right?

I think that is also the issue that

I've had is people will get onto Signal,

but they won't keep using it to message

me.

So I just think trying to be gentle

about it.

Don't be too...

just be normal.

Well, not, you know,

as normal as you can be about this

sort of stuff, but, you know,

just gently mention that it's where you

prefer to be messaged and that's your

personal preference.

And I think most people who are respectful

will

acknowledge that and they'll be fine with

messaging you on Signal instead of

whatever other platform.

I think as long as you're using an

encrypted platform,

I think you're better off than nothing,

right?

Like if you're using WhatsApp,

for example,

Then, you know,

you can casually mention that.

I know some people have added that to

like their Facebook or like WhatsApp

profile picture.

Like I've moved to Signal or something and

like stuff like that.

You can do that as well.

But I think, you know,

you can't control other people.

So if someone really doesn't want to

download another app,

which I think is a little silly because

most people that I know,

they download apps for everything.

They'll download an app for...

buying a burger.

They'll download an app for anything.

So I think most people are pretty flexible

on that.

But of course,

you're not going to move everybody.

I think that's just the way things are,

unfortunately.

But yeah, good luck.

And I hope you can get more people

to switch over.

But definitely try not to push it too

hard.

And I believe in you.

You can do it.

Yeah,

I was also thinking of that Michael Basil

thing.

Just to add on to that,

one thing that he noted is...

one of the things he does that makes

that strategy work really well is you have

to be consistent.

So yeah, he'll tell people like, oh,

you can text me or I respond faster

on signal.

And then they'll text him and he'll

purposely take like two or three days to

get back to him.

Like, I mean,

obviously not if it's a life-threatening

emergency, be, you know,

use some common sense,

but he'll purposely wait forever.

But then he's like,

but then when they finally give up and

they're like, oh my God, okay,

let me use the signal.

Maybe that's faster.

You have to actually get back to them

faster because

Cause if it's the same either way,

they're just going to be like, well,

he's slow either way.

So I'll just keep texting him regularly.

But if it's like, no dude,

he takes like three days to respond on

text,

but he responds in like five minutes on

signal.

Like that's, that's,

what's going to reinforce it.

So yeah, it's a.

For sure.

And yeah, just also you said,

don't be people over the head with it.

That's, I mean, really with privacy,

that is the biggest thing is I've had

the most success in my life with all

privacy stuff,

just by like letting people know that

like, this is my passion.

This is what I do.

This is my lifestyle.

And I'm here if you have any questions.

And nine out of ten times,

they don't right away.

But over time, they're, hey,

what was that ad blocker you mentioned?

Hey,

I'm really getting sick of like this

thing.

How do you get around that?

Like, hey,

how can I use Facebook in a more

private way?

And you know, like, which I know,

ideally delete it, but...

I digress.

So yeah, I think that's all I got.

I think maybe we could hop into this

next story that's also about meta.

Yeah,

let's dive into this next story from Ars

Technica.

So this story is about, like Nate said,

it's about AI smart glasses,

including meta,

but now there's so many other brands that

are releasing, which kind of is,

it kind of sucks,

but

Here's a story from Ars Technica.

AI glasses face their first major

government crackdown.

Norway wants to write permanent rules for

glasses that can record bystanders.

Quoting from the article,

Norway has become the first major country

to propose a temporary ban on the use

of AI glasses.

in selected public spaces amid growing

privacy concerns over wearable technology.

The Scandinavian country's government said

on Monday that it would introduce a law

to Parliament soon on a temporary ban for

places such as parks, beaches,

schools and kindergartens.

It will also set up an expert group

to propose permanent national rules.

A temporary ban will give us time to

conduct a thorough assessment and hold an

informed debate that can lay the

foundation for permanent regulation,

Torge Mikkelsen said.

Sorry if I butchered that.

Norway's digitalization minister said.

Parts of Norwegian society have already

reacted with their own bans,

including schools in the capital, Oslo.

and the country's biggest company,

oil and gas major Equinor,

which has banned them from its offices and

offshore facilities.

And Australia is also considering a ban on

smart glasses in certain public spaces,

while courtrooms in several countries have

issued bans as the use of wearable

technology increases.

Norway's government said it did not want

to propose a total ban,

but it said that the appropriate use could

be where

there was no risk of filming people

without their consent.

So what are we thinking about this?

Is this sort of a privacy win?

Is this too far for the government to

be making changes like this to ban people

from using these in public spaces?

I do wonder how this is actually going

to be enforced.

Um,

are they going to be inspecting everyone

to make sure that they're not wearing, um,

these glasses?

Cause I feel like they do look quite,

they look pretty normal.

They don't, they don't look particularly,

um, obvious, I guess at this point, but,

um, yeah.

How do you feel about this one, Nate?

Well, not to be overly political,

but as an American where we are the

country of basically like shoot first and

then maybe ask questions if you feel like

it, so to speak.

It is kind of nice to see them

taking that kind of a stance of like

–

Because again, a minute ago,

I just defended all the IoT stuff where

I'm like,

this is great for people who are

differently abled.

And again,

I've mentioned in the past that I'm not

always great with faces and I would love

something that's on device,

that's fully private, stays on device.

But I would love to have glasses that

remind me like, oh, you know this person,

you did this project together or you

chatted at this party.

And I would love something that does that.

So I'm not against this technology in

theory, but...

But I'm certainly against Meta doing it.

But it's I like the fact that they're

saying like, hey,

we're not banning this permanently,

but we need a minute to get a

handle on this.

And I think that's my favorite thing about

it.

Like,

I don't know if that's normal for other

countries to do.

I certainly we certainly don't do that

here in the US.

But I love the idea that it's like,

hey, we're not saying no,

we're just saying like, pause, timeout.

And let's figure this out.

So I think that's pretty cool.

And I mean, yeah,

even in my own life,

I can think of situations in my last

job where it's like we, you know,

I used to do audio video and we

do a lot of permanent installs.

And a lot of the time we'd like,

you know,

we're going to put a speaker in the

ceiling and you'd have to like stick your

head up into the ceiling.

And it's so hard to like get a

camera up there and get a picture to

show everybody else like what's going on

or, you know, and like, yeah,

you could just stick your phone up there,

but then like the,

it never turns out right.

And it would be awesome if I had

something like this,

I could just poke my head up there

and like snap some pictures or take some

video and then come back down and,

I don't know.

So yeah,

I like this idea where it's like there

could be an appropriate use where there's

no risk of filming people without their

consent.

But yeah,

I don't like this whole like here in

the US where you could just walk around

in public with these and film everybody.

And it's like,

cool that I didn't consent to that.

I didn't know what was going on.

But yeah, I don't know.

I'm interested by it for sure.

I don't know what's going to come out

of it, but I like it.

yeah so unfortunately you know i think

when we talk about these these glasses

unfortunately like they are being used

Like, of course, like Nate,

you're saying like, you know,

there's legitimate use cases for this

technology, right?

Unfortunately,

sometimes when we have technology that is

useful in some ways,

it's also being used for other things,

right?

And unfortunately,

there's a very large amount of harassment

and stalking that's being used with these

glasses, right?

So I think that is the main...

issue that the that these governments and

and things are probably concerned about as

well as you know just in general like

we talked about the the companies that are

that are not a fan of this obviously

you don't want people like recording

inside your offices of confidential

information sending that to meta that's

that's a no-brainer but um i think you

know unfortunately these these like camera

glasses are being used to

stalk and harass women you know at the

gym at the beach just like record people

without their consent um provoke people

and make them say things that they

wouldn't usually say and then record them

it's it's not a great it's not a

great outcome i think um

Someone should be aware that they're being

recorded.

If they can't tell that they're being

recorded, that's a little bit of an issue.

I think we can definitely talk a little

bit about, you know,

do you have privacy in public?

Is this fine to be recorded in public?

I think there's definitely some

amount of understanding when it comes to

that,

but I think there needs to be a

level of consent happening, right?

You know,

like if I see that I'm being recorded,

I'm going to act differently.

If I don't,

if I see that I am being recorded,

I'm going to act differently.

So, you know,

I think if you're in public,

there's a general, you know, rule that,

you know,

you can be

filmed and recorded, right?

Because there's cameras everywhere.

It's kind of how that is, right?

But I think, you know,

when you start recording people without

their consent and they don't know that

they're being recorded,

I think that's when that starts being an

issue.

But, you know, as I said before,

they're also being used to, you know,

record people in private spaces,

like in gyms, in universities,

in

workplaces and stuff like that which is

you know I think definitely an issue um

there was some comments here do you want

to maybe grab one of those um

Yeah, absolutely.

Because I definitely,

I agree with everything you just said,

where like there are certain technologies

that like,

even if they're useful technologies,

if the net negative for society is too

bad,

then we just don't allow those things.

And I kind of thought about what Vonnegut

Rosewater here said.

They said people with accessibility needs

should be able to get these kinds of

glasses through some kind of like

nonprofit or government org.

The issue is with meta farming the data

and everyone having them.

which was kind of something that I was

thinking.

It's like, okay,

well then maybe if this technology is a

net negative for the general public,

then maybe it would be better to make

this, I don't know about regulated,

I feel like that might be a little

too strong of a word,

but maybe it should be like a restricted

thing where it's like, you know,

I mentioned using it at work.

Like, okay, I show up to work,

I clock in, the supply guy or whoever,

whatever you want to call him,

the warehouse guy,

gives me my glasses and,

that I can go take on the job

site and I can film these things.

Cause also, you know, we,

you mentioned that a lot of these places

I was working at were like private

businesses and boardrooms, um, some very,

very big companies that all of you know

that I'm not going to name.

Um, but you know, it's like,

I've been in really sensitive places.

And so, yeah, the idea to like, yeah,

you can take your glasses and then the

project managers can use them to get

updates, uh,

you

At the end of the day,

I turn them back into the warehouse guy

and I don't take them home.

So yeah, something like that.

I don't know if that's the best,

but yeah, it's something like that.

And kind of what you said,

what you also said, found out here,

expectation of privacy laws need to be

revisited wholesale now that we have all

these recording devices.

I totally agree.

Again, I don't want to be too political,

but that's one of the arguments they have

in America when the whole gun rights thing

comes up.

When the founding fathers wrote that,

they were still loading individual shots

into muskets.

Machine guns and pistols and

semi-automatics did not exist back then.

It's kind of the same idea of the

laws that we have now were not written

for the technology that exists today.

And I totally agree with that.

Like what you were saying about

expectation of privacy in public,

I wrote a blog post a long time

ago that I should probably repost

actually,

where I compared the expectation of

privacy and I called it the expectation of

stalking.

Like the example I used was during

lockdown,

I went to the grocery store one time

and it was COVID,

so I had a mask on and one

of my friends texted me and was like,

hey, I saw you leaving the grocery store.

And I remember looking around and I'm

like, how did she recognize me?

Everyone has masks on.

And then I looked down at my tattoos

on my arms and I'm like, oh.

duh.

Yeah.

I kind of stand out.

And, and I mentioned, I'm like, yeah,

that didn't bother me that she's like,

Hey, I saw you at the grocery store,

but it would have bothered me if she

like followed me home and wrote down every

stoplight I went to.

And like, you know,

and that's the difference is like, yeah,

I don't really have an expectation of

like,

if I walk in front of a camera

or if somebody snaps a picture of me,

but it's the fact that all this data

gets recorded.

Um, I think it was again, Vonnegut said,

you know,

it's all this data goes back to meta

farming it from everybody.

That's kind of the issue that I have

personally, um, myself.

So

Yeah, I mean, it's...

I agree with both of those.

Like, maybe these are...

is a technology that just should not be

widely available to the public.

Maybe there should be more obstacles in

the way and they should be used for

very specific purposes from certain people

or... I don't know.

And Vonnegut also said, he said,

even if the government doesn't step in,

I am heartened by the fact that people

are now embarrassed to wear these things

in public.

Yeah, they're very polarizing for sure.

So, I don't know.

It's...

Yeah,

I'm very glad to see that there are

governments like, oh man,

I had one other thought that I just

forgot.

I don't like how a lot of these

tech companies are just releasing a thing

into the world and like, okay,

this is a thing now.

And we're not really having a chance to

say whether we want this and what the

rules should be.

And I appreciate that Norway is trying to

do that.

And I hope other governments will too, so.

I think those are all my thoughts.

Sorry if that was a bit rambly.

I think unless anybody has anything else,

I know viewers have already weighed in,

but yeah,

do you guys think there should be a

total ban?

Do you think it should be okay in

specific situations?

But for now,

I think we'll move on to our next

forum update.

We kind of had a lot of forum

updates this week because for those who

don't know,

we get these from

our forum, discuss.privacyguides.net.

And this week,

there were just a lot of really good

discussions.

When I was looking through, I was like,

oh, man, that's a good one.

That's a good one.

That's a good one.

So kind of made a little more space

for these.

And this one is kind of more of

a signal boost slash thought experiment.

This comes from one of our regulars who

said that Google randomly disabled one of

my accounts,

and this was my wake up call.

So

Let me see the parts I picked out

here.

So they said,

I had a Google account that I was

using as a secondary Gmail account.

I created it years ago.

They said,

I didn't even lie about personal

information or try to anonymize myself.

I never did anything illegal.

I sent maybe ten emails from this account

during the life of it.

Google had my real name, phone number,

etc.

I used a strong password,

two-factor passkey.

I listed my main Google account as a

recovery email.

I made sure to log in regularly and

generate some type of activity to avoid

being flagged for inactivity.

And they said,

this is actually something that is

recommended by mainstream tech outlets as

a way to boost privacy and security

because apparently using Proton and Tudor

is just too hard.

But they said, yeah,

like mainstream tech outlets recommend

doing this.

Even Google alludes to this being a

legitimate use of their service.

And they said, obviously,

I still don't know what rule I broke.

Google won't tell me.

I didn't do anything new.

This account was just randomly disabled.

So they said,

Google gave me the option to download my

info and send an appeal,

which entails a Google employee manually

reviewing my account information and

likely manually reading some of my very

sensitive emails.

Otherwise,

Google says they will delete the account

in about a year.

Since my emails were fortunately already

forwarded to my other Gmail account,

I'll likely avoid the privacy invasive

appeals process and allow them to delete

the account.

I was already convinced of the privacy

sacrifices of using Google services,

but I still considered Google to be

reliable and convenient.

And this is no longer the case.

If they disabled this account without any

reason,

they can do the same to any account.

And they said,

while I was in the mindset of de-Googling,

I was doing it at a gradual pace,

which is often recommended to avoid

burnout.

But with everything and shitifying so much

in the last few years,

this was the final wake-up call that I

needed to stop walking and instead start

running for the exit.

So...

Yeah,

a lot of people mentioned that this is

pretty common online.

Apparently there's like whole Reddit

communities where you can go to talk to

people and like,

here's how I was able to appeal it.

Here's what I said.

Some people said this is also true of

Discord.

Like there's whole communities about like,

here's how I contacted people.

One user noted the importance of making

regular backups,

which I totally agree with.

Another cited the importance of custom

domains.

So yeah,

I just thought there was kind of a,

again,

most of a thought experiment for people

to,

You know,

you can never be a hundred percent

risk-proof or a hundred percent resilient.

I mean, at the end of the day,

you never know if like ICANN is going

to disable your top level domain or

something, right?

You can never be a hundred percent

positive, but I don't know.

I guess I have some answers to this,

but Jordan, how would you,

or how do you think about trying to

reduce risk and maintain control of your

data and your online identity like this as

much as possible?

Well, I mean, I think, you know,

when it comes to these big tech companies,

putting all your eggs in one basket is

a concern.

And I think this same concern extends to

every other service that you use, right?

Like ProtonMail, Tudor,

whatever service that you're using for

your email.

You are trusting that single entity with

your email account.

And, you know, usually, usually,

as long as you're using a service within

what they deem as acceptable,

then you'll have absolutely no issues.

But like this person found, you know,

like there can always be false positives

that can be, you know,

you logged into your account using an IP

address that's blacklisted or something,

and suddenly you find your account's

disabled or something like that.

Right.

Um,

what exactly can you do to get around

that?

And I mean,

you mentioned it a little bit, but like,

you know,

custom domains are probably the main area

where you're going to be able to bypass

this, right?

If you just use your own domain,

then even if your email account gets shut

down,

you still have access to all the email

addresses.

I think that's also the case for

you know,

if you're using it with an aliasing

service too.

So, you know,

you can use these custom email addresses

for that.

I think, you know,

we can't really trust Proton, Tudor,

Google, whichever company to always exist.

So,

you should be kind of, you know,

planning ahead.

What does your strategy look like?

You know,

if one of these companies were to

disappear,

I think it's very unlikely that we'll see

Proton or Tudor or Google disappear,

but we can always, you know,

So I think, you know,

using custom domains is probably the best

way to avoid losing access to services.

But I think, you know,

you should also be careful because when

you use a custom domain,

you're linking that back to your identity

because you need to provide, you know,

your personal information in the domain

registration and such.

So...

there's more information that's connected

to that whereas you know if you just

use like an anonymous proton mail email

address it's definitely you get a much

higher degree of privacy on that so it's

kind of up to you to decide whether

something is that important that you know

losing access to it would be kind of

terrible so

Yeah,

and I think the downloading the emails

part too, I know me personally,

I pay for Proton,

so I get the Proton Bridge.

And I try to at least once a

week fire up my Cubes computer because

that's where I have the –

Thunderbird synced up and I try to let

it synchronize and pull all those emails.

So at least I have an offline copy.

I think Kerry Parker actually,

I want to say recently talked about this,

but I keep remembering I'm literally like

four months backlogged on podcasts.

So earlier this year,

Kerry Parker talked about how to go in

and how to back up your email.

And he did it in the context of

like moving from a very established like

Gmail account that you've had.

I think in his case,

he said he was actually one of the

OG users that's been using it like since

it debuted.

So he's got over a decade's worth of

emails.

I think two decades.

I forget exactly how old Gmail is.

And he's talking about how to back all

that up,

how to make sure it's backed up,

how to store your backups.

So yeah,

I think that's for sure a good one.

Yeah, I don't know.

I don't have too much to say on

that one.

Like I said,

it was just kind of an interesting

thought.

I like to ask these thought experiments

because this is kind of like running a

drill, right?

This is the moment where instead of waking

up and going, oh,

I'm locked out of my email account.

What I do?

You ask yourself now, like,

what would I do and how can I

act now?

So I'm not scrambling if that ever

happens.

And yeah,

so I guess I'd throw that over to

viewers.

Like,

do you guys have any strategies you want

to share?

What steps would you share with...

I hate to use the word,

but quote unquote normie,

like someone who's just casually

interested.

They're not going to self-host their own

email, stuff like that.

So Oddbite said, I am so behind.

Yeah, I know.

It's because I used to commute to work

and now I don't.

So I used to just sit in traffic

and I had all the time in the

world to listen to podcasts.

And now I just wake up and sit

at my desk and start working.

I need to get back in the gym.

That'll give me time to start sorting

through podcasts.

But yeah.

Um, yeah,

I guess unless you have any additional

thoughts,

I think we can move into the site

updates.

Yeah.

So I guess,

do you want to start taking that or

should I, should I start?

Yeah,

I'll go ahead and kick this one off.

So, um, in a little bit,

we're going to talk about how attackers

successfully imitated Google,

but first we're going to talk about what's

been going on at privacy guides this week.

Um, again,

remember to leave questions and comments

in the chat and we'll get to them

in just a moment.

Uh,

So first up,

we put out a new video.

It's been a mostly quiet week.

Just a lot of things going on behind

the scenes.

I'm working on a new script.

I know Jordan's editing the next video,

which I'm hoping you guys will like.

But in the meantime,

I knocked out another tier list video.

This one I think so far has been

a little bit less controversial.

I will say,

so I did not know that Outlook...

had email aliases that did not show up

in my research.

And so some people have left comments

asking about that.

I also just realized on the topic of

email, we were just talking about that.

But yeah, a few people left comments like,

oh, you didn't mention Outlook.

And it's like,

I didn't know Outlook did that.

And I know apparently I did mention

StartMail because I knew that if I didn't,

people would ask about it.

Apparently FastMail also has aliases.

Again, did not know that.

Apologies, but...

you know i tried to go over like

gmail has the whole plus thing um you

know proton uh addy simple login we even

talked about apple so uh yeah for sure

um i think that's kind of like i

said we've uh i'm writing the next script

jordan's editing but i think as far as

videos go that's kind of all we've got

going on this week um jordan have we

had any uh any interesting stories

articles anything like that

Yeah, so as usual,

there's always news briefs going up at

privacyguides.org forward slash news.

And, yep,

so we've had a post about Android

on-device AI getting a security bump with

next-gen enclaves.

And that's an article by Fria.

And there was also an article there about

Apple tightening full disk access issues.

permission with, you know,

I think this was relating to Muse

actually.

So kind of related to the highlight story,

but yeah,

because of the AI agent concerns.

So they are restricting the access of AI

agents a little bit.

There's also the support privacy guides on

DAF day,

so if you didn't miss that if you

missed that there was um a fundraising

drive that we were doing so if you're

someone that wants to give to privacy

guides definitely check that out and yeah

I guess that's sort of the only sort

of things we've had going out um as

usual Nate does the um

data breach roundup.

So there was a data breach roundup from

October third to October eighth.

So you can check that out if you

want to stay up to date on data

breaches.

So those are

all the news briefs that have been going

up this week.

And like Nate said,

I've been working on the,

a new video that we're going to put

out soon,

but it's ending up to be quite a

monster.

So it's, it is kind of long,

so it might take a little bit longer

to, to, to get that out to everybody,

but it's looking like almost,

it's looking like almost, and yeah,

as you know,

like these high quality sort of edits do

take a little bit longer.

But I think everyone will be,

I'm very happy with the video.

I think it'll be really interesting.

I'm learning a lot of things.

I'm learning a lot of things,

let's just say,

about all sorts of digital rights stuff in

the US,

which I think everyone will find very

interesting.

But as always,

all of this is made possible by our

supporters.

And you can sign up for a membership

or donate at privacyguides.org or pick up

some swag at shop.privacyguides.org.

Privacy Guides is a non-profit which

researches and shares privacy-related

information and facilitates a community on

our forum and matrix where people can ask

questions and get advice about staying

private online and preserving their

digital rights.

Now let's talk about the future of Kagi's

Orion browser.

But just remember everybody that you can

leave your questions in the chat and we'll

get back to them in between stories.

Okay,

so here's this article from Linux Yak,

and it's,

Kagi N's Orion browser development for

Linux will open source it.

Kagi has announced that it will stop

developing the Orion browser for Linux and

Windows,

ending its direct work on these platforms.

The good news is that instead of dropping

the project,

the company plans to open source both

versions so that other developers or

organizations can keep them going.

Orion first came to Linux in early alpha

at the start of the year,

then officially entered beta in August.

Kagi says the current Linux beta will

still keep working and it will stop

getting updates from the company after

October second, twenty twenty six.

Orion uses WebKit,

which makes it one of the few browsers

trying to offer an alternative to many

Chromium-based ones.

Kargi says that keeping a browser running

on multiple platforms usually requires

either a lot of funding or a big

open-source community.

Since Kargi has neither,

it will now focus its limited resources on

Orion for macOS and iOS.

Kargi plans to publish the source code for

both versions and share more details

within thirty days of the announcement.

The company has also reached out to open

source foundations and organizations about

possibly taking over the projects in the

long term.

I think this is sad, but I think,

you know,

it is understandable that they've made

this move, unfortunately.

But it's good to see that they're not

abandoning the project and, you know,

open sourcing it might give us a chance

to see

how good the browser actually is,

if there's some good work that's been put

into it.

And I think when it comes to community

development,

so many projects that are gigantic rely a

lot on the community to keep things

maintained.

I think huge backbones of the internet are

relying on these open source utilities,

open source programs.

I think...

there is definitely the community to keep

this alive.

It just depends if people are actually

interested in keeping it going and if

there's actually interest,

especially when it comes to a browser.

I think that's where it's not possible for

a single person to keep maintaining this.

It needs to be a group of people

working on this to keep it up to

date.

So it'll be interesting to see if this

just becomes sort of a

you know,

maintain status where it just keeps

getting updates to keep it up to date,

but no new features are added,

or if this will actually become more of

a solid open source project on Linux and

Windows.

But I do think it would be extremely

nice if they open sourced it on macOS

and iOS too.

just open source everything.

You're doing it now.

You're working on it now.

Just get it, just do all of it.

I think it would probably be better,

even if you don't accept contributions,

just make it open source.

I think that would be the best way

to go.

But yeah, what,

how do you feel about this, Nate?

Is this, you know,

were you thinking this was coming or like,

have you used like Orion before?

Like I'm genuinely interested.

Um, I haven't used Orion.

I think mostly because

Well,

I know back when I first heard about

it,

it didn't have any anti-fingerprinting

features.

I went and checked the website today,

actually,

when I was looking into the story.

And I think it did add some now,

but I don't know what ones.

I haven't dug into it too much.

I don't know.

I had an iPhone for a while,

but then I switched to Android as my

daily driver.

And then the Mac I only got within

the last year for work here at Privacy

Guide.

So I kind of never really had the

opportunity or the reason to check it out

personally.

I can't say I saw this coming.

Like I didn't hear any rumors, but again,

I,

I also didn't really have my ear to

the ground in that particular space.

So I don't know if that's something that,

um,

people who are deeply involved in the Kagi

community knew about.

I will say, uh,

I think it was odd bite mentioned here.

Uh, yeah, he's like, um, you know,

at least they open sourced it,

which is kind of how I feel.

Um, you know, it's,

it's a bummer that they're shutting it

down,

especially when they just pushed it into

beta.

And now they're like, ah, you know what?

Nevermind.

Um,

But at the same time,

I think that's really cool that rather

than just being like, ah, nevermind,

we're not going to do it.

They're just like, you know what?

If anyone wants it, you can have it.

And I think that's pretty neat.

I think that's,

what's the word I'm looking for?

Mature?

Noble?

I don't know.

I think that's cool of them to just

admit, like, look,

we bit off more than we can chew.

This is a huge undertaking that we're not

prepared for.

I don't know.

For some reason,

I do kind of like that response.

Yeah, I don't know.

I think the thing I'm most looking forward

to is what we're going to find out

when it goes open source.

I wonder if it's going to be like

if we're going to look at the code

and be like, oh, actually,

they were doing some really cool stuff,

and we can build on this and make

something really awesome.

Because I...

from a user interface perspective,

I don't really care too much about

Chromium.

Like I know some people are really against

the Chromium monopoly and I get it on

principle, but as a user, like to me,

I, I use brave.

I use a Movad browser.

I use Firefox from time to time.

To me,

they're kind of interchangeable

personally.

I'm not really like,

they all pull up a website,

the same to me.

Um,

But I respect having another option that's

not Chromium-based.

And yeah,

so I'll just be interested to see what

the community thinks when they get their

hands on it.

And again,

are we going to crack it open and

be like, oh, wow, this is really cool.

We can do something cool with this.

Or is it just going to be like,

eh, whatever.

This isn't worth dealing with.

I don't know.

So yeah,

I'll be interested to see what happens.

Do you have any?

I think it's definitely,

Orion was definitely interesting to me

because one of the main features that

stuck out was it actually has support for

like a wide array of extensions that exist

on like Firefox.

So like, you know.

Yeah, I forgot about that.

You're right.

You block origin.

on Safari, on iOS,

and that was pretty cool.

I remember trying it out and I was

like, wow, uBlock Origin,

and it's the full version of uBlock Origin

too.

It's not just like a crappy version.

So it's cool that they have that ability

to do that sort of, you know,

do something different,

do actually push the boundaries of what's

possible.

I think that was the most interesting

thing to me about Orion itself was

Um, I think, you know,

when it comes to like the privacy stuff,

I think it's kind of easy, um,

for them to just not collect data.

So as far as I know,

they were not collecting huge amounts of

data,

like all the other browsers on iOS and

stuff.

So that was good as well.

But, you know, there's, there's just,

you know, differences about what,

what people want.

Right.

And I think a lot of features that,

um,

that, what do you call it?

Um,

Safari has actually give really good

privacy protection too.

So there was never really a reason to

add, um, Orion as like an, an option,

um, on the website.

So as far as I know,

it never really got, um,

it got considered.

There was people who wanted to get it

added.

Um, but it seems like they didn't really,

um,

They didn't really push the boundaries far

enough for it to become something that we

recommend.

So it's still going to be existing on

macOS and iOS.

So for those people that want to keep

up to date,

that's where it's being developed now,

which it's good that they're focusing in

on what they believe is the right

platforms where people are most interested

in it.

But I think it is a shame that

we're not going to see any more

development from them on Linux and

Windows.

It's unfortunate.

Yeah, totally.

I forgot about the extension thing.

You're right.

That was pretty cool.

So yeah, again,

we'll throw that one to the viewers.

What do you guys think?

Are you interested to see where it goes?

Do you think this is just not going

to go anywhere?

Username is nice.

I'm optimistic.

Maybe the FOSS community can take

advantage of it.

Yeah, we'll see.

Real quick,

before we jump into our next story,

which will actually be another forum

update, Foundog,

going back to our previous story or our

previous forum update,

said Google Takeout or Apple's privacy

portal exports every so often.

So yeah,

if you are using Gmail or iMail, iMessage?

No, not iMessage.

iCloud, I don't know.

You know what I mean.

If you're using one of those,

be sure to go ahead and look into

that and back up your data.

And then, hi, I'm new here.

Had a question for you, Jordan.

Ballpark estimate,

how long does it take you to edit

videos on average?

Ballpark estimate,

it depends on the video as well.

I find if it's something like a tutorial,

like we did a whole series on securing

your mobile device,

those are easy to edit videos, I find.

It's all stuff that's easily accessible.

It's not hard to find information.

I don't have to make custom graphics and

stuff like that.

The history videos definitely take a lot

longer.

I think we looked...

I looked at it and I think it

was around... ...sixty hours, I think,

for the previous one.

So it is kind of a lot.

Not the entire...

I'm not editing the entire time, but,

you know, like...

that's that's like the whole production

pipeline so it can take a decent amount

of time um I think also people I

don't know there's there's people here

like no we do all sorts of other

stuff apart from just like editing videos

we have to you know do the podcast

and like keep on top of all the

other stuff as well so you know um

that's not a hundred percent of all that

time but uh it's I think

At least with the previous one,

it seemed to help that it was so

high quality.

I hope that, you know,

that was the reason that it did as

well as it did.

But it does take a little while to

edit, so...

But I do think it ends up being

worth it.

But yeah, that's sort of the timeline,

at least for the last video, so...

Yeah,

I know you also help out a little

bit with forum moderation.

I do some news shorts from time to

time,

which I do those a hundred percent myself.

I don't waste your time editing those

because those are super simple.

But just to kind of, like you said,

like we don't just do like writing or

editing or filming, you know,

we got other stuff we do back here

too, so.

um hi i'm new here said there's too

many browsers i feel that way about

messengers personally yeah yeah it's it's

it's definitely yeah there's there's a lot

of browsers now and i think the ai

stuff has definitely made it a lot worse

you know there's like so many new browsers

that are coming and popping up so yeah

i think this one did bring some

interesting things to the table though but

yeah

We'll see where it leads.

In the meantime,

we'll take a quick forum discussion.

This one really jumped out at me because

I feel like, I don't know,

this is just an interesting question that

I think needs to get asked more.

So this actually comes from a new forum

user who just joined the forum.

They said,

I've been using a VPN for a while,

but sometimes I wonder if I'm actually

using it when I need to.

I usually leave it on,

but I'm not sure if there's any real

benefit when I'm at home on my own

Wi-Fi, for example.

Yeah, I mean,

pretty straightforward question is,

do I really need a VPN all the

time?

And

you know, one user, which I personally,

I fall in this boat again,

I live in America.

Um, they said they,

they don't trust their ISP.

So they use it all the time.

That's kind of where I'm at.

My ISP where I live is legally allowed

to sell data, um,

as much as they want pretty much.

So, um,

Yeah.

Super fun.

Let's see here.

Another one said better safe than sorry,

which is fair.

One user did point out, you know,

like they agreed, like they,

I use a VPN wherever possible,

but they also did say, yeah, there's,

you know,

there's issues like there's sometimes

sites block VPNs.

Sometimes you get more captures than

normal.

Personally, you know,

one trick that I do still recommend,

and I know a lot of people recommend

is if you put a VPN on the

router,

Number one,

that gets past a lot of device

restrictions.

Like a lot of VPNs will say,

you know, you can have five devices,

ten devices, whatever.

If you put it on a router and

then you have twenty devices on the

router, that all counts as one device.

So and it's also good for like,

you know, like smart devices like Proton,

for example, on their unlimited tier.

They specifically say that they work with

streaming services like Netflix and

Disney+.

So if you put a ProtonPlus VPN server

on your router,

you can put it over your smart TV,

and that'll give you a little bit of

extra protection.

You'll get the net filter,

which helps filter out some of the

trackers and the malware,

and hides your IP address.

So definitely useful, useful stuff,

for sure.

But...

It's important to remember VPNs are a

transfer of trust.

Instead of trusting your ISP,

you're trusting this company,

so you've got to make sure it's somebody

you trust.

They're also not a total privacy solution.

If any of you spend any time on

YouTube,

you've probably heard all the ads that

VPNs will solve all your problems and cure

child cancer and bring about world peace

and all that stuff.

Uh, don't fall for that.

Uh,

they can be useful to avoid your ISP.

Um, they, uh, I,

I've also seen in a past, uh,

as surveillance report,

we covered a story one time where there

was a news website that, um,

Oh, man,

I'm trying to remember the details.

There was a suspect in some kind of

attack,

and they had a reason to believe that

the suspect had read a news article

shortly before the attack.

So they had the news site turn over

all the IP addresses that visited within a

certain window.

So a VPN would protect against that kind

of stuff.

Not that we're encouraging crime.

Always got to throw that out there.

IP address is one part of your tracking,

pretty small part.

Yeah, just the point is defense in depth.

You know, they're not a perfect solution.

Make sure you're using DNS blocking,

privacy browsers, uBlock origin,

stuff like that.

None of these are perfect on their own,

but they all add up.

And sorry,

one more quick thing that popped into my

head while we were talking actually is if

you have a really solid network or you

have like a VPN at home on your

router,

iVPN has a really cool feature that I've

never seen anywhere else called trusted

networks,

where when your phone connects to the

trusted network,

it'll automatically shut off the VPN and

you can configure that.

So you can tell it, you know,

when I jump to cell network,

when I leave the house,

turn the VPN on, you know,

when I get home and I'm connected to

that home network, turn it off, whatever.

So I don't know.

Yeah, I don't know.

Did I miss anything there, Jordan?

I know you were kind of trying to

fix something.

I don't know if you had any thoughts.

Yeah,

so there was nothing that I can really

add to that.

I mean,

I will say like that feature that you're

talking about with the trusted network

stuff is I think Windscribe does have that

and I believe Molvad might also,

but I can't remember if Molvad has it.

I'm not sure.

Molvad didn't have it as of a year

ago because I was using them before I

moved.

Okay, yeah.

I didn't know Windscribe had it, though.

That's cool.

Yeah, Windscribe has it.

So that is cool.

We don't recommend Windscribe,

but we are looking at all sorts of

different services to see if they'll get

added at some point,

but that's why I was looking into them.

But, yeah, no,

that's all really good stuff.

I think also, you know,

you have to think about whether you need

that privacy for everything, right?

So like, you know,

if I'm just working on like privacy guide

stuff,

do I need to be on a VPN?

Do I need to slow down my connection

even more?

Probably not.

So, but you know,

if you're looking at stuff that you don't

want your ISP to be recording,

then obviously that's probably more of a

concern where you might need to consider

using a VPN.

I think, you know,

it's also interesting to see there's,

there's these new services like Obscura

VPN,

which kind of goes to this next level

of protection, right?

Because like you said,

it's like a transfer of trust, right?

But if you're using like Obscura, right,

then you're not really transferring the

trust as much or there's less trust that

is being needed to be

to be given, right?

So it's all interesting stuff,

but I think it always comes down to

your personal threat model and what you're

trying to protect against.

If you are looking at stuff that you

don't want your ISP or the government to

see, then maybe consider using that VPN.

But if it's just like benign stuff that

you're not really concerned about,

then maybe it's less of an issue.

I think it also depends on the country

that you live in, because, you know,

in some countries,

the sale of your browsing data is legal.

And, you know,

in some countries that is illegal.

So it depends where you live.

It depends whether that's a concern.

And there's also metadata retention laws,

which, you know, in Australia, it's,

I believe, up to three years.

So it's

You don't really want all that metadata

being stored,

especially if you're looking up strange

stuff.

That's a concern too.

Whether your country has metadata

retention,

whether your country allows the sale of

browsing data,

those are two concerns that you should

think about.

Most countries, that's not the case,

but there are countries where that is the

case.

So definitely double check that.

I agree with the IoT device stuff.

I think that's also kind of one of

those things where...

It's hard to basically, you know,

you can't install a VPN app onto these

individual devices.

So having something that covers your

entire network is extremely beneficial.

But I think when you do this,

you do run into issues where, you know,

Perhaps the IP address of the VPN server

that you've chosen to add to your entire

network is blocked on certain sites.

Then it becomes kind of annoying because

you have to spin up another VPN on

that device to basically bypass that.

So, again, another thing to consider.

But...

I'm not sure if you talked about this

as well,

but there's also the aspect of combining

this with other things.

Just using a VPN is not going to

protect you against every threat.

It's going to protect you against the

single threat,

which is your ISP recording the websites

that you visit.

You need to be using all sorts of

other privacy tools as well,

which you can check out on our website.

We'd recommend DNS blocking,

we recommend private browsers,

we recommend content filtering.

All these things combined give you

additional privacy from

the websites you visit and also your ISP

and other threats.

So, you know,

you need to use the required tools for

protecting against what you want to

protect against.

So yeah.

I guess throwing it over to the chat,

does everyone here use a VPN on their

entire network?

Is this something that you've had success

with?

Like,

is this something that we should talk more

about?

Yeah.

For sure.

Yeah, and on that note,

I think we're actually going to move into

our last story.

So if anybody's been holding on to any

questions or comments,

go ahead and drop them now.

We do have the chat open.

We also have the signal chat open for

supporters and the forum thread open.

So if you're on any of those,

Feel free.

And this last story is pretty wild.

This comes from Ars Technica.

The headline says,

hackers obtain counterfeit TLS

certificates for Google and other large

services.

So just real quick,

in case anyone doesn't know,

TLS is when you go to a website

and it says up in the address bar,

it says HTTPS,

and there's a little lock there.

Um, that's TLS basically.

And it's actually, believe it or not,

it's very, very secure.

Um, as far as I know,

it hasn't been cracked or at very least

it very rarely gets hacked.

Um,

that is what has made the modern internet

possible.

You know, that's why you can,

for the most part,

you can safely buy things online and your

credit card number usually doesn't get

stolen and

you know, you can, uh,

like send your password safely,

all that kind of stuff.

God bless TLS and a quick fan boy

moment.

Um,

that was also made possible because of a

case here in the U S called DOJ

versus Bernstein,

which Cindy Cohen was the lead attorney

on.

And we interviewed her earlier this year.

So go check that out on the channel.

Um, sorry,

that is a personal highlight career moment

for me.

So I'm going to show that every chance

I get.

Um,

Anyways, diving into this story here.

So it says that attackers launched a

series of attacks on the .gh, .sl,

and .as country code top-level domains,

and then modified the DNS records for

selected domains within those namespaces.

By controlling those records,

the attackers were able to pass automated

domain control validation checks and

obtain unauthorized certificates for

several Google domains and several leading

global brands and widely used online

services.

Google said that it updated Chrome to

block all certificates it identified as

unauthorized and worked with the issuing

certification authorities to ensure the

unauthorized certificates were revoked.

So Google did not identify that.

I hate to say this is one of

those stories where that's the bulk of

what we know.

Um,

Google did not identify the affected

domains it owns or name any of the

other organizations.

Um,

it says Chrome users do not need to

take any action to be protected,

but Google caution domain owners not to

rely solely on browser side interventions

to protect their users.

The company is advising domain owners to

monitor certificate transparency logs for

unexpected issuance across their domains

and publish restrictives, uh,

certificate authorization authority DNS

records to prevent attackers from reusing

cash validation.

So probably doesn't affect most of us

listening,

but if you are a sysadmin or something,

um,

They also say it's not immediately clear

what the other affected organizations are,

how many certificates were issued,

or if all of them,

except for those Google domains,

have been blocked.

The process for officially revoking

certificates is slow and cumbersome,

so browser makers have devised quicker

methods to block specific certificates at

the browser level.

With all known unauthorized certificates

now blocked, the risk is mitigated.

But as Google noted,

any certificates that remain undiscovered

posed a threat.

And let's see here.

I think that's all I wrote down for

notes.

Oh, no, no, no.

One more spot down here.

This isn't the first time threat actors

have obtained unauthorized certificates.

A two-thousand-eleven hack of the

Netherlands-based CA DigiNotar allowed

attackers to mint counterfeit certificates

for Google.com and more than two hundred

other high traffic domains.

The certificates were used against at

least three hundred thousand people with

ties to Iran as they borrowed the sites

in person as they browse the sites

impersonated by forged certificates.

There have also been many similar

incidents, since most often, though,

failures by certificate authorities,

but also domain holders.

And those are all links right there that

are underlined for those of you watching.

So, yeah,

check that article out if you want to

know more.

Yeah, I mean, unfortunately, a minute ago,

Jordan and I just talked about DNS block

lists.

And DNS block lists are fantastic,

and I use them, and I love them,

and I highly recommend them,

and I wish more people would use them.

But this is why Jordan was just talking

about defense in depth.

It's not always enough to block a

malicious domain,

because what if a legitimate domain gets

hacked?

Yeah.

I don't know.

Since we don't have a lot of information

about this attack,

I don't know if we really have a

lot of specific advice we can offer other

than, again, defense in depth,

keep your stuff updated.

Maybe there's that real-time safe browsing

thing from Google if you have a high

enough threat model.

But I don't know.

I didn't really come up with a lot

of defenses here personally.

I think this was more just a pretty

big story people should know.

Do you have any thoughts you could add,

Jordan?

I think the main thing to take away

from this that you didn't mention that I

think Jonah would definitely mention if he

was here is this is one of these

issues that happens with country code top

level domains.

So,

This is one of these issues where these

country-level, top-level domains,

and I think in this one it was

Ghana,

someone said it's Sierra Leone and

American Samoa.

So those top-level domains,

those have registries, basically,

in those countries that...

basically certify these like domains,

right?

So it's the actual, it's the registries,

the domain registries that I believe were

the issue here.

So like, you know, probably don't go for,

if you're going to,

if you're going to get a domain,

probably don't go for ones that are

using country level country code,

top level domains, probably avoid that.

Again, it's like one of those things.

If you see a website that ends in

.gh, .sl and .as,

they seem a little sus.

I've seen .as before, actually.

But, you know,

I think when you it's one of those

things where you can kind of vet a

website by looking at the at the at

the top level domain.

If it's something more common, you know,

like we kind of push people more towards

generic top level domains because,

you know,

they're run by much larger registries.

There's less risk involved, I think.

But, you know,

that's always that's not always the

concern as well,

because like we saw a couple of weeks

ago, there was Autostisi, which, you know,

the US government got their domain

suspended because the registry was based

in the United States and they got placed

on a terrorist watch list.

So, you know, it's

um there's still issues with you know

generic top-level domains and this is one

of these issues where it's the core

infrastructure the internet is kind of

built in a way that doesn't really allow

for you know uh it kind of allows

for this sort of vulnerability to happen

right where these where these like domain

registries can be can be hacked and

impersonate and allows for impersonation

and all sorts of stuff so um

As far as I know,

that's what happened here.

But I might be wrong if someone else

has any more thoughts.

Like, I mean,

there's not a huge amount of information

in this article.

So I think the other thing was this

was a little – it was a little

yikes that it took them a whole week

to get this out.

You know, if these were compromised,

they should have probably been a bit more

quick to notify people.

I think that's another concern that we

should probably –

bring up Google you should probably do a

little bit better notify people

immediately because this is kind of a

concern right these are you know it's not

it's not good if people are getting that

sort of access to people's domains so yeah

it's it's all interesting stuff but I

think this is also kind of something that

we can talk about more about like you

know the defense in depth stuff so do

you do you have any suggestions when it

comes to that sort of thing

I don't think so.

Um, other than, you know,

what you said last time, like using,

I mean, again, keep your stuff updated.

Cause if you're using a Chrome based

browser, I'm assuming, um,

I'm sure it's not just Chrome.

Then the CAs would have been updated

almost immediately.

Uh, again,

if your threat model calls for it,

Google does have their like real time AI

scanning thing.

Um, it may not be right for everybody.

You're certainly giving up a little bit of

privacy, but if you,

if you have a really high threat model,

you know, um,

Yeah,

and thanks for adding that about the

country code thing.

I completely forgot that Jonah has some

bones to pick with that, which are fair,

which are valid.

We've also seen there was a,

I can't remember who,

but there was a Mastodon instance that got

kicked off their top-level domain because

it turned out it belonged to a very

conservative country,

and it was a very pro-LGBTQ instance.

And so basically the registrar was just

like, oh,

you can't use this domain anymore, so.

Yeah.

SCN here said pseudo app install OPSEC.

I just thought that was funny.

Yeah.

I think, you know,

that is the issue with these country code

top-level domains.

Like, you know,

if you're putting it in a country where

the government is a little hostile,

for instance,

it's a reason why I've never registered a

.australia domain.

Because I don't think that, you know...

our government it's great and everything

but like you know they're not the best

when it comes to like you know when

it comes to digital rights and like

respecting people's privacy and stuff so

you know i'm probably not going to

consider that rather use a generic one um

so again though this is like a it's

a personal decision what what you decide

to do with that but um there's some

more comments here um they needed time to

patch this up quickly telling people

there's something wrong with the protocol

it's kind of productive as opportunists

crave for these moments

I guess that's fair, too.

Yeah,

like they probably needed a bit of time

to make sure that this was like solved.

Right.

I guess I was just sort of just

reading what they said and I didn't really

think about it.

But that is a good point as well.

There was another comment here from Dicto

Pot.

Another reason to use a VPN,

even in countries with supposedly strong

data protection laws,

is because ISPs may also share metadata,

NetFlow data with third party

cybersecurity providers.

That's a good point as well.

Um, what was I going to say?

Oh, uh, yeah.

On the country level,

top domain thing too.

Um,

if you do decide to register one of

those, uh,

make sure you study them very well.

Cause I remember well over a decade ago,

I registered a dot us domain and it

wouldn't let me add the whole,

who is guard thing.

And in the back of my head,

I'm like, well, it's probably a bug.

Like, let me go ahead and buy this.

And then I'll hit up support and be

like, Hey, I couldn't register this.

So I bought it and I messaged support

and support was like, oh yeah,

you can't do that with .us.

Like for whatever reason,

I think it was a legal reason,

they're not allowed to put WhoisGuard on

.us domains.

To this day,

I am still getting the occasional piece of

spam, those random cold calls.

It's like, oh, we'll build your website.

We'll build you an app.

We'll give you a business loan.

I'm still getting that over a decade

later.

So yeah,

there's a lot of stuff that goes into

a country code ccTLD.

So if you think that is right for

you, definitely do your research.

I'm so salty about that.

But anyways, I digress.

That's all I've got.

I don't know if you have anything else

to add.

You are muted.

I don't think I have anything more to

add on that,

but I did see that there was no

more comments,

no comments on the forum thread or in

the chat.

So we could start ending out the episode,

I suppose.

Yeah, I think we'll call it a show.

So all the updates from this week in

privacy will be shared on the blog every

week.

So sign up for the newsletter or subscribe

with your favorite RSS reader if you want

to stay tuned.

We also offer a podcast available on all

podcast platforms and RSS,

which now includes video on supported

platforms.

And this video will be synced to PeerTube.

Privacy Guides is an impartial nonprofit

organization that is focused on building a

strong privacy advocacy community and

delivering the best digital privacy and

consumer technology rights advice on the

internet.

If you want to support our mission,

you can make a donation on our website,

privacyguides.org slash donate.

You can also make a donation on any

page on the website by clicking the red

heart icon located in the top right corner

of the page.

You can contribute using standard fiat

currency via debit or credit card,

or opt to donate anonymously using Monero

or with your favorite cryptocurrency.

Becoming a paid member unlocks exclusive

perks like early access to video content,

exclusive video content,

and priority during the This Week in

Privacy livestream Q&A.

You'll also get a cool badge on your

profile in the forum and the warm,

fuzzy feeling of supporting independent

media.

So thank you everyone for watching and

chatting.

Super fun.

And we'll be back next week.

See you next week.