This week's surveillance report covers France's first in Europe ban on social media for under 15s.
And fortunately, there is somewhat good news out of the UK and California to help balance that out.
A hidden device leaving US cars open to hacking, statistics undercutting chat control,
a wave of platform openness rulings against Apple and Google,
plus the usual data breaches, threats, and open source updates,
closing out with actually an update from ourselves as well.
Welcome to the Techlore Surveillance Report,
your weekly essential tech news,
delivering deep analysis on the latest threats
to security, privacy, and digital rights,
and empowering you to reclaim control and defend your rights.
Welcome, everybody.
We got a pretty good week this week,
and I'll do my best to give you all the news.
Let's get into it.
So today's episode is going to start in Europe,
specifically in France.
So Australia was the first country
to try a social media ban for minors,
and it's getting around it.
It's calling into question
the privacy implications. There's also this whole thing of having the companies who are the problems,
having to collect more personal data about people, and now putting more trust in their hands to
regulate themselves. And then we also have this whole thing of like, well, we're not actually
changing these platforms. Once these kids turn whatever age they're allowed to use the platforms
again, they're back on the same exploitive crappy platforms that have existed now for the last 10
years or longer for some of them. But France has decided that this is what they want to do.
So French lawmakers approved on Tuesday a ban on social media access for children under the age of 15.
In terms of the reasoning, President Macron, who in April urged young people to switch off their phones and read in order to become better citizens,
wants the law in place in time for the start of the next academic year.
So if you're curious for the timing on how that works, children younger than 15 right now will not be allowed to open a new social media account from September 1st.
And honestly, those are kind of the established facts of the story.
There isn't too much yet.
There aren't even that many quotes from it.
It was a pretty wide majority of people who approved this in parliament.
I get especially frustrated because I understand why people want to rein in these big tech companies and these social media platforms.
I have massive problems with these platforms, but I also have massive problems in just banning them outright and just telling kids not to be on them, especially when we actually look at the technology required to do that.
the privacy implications, whether or not they've actually been shown to work,
which if you look at Australia, which is already past this in December of last year,
it's not working very well. These kids are getting around it. They're using VPNs. And in
the UK, they've also done similar things. And the UK continually teases this concept of banning VPNs
and trying to go to the next downstream thing without actually fixing the real upstream issue.
And I think that's really what I'm trying to target here. Banning social media is a potential
solution, but it's going to create so many more downstream impacts like the ones I've covered.
Whereas if we look a little bit more upstream of this issue, we see the real problem with these
platforms and how universal they are. It's the fact that they are collecting such data in the
first place and they're using that data to exploit you as an individual. It's the fact that they have
algorithms that are designed to be addictive. They implement dark patterns. These are tech companies
that are literally hacking human biology and just banning it from people under 15, I think sends the
wrong message. I also know that the reality is the internet is how people are doing things.
Really radical response to try to do something people have neglected for over 10 years.
This has been happening this whole time, and it's just taken too long for anyone to do anything
about it. And I think this is the radical approach, which frustrates me, but that's why I'm here to at
least give you my take. And also, if you're in France, you can still contact your politicians,
but especially if you're outside of France and the rest of Europe, and also any region at this point
in the world. It's important to contact your politicians about this stuff because, again,
it seems like and sounds like it's very popular to people because the overall premise sounds good,
but the actual implementation and we see countries that integrate this, it is not good. And so it's
important to educate people accordingly. If you're listening to this podcast, I think it's the number
one thing you can do this week. Now, it is not all bad news. There is a bit of good news here. Now,
The UK actually got a new prime minister, Andy Burnham, and he is planning digital ID scheme.
He's pretty much come forward and said, hey, this is all a distraction.
We want to focus on the cost of living.
This isn't something we want to focus on.
So let's focus on the economy and what really matters to people.
And so he's pretty much saying we're not going to do this anymore.
Now, I do want to be clear here because there's a lot of stuff going on in the UK,
and a lot of them actually function quite independently of one another.
So we have the UK going after these social media bans.
They also tease VPN bans.
This has nothing to do with that.
They're also targeting many other things right now in the space, like age verification.
I don't think this even necessarily touches on that.
What this is specifically is, and this was covered on the podcast, but it was from a long
time ago, it's this scheme to tackle illegal immigration.
So think of this more as like a digital passport and a way to just verify your identity on the
internet.
So this is actually a lot of things that are of concern in the UK right now.
And so this is something that is a small win in the right direction, but I'm still following
a lot of other UK news.
So I guess we'll see where the UK heads.
Maybe this kind of leadership change may change things drastically for the other places.
Time will tell.
Stay subscribed.
I will definitely let you all know.
Now, another piece of good news here is that California Senate has dropped browser age ID
mandates, but the operating system checks still remain.
So I did coverage for this in a dedicated video not too long ago on the main Techlore channel.
But California has been teasing age verification.
But apparently this age verification is designed to be grouped into buckets.
And it's attestation, I believe, which if I'm getting the terminology correct,
means that there isn't verification beyond that.
But this is actually what prompted the entire Linux world to freak out
because it requires Linux users to have to then start signaling to developers.
And this is built into the operating system what age each user is.
And so you started saying to Linux community, go crazy about this.
And you started seeing forks of projects saying we're not going to add this in.
Some projects even said we're not going to deliver software anymore to California as a result.
So there's a few things going on here that I want to be clear about.
There was two different pathways that they were looking to explore this age bracketing scheme.
The first was actually in browsers.
So a browser gets your age scheme.
Ideally, you just say what it is, but it's unclear quite what that would look like because it hasn't been done yet.
And then each site could essentially request that from the browser.
And then the second version of this was from the operating system to specific applications.
Now, they have dropped the browser level one.
So that is the big positive news here.
And also for those who missed it, they actually did add an exemption for open source operating
systems as well.
So if you're using any kind of open source operating system, you don't have to worry about
this.
But if you're using Apple, Microsoft Windows, anything there, there is this age bracketing
scheme.
This still isn't signed into law.
It still needs a governor's signature and there's still unfolding things about it.
So it's not too late to still continue to contact your representatives, especially in California.
But they also talk about a lot in this article about Texas and the different approaches they're taking and how Texas hasn't been backing off on theirs.
So there's a lot of stuff going on all around the world right now.
And so I really want us to zoom out.
And, you know, you might be listening in from the Netherlands.
You might be listening in from Canada.
You might be listening in from Brazil.
wherever you're listening in from,
just remember that these things are spreading like wildfire.
So right now I'm talking about these three regions.
But last week it was a different set of regions,
and I'm sure next week will be a different set of regions.
And so that's why it's important to keep up with this news,
whether it's on your own time or if it's the podcast or the newsletter.
Keep up with this stuff.
And also make sure that you're trying to find even a subtle way to get involved,
whether it's contacting your reps, whether it's educating people around you,
whether it's just making a single post on socials if you're on social media.
And just communicate some concerns you have with it.
It doesn't have to be a massive essay.
I think just getting the word out, educating people,
communicating with the politicians as best you can,
it can actually make a pretty big difference
when you have thousands, hundreds of thousands,
even millions of people getting involved.
So make sure to find a way to get involved
that is most aligned with what you're good at
and what you enjoy doing.
All right, this next story is a very exciting one
cover. Well, it's not exciting. It's actually not really good, but it's exciting from a technical
perspective because there's a lot of lessons here and I just thought across the United States that
leaves them completely vulnerable to hacking and paralysis. The overall concept here starts
with something called a car alarm device, K-A-R-R. These are installed by typically car dealers,
not manufacturers or owners, and used as a measure to prevent auto theft from the lots of these
dealers. Yet when the cars are sold, the alarms typically aren't removed, even if the buyer
declines to pay for it as an additional feature. This means that car owners across the U.S. have a
hackable device under their hood whose code they'll need to update to protect their vehicle,
but one that in many cases they never purchase and have no idea is there. So there is a very good
chance that if you have a vehicle in the U.S., you could even have this thing in it and not know. So
everybody, especially in the U.S., listening to this with a vehicle should probably follow up,
and I'll have some more actionable steps as we go along.
This discovery came from researchers at UC San Diego,
and this happens all over Bluetooth.
And again, I do want to cite here in the article,
they say at least half of car owners
who have this car device installed
didn't ask for it to be in their vehicles.
So you should check for a car sticker
in your car's driver's side window,
or in some cases, a sticker reading SWDS
for Southwest Dealer Services.
You can also look for a small button
with a blinking light attached
to the underside of your car's dashboard.
Apparently, car owners in Southern California are the most likely to have this device installed
due to popularity among car dealers in that specific region.
So these exploits that they found in this device can, with the tap of a button,
unlock a car at a start to prevent it from starting,
or it even has a mayhem button that they built into the app to hack a group of cars
to simultaneously and repeatedly trigger their horned lights.
Now, there is a video of this happening, which I recommend you all see in the show notes
if you are watching the video version.
you're going to see them tap the mayhem button here and you're going to see all the cars behind
them light up, which is pretty wild. Again, it's all over Bluetooth. The only thing that they can't
do, which is somewhat good news, is that they can't actually start the car's ignition. So there is a
silver lining here. But they did show how a locksmith tool, commonly available for resale, can, once a
car thief is inside the vehicle, be plugged into the car's dash to create a working key within a few
minutes and drive it away anyway. The security flaw here is that they used a single authentication
key shared across all car devices. So the UCSD researchers spotted that key in the code of the
smartphone app, which customers who pay for the alarm can use to control it. And with that key
and the homemade app they created by reverse engineering the car's app code, they found they
could just spoof radio commands that would be accepted by any nearby Bluetooth-enabled car
device. Very poor implementation of something that should be considered basic security. And the fact
that dealers weren't removing these from your car and it could just be on a car that you own is
wild. So takeaways here. Cars in general are kind of a nightmare still in 2026. So I like to really
proceed with caution here and advice because there isn't a huge amount you can do. You know, a lot of
people online are going to tell you, oh, that's why I drive around my 1964 vehicle and it avoids
all these problems. And it's like, okay, that's great. But also a lot of people have newer vehicles
and you can't get around some of these problems. So I always like to look at opt-outs when possible.
You have tools like privacy for cars that do exist on their sites.
There is a bit of a paid funnel there, but you can do a free scan to see what kind of
data is collected by your car's manufacturer by default.
It's good to check in with your dealer when you're purchasing your vehicle to ask, hey,
are there any add-ons or devices that are in this vehicle that I should know about?
And now we know the name KARR is a good name to throw around if you're getting a new vehicle
as well.
Again, utilize opt-outs when possible.
And if you really want to go on the more extreme side of things, on most cars, you can typically
find a way to disable the cell modem or remove the SIM card or have some way to take the
vehicle offline.
But that typically will come with some kind of usability limitation.
This is a very difficult place for me to give advice.
But all I can say is to at least be educated and alert about these things.
And you can typically at least know what the risks are with your specific vehicle, which
is better than not knowing the risks and just kind of yoloing it.
And I think the best thing about knowing the risks, even if you can't solve all of them, is that you can keep it on the back of your mind.
And as things develop, as we get more tools accessible to us, some of those might have some better overlap and be able to at least partly remedy some of those other concerns.
Coming soon, we have Apple and Google being forced to open up.
But before we get there, I just had a quick thread from Patrick Breyer from Europe about
chat control and these new stats that came out speaking to how effective it is.
Now, last week, I talked about chat control and how the EU, unfortunately, has decided
to bring back chat control 1.0, which allows voluntary scanning of your data.
Chat control 2.0 is the more concerning one because it attacks encrypted data, which is
end-to-end encrypted and isn't supposed to be read.
And it's in some ways just requiring backdoors into sensitive conversations, which is far
but both of these are concerning. Now, we do have a guide coming out probably in the next 24 hours to
48 hours on what you can do about chat control and what it looks like to keep your data safe from
these kind of scanning tools. But I wanted to share a quick stat from Patrick Brayer that he posted on
Mastodon because he says that tech reports have never been so unreliable. This came from the NCMEC
slash US, and they found that in 2025, 52% of flags were legally irrelevant, which means of those
scans that were done, those 113,000 private photos were wrongfully exposed. They also found that 40%
of investigations targeted children aged 10 to 14 themselves, not actually people who are adults
exploiting those children necessarily. They take those photos themselves or share them without
thinking. Last year alone, these U.S. reports hit over 8,000 children in Germany, is what Patrick
reported. They also found that 53% of investigations targeted minors themselves, which criminalized
12,000 teenagers rather than going after the real people causing issues. And then Patrick has a good
way of closing these stats out, which is the police crime clearance rate for the online distribution
of illegal content online is already extremely high, reaching 87.1% in 2025. Now, again, this is
a very sensitive topic, but it's important to discuss and it's important to have open conversations
about it because it is a real issue online. So I don't want to dismiss this very real issue here,
but I am in the camp of finding a real solution to it. And I don't think just that mass scanning
out there is going to necessarily solve this problem. And that's what the stats are pointing
at, too. There weren't any other EU chat control updates this week, but I at least wanted to put
this on everybody's radar so you all can keep up with some stats given what happened last week.
And because chat control 2.0 is still around the corner and we need to already be getting ahead of
that. And you can go to fight chat control to get involved. It has never been easier with a site
like fight chat control dot EU. It really makes a difference. They've already failed 2.0 before.
we can do it again. We just got to keep fighting. All right. And we're about to get into the courts
forcing Apple and Google to open up. But before then, I wanted to share a bit about our sponsor
of this episode, Easy Opt Outs. They are who I personally use to remove my data from people
searching where you live, your family members, and they just do this all behind the scenes without
any direct relationship with you. And they take that profile and they give it to people searching
websites who then profit off of your data without your knowledge. Now, there are many removal tools
out there. But the reason why I like Easy Opt-Outs is it's not run by the data brokers themselves.
It's just run by a couple guys who knew they could do it for a bit cheaper. It's also one of the two
top performers in Consumer Reports' research from 2024, where they actually analyzed how effective
these tools are. They were tied with Optory, but the difference with Easy Opt-Outs is it is a
fraction of the price from Optory. Additionally, they only give your information to sites that
actually already have it. They don't just mass send all your information to every person and call it
a day. They actively look and you get a report quarterly with what that looks like. If you're
going fully automated, this is the best recommendation I have to share with people, especially in the
United States. And even if you go manual, I do recommend combining manual with an automated path
to make your life a bit easier. It is $20 a year, so it's extremely accessible compared to the other
providers. Check them out down in the description. Again, it's who I use personally. It's who I
recommend to my friends and family. So it's genuinely what I do recommend if you are looking
for a tool like this. Check them out down below.
the europe is really cracking down on a concept called interoperability this is not strictly a
privacy thing and i think it's really important for us to get away from this being just a privacy
thing because i don't think interoperability actually has very much to do with privacy i think
it has more to do with the broader concept of digital rights now i've had people from the free
software foundation of europe on tech lore talks our sister podcast and they explain this 10 times
better than I ever can. And they're literally the people who are fighting this war that I'm about to
talk about. And they're in the front lines. The concept of interoperability to them based on,
you know, I'm trying my best to relay their messaging is it's allowing small players to
take part in this ecosystem that these big companies have developed. As you grow in size,
if you're WhatsApp, if you're Apple, you actually have a lot less incentive to make your platform
work with everybody else. Whereas people who are smaller don't have that same incentive. They need
to work with what's out there. So WhatsApp isn't incentivized to make their platform work with
anybody else, but everybody else is pretty incentivized to work with WhatsApp users.
And the reason for that is Meta doesn't want you to use any other clients. They want you to be on
a Meta platform, but everybody else, if you're building a messenger and you're small and you want
to make a name for yourself, the fact that you don't work with WhatsApp means you can't tap into
the multi-billion user platform that WhatsApp has. And so these interoperability requirements are
assigned to the largest players, not the smallest ones.
So if you're small, you don't have to interoperate.
But if you're large, you have to open up your platform.
Now, Apple fought against this, saying,
no, developers shouldn't be allowed to publish apps in other places.
No, we don't need to open up to third-party browsers.
No, we don't need to open up to web apps.
No, we don't need to open up to other messengers.
What this is really targeting is the concept of an ecosystem.
When people talk about how hard it is to leave Apple's ecosystem,
it's because of these design decisions that they've made
to purposely make it difficult for people to use third-party services and tools within their
platform. And that's what interoperability is trying to target. And so Apple did fight it.
They are continuing to fight it. The court said no. And so this is just a quick update from the
EFF. They also covered this story. I don't think there's anything too new from the last time I
talked about it on the podcast, but I did want to just remind people it's going on. And the EFF
story was a perfect way to do that. So if you want to learn more about this, the EFF covers it quite
well in the show notes. Separately, we also have third-party app stores that are coming to Google
Play next week as Epic settlement is withdrawn. There is a whole story leading up to this between
Google and Epic Games. I am not going to get into those details right now because that can take the
next 15 minutes, and I think it's not too relevant to the practical stuff for the story. But Google
has confirmed that it will begin distributing rival app stores next in the stage for competing
platforms to take a bite out of Google Android's revenue stream. And this was published on July 15th,
which means by the time you're listening to this, this could already be live.
Now I'm going to level with you all.
I think what I'm a bit confused about here with this story is that
it kind of goes against some of the things that Google is doing
to try to prevent things like sideloading,
aka installing apps from other third-party app stores on your phone.
We've seen Google that's put out this advanced flow that they call
where you got to tap your tummy five times while you make circles around your head
and you got to kick your legs left and right.
And you do all these crazy things.
then Google says, okay, sure, yeah, you can finally start installing apps on your own phone.
I'm exaggerating, but really what it is, is there's like a 24-hour waiting period. You have
to reboot your device. You have to go into the developer settings, enable developer settings.
You got to do these crazy things to pretty much just start downloading apps from another app
source. So I don't really know how this decision from them goes with that decision. Are these
combined? Does it mean you can install a third-party app store from the Play Store? And then if you
try to actually install another app from that app store, you're going to have to go through this
advanced flow. So I'll do my best to do coverage for it as it comes out.
All right, everybody. And now we're going to get into the defense bulletin. This is the quicker
kind of segment of the podcast if you're new. And there's three subsections. There's the data
breaches, which is data breaches. There's the threats, which are things to keep you up to date
with the latest things happening so you can stay safe. And then there's just the open source news.
So if you're following kind of the better, more positive tools, we can end the podcast in that way.
And I can share with you all the new stuff happening in that side of things.
Now, the first data breach is from the AI music generator, Suno, which affected 55 million users per Have I Been Pwned.
If you're not already using Have I Been Pwned, I highly recommend setting it up already.
Or if your password manager integrates with it, however you're using this, it's good to stay up to date.
But they did get a copy of the breach data set.
And it includes names, physical addresses, and email addresses, phone numbers, purchases, and partial payment card numbers taken from the Stripe account.
Pretty brutal data breach.
So if you are in any way affected by this or you use this service, investigate in the show notes.
Now, South Korea has also disclosed a data breach impacting diplomats worldwide.
So if you want to learn more about this, check it out.
It impacted 6,000 individuals, 350 of them being current government attaches.
I haven't heard that word before.
A-T-T-A-C-H-E with an accent S.
Attaches.
That sounds very nice, but check that out if you want to learn more in the show notes.
Now, this story is a little crazy.
Apparently, a hacker deleted Romania's entire land registry database after a failed extortion
attempt, paralyzing the entire real estate market.
I didn't make it the main story because there was other more important stories to share
with you all, but this is one of those just really entertaining stories that you need
to just trust me.
You should read it in the show notes because it is kind of crazy.
It's got everything.
It's got high stakes.
It's got obvious things they could have done to prevent this issue.
It's got lessons.
And the hacker is even named and he has a history.
So again, it's a great story.
I do recommend reading it.
And I hope that you all read that into that one.
All right, next data breach is from Ernst & Young,
who has disclosed a data breach after a support system hack.
This is an auditing and professional services provider.
They offer auditing, tax, consulting, and transaction advisory services to major organizations.
So I think it's more B2B.
So if you don't personally use these, that's probably why.
If you have any relationship with this company, I would suggest reading more.
Now, this next one.
And oh, man, these are more embarrassing things I'm going to pronounce incorrectly.
Stay lauder, lauder.
Don't worry, though, guys, I'm going to do something a bit different today.
I am going to get someone else to do the pronunciation from me.
From the YouTube channel Face Palette Makeup.
Estilada.
There we go.
Alotta has disclosed a data breach via Oracle e-business flaw. They are notifying employees
of this after hackers exploited the flaw. So this is more human resources, employees of the company.
So if you are an employee of this company, check it out because it impacts a lot of sensitive
things like full names, addresses, email addresses, socials, passport numbers, literally your whole
life. So it's a pretty serious one if you are impacted. Please look into it. Now, if you enjoy
eating chickens, Chick-fil-A disclosed a data breach after credential stuffing attacks. So this
is an undisclosed number of customers at this point in time. It seems like very limited information.
And so I hope they follow up and disclose a bit more about this data breach. So stay subscribed
and maybe we'll get more information about that one. Now, Coca-Cola has suspended production at
its Fairlife Dairy after a ransomware attack. I did not know that Fairlife was owned by Coca-Cola.
So that was news to me. I don't drink Fairlife. So for me, this was another like, oh my God,
Coke owns that moment. But they said in the disclosure with the US Securities and Exchange
commissioned that its Fairlife Dairy Company was hit by that ransomware and that its production
systems were even affected. Specifically in the US, I might add, apparently Canada's kept separate
and they went unaffected. All right, I think this is like the 30th week in a row. I'm exaggerating,
but I actually think that it's been many months in a row where every single week we have at least
one WordPress exploit. And so this week's was called WP2 Shell. And this flaw was exploited
to install web shells. If you're a WordPress administrator and you have any kind of extensions
or anything that has to do with it,
please check out the show notes.
This is happening every week
and you need to stay on top of this stuff
to keep you and also your users safe.
And this is just kind of a recap article from TechCrunch.
It's called Hackers Are Exploiting
Recently Patched WordPress Bugs,
Putting Millions of Websites at Risk.
It's kind of just a summary of this entire incident.
Not that specific exploit, but just, like I said,
the many months of this kind of thing happening.
So if you want to learn more, check that out.
Now, the next one is an Adobe Chrome extension flaw
that lets sites access private WhatsApp chats.
So this is from the Adobe Acrobat extension for Chrome,
and it could have been used to access conversations
and data rendered in the WhatsApp web client
without any form of authentication.
This did require you to access a webpage
under the threat actor's control,
but the fact that this was possible in the first place
is crazy and should remind you to be careful
about the extensions that you have in your browser.
And if you have to use extensions you're not a fan of,
try to separate them from other sensitive things.
I think this is a great area for work profiles
or just separate browsers altogether
so that you can separate extensions from your web traffic.
Now, this was patched,
so make sure you're also keeping all this stuff up to date
and it should no longer be a concern.
But again, that principle I just shared with you
should be carried over into the future as well.
Now, there was a 7-zip exploit
and this was patched with version 26.02
and it was a remote code execution vulnerability
that could allow attackers to execute malicious code
by convincing users to open specially crafted compressed files.
So get yourself up to date if you haven't already.
And if you want to read more about that exploit, it's actually a pretty interesting one if you want to get more technical.
It's all in the show notes.
Now, Zoom has warned of a critical account takeover vulnerability.
This was discovered internally, and it was tracked, and it received a severity score of 9.8 out of 10.
This was specifically in their Windows client, and it's important to remind you that they have patched it, so get yourself up to date.
And sadly, they haven't actually disclosed too much of how it works.
So there might be more information that comes out, but that's all I have right now.
I covered a hide my email vulnerability a few weeks ago on this podcast that Apple's hide my email feature was exposing customers real email addresses.
Now, I want to be clear, there's two specific issues that were happening with hide my email.
There's the vulnerability, which actually exposes the real email address to the iCloud account.
That is a real security issue.
And that was patched.
Apple was looking to move away from that system and create a new subdomain for those hide my emails, which instantly tells people that you are using an alias email.
And if you use alias emails like I do, like SimpleLogin or Addy.io, you know that they can sometimes be blocked on websites.
That is still an ongoing thing.
This has nothing to do with that.
This was just that first issue, which is now resolved, which is at least something good.
This is something else from 404.
I'm not going to get too far into it, but they did find some links in that when you apply for a new credit card and you open one,
ICE now knows where you live because of all the data sharing happening between private and public companies and all this crazy stuff.
I know ICE is a very politically charged thing, and it has been a politically charged thing,
especially this year.
But for me, the concern, especially with all of this stuff, is just the lack of consent
in what is going on with your data.
If I'm applying for a credit card, I think what is reasonable to expect is my credit file
is touched and the company that I'm applying to gets my information.
So when you start realizing that, oh, they're also sharing data with these five middlemen
companies and they're all sending data to all these other data brokers and the government,
That is my problem, and I think everybody should be pretty pissed about that.
There's a reason why warrants exist, and things just aren't publicly available to anyone all the time.
There are probably safeguards that we want to have if we want to have a proper society.
This one also pisses me off, so I guess this is like the heated moment of the podcast,
because a period tracker app called Stardust was sharing users' health data with an analytics firm.
The company had a quote,
Your data is private, period.
Says period tracker Stardust on its website.
Period is part of the quote.
Like they said, period.
And Mozilla Foundation found that they were actually sharing user-sensitive health information
with a third-party analytics company, Rudderstack.
This included their birth dates, their birth control types, their reproductive goals,
and specific symptoms that the user was experiencing.
And it tied that record to a unique identifier in place of the person's name.
And even the FTC, which is not really like crazy privacy first on a lot of things,
Even they said it does not make the data anonymous or prevent it from being linked back to a person.
The Mozilla Foundation Security Researcher who found this, whose name is Wadinski,
even said that Stardust was the only app out of the six tested that shared the user's sensitive health data with another company.
This kind of stuff really pisses me off.
And again, back to that video that I made not that long ago,
I made a video that talked about this service that was on Shark Tank,
where you send a photo of your children to their platform and they build, I think, a book out of it,
or they build something out of it.
the point is they used very interesting terms and it's important that we get our terminology right
because so many services nowadays say they're encrypted your data is always private with us
encryption and transit encryption at rest they use all these terms which pretty much implies like
your data is yours man like nothing to worry about but the terminology is really important
to nail down i want to remind everybody encryption and transit i'm showing you here on the screen if
you're watching the video podcast it's the padlock the security padlock for your website it means
they're using basic TLS. Every website has HET vector data between you and the website. So in the
case of Stardust, if I'm accessing Stardust and their website and their app, it just means that
all the data I upload to them can only go between me and them. That's a great step in the right
direction, but they can still access that data and they can do anything they want beyond that.
Now, encryption at rest means that when they collect my data and they're storing it on their
servers, they're implementing encryption on their servers. So a hacker who gets in is going to have
a more difficult time accessing my data. The problem, though, is that encryption key is still
held by Stardust. It's not like Stardust can't read the data themselves. That's not the same as
something that we would call probably zero-knowledge encryption, where a service actually allows you
to control your own encryption key, and while they still hold your data on their servers,
it's encrypted in a way where not even the service themselves can access the data. These things might
sound like technical nitpicks or whatever, but these are huge implications. It's the reason why
Stardust can even access your data and can freely share it with third parties however they choose
to. It's the reason why a Stardust employee might be able to access your data, whereas with a zero
knowledge provider, they're incapable of doing those things because they don't have the data in
the first place. It's important to get the terminology right. Be very skeptical when
companies say your data is yours, your data is private, without actually verifying their technical
implementation of trying to guarantee that. If they don't let you control your own data, there are very
few safeguards and it's mostly a trust system that the company won't do anything nefarious with it.
Rant over, this stuff really pisses me off. And now we're going to move on with a quick victory
from the EFF who has said that Flock, the surveillance network all around the country
right now that's getting a lot of headlines. And I actually interviewed someone on a sister podcast
Techlore Talks from DFlock, which is the organization fighting Flock and all the advocacy that they're
doing. It's not live yet, but stay subscribed on that sister podcast or the YouTube channel
gatch that, but they have ended their rollout of the distress detection of human voices.
This was meant to try to analyze human distress, but they actually found that there was tons
of false positives.
It didn't work very well.
There's privacy implications for recording all this stuff.
And so it's good that they paused that.
And I know people who are anti-flock, which is definitely me back here too, are going to
be proud about that one.
All right.
And now we are down to just the open source section.
Now Signal, the open source end-to-end encrypted messenger has had polls and groups for a long
time now, allowing you to just ask whatever you want. We use them quite a bit in our Signal group.
If you want to join our Signal group, you can become a Techlorian in the description. But now
they have extended that functionality to direct messages. And so if you're messaging a partner or
a friend, you can still send the poll to them, which is kind of a fun thing. I think there's less
use cases for that, but I still think it's pretty cool. Tor Browser has released version 15.0.19.
This includes some security updates, and there's a few other little things in their changelogs. So
launched 5.8, which extends pass keys from secure authentication to verifiable authorization.
I'm going to be pretty real with you guys. This is very technical stuff that are very standards
based that I haven't dug very deep into. So like this supports the CTAP 2.3 standard and preview
support for the emerging web auth and signing extension, providing developers with modern
standards to implement secure flood enterprise at a station. And we also have 16 unique relying
party IDs. These are things I'm not as focused on. These are things that seem more IT focused.
I still wanted to put it on your radar so you all can dig into this.
Now, I did a whole video on a YouTube channel demoing this one, but Firefox has now made
their containers native in Firefox 153.
Previously, you had to install the extension in your Firefox browser to get multi-account
containers, but they are now just bringing that directly into Firefox.
It is technically a preview, but this is super cool, and I think it's going to make containers
even more easily accessible than they are already.
So I'm super excited about that.
And again, I covered this more in a dedicated video on the YouTube channel.
And how it compares to Brave, who also just released containers, actually.
And so it's pretty cool to have both browsers now support both profiles and containers.
So you don't have to really choose any one of those browsers for either one of those features.
There's also an update for Firefox for Android, where you can now group related tabs together.
And they go through how this works and how you can sort them.
And it's on the blog in the show notes if you want to learn more.
Vivaldi, the browser, hit version 8.1, which launches more customization features and more options for Android users.
So if you are a Vivaldi user, go check that one out.
WhatsApp has also developed first-party encrypted cloud backups for Android and iOS.
This is really big news.
The reason why I like this a lot is that previously,
if you wanted to do an encrypted backup of your WhatsApp data,
you actually had to opt into it.
And very few people actually knew this was the case.
A lot of people didn't know that if you did a cloud backup of your WhatsApp messenger,
it was actually going unencrypted to somewhere else where your messages could be scanned,
which kind of negates the reason to use an end-to-end encrypted messenger.
This implementation is stored on WhatsApp servers, and it will have end-to-end encryption enabled by default, which I think is a big step in the right direction.
It's two gigabytes of free cloud storage with paid plans available for those needing more space.
It seems like lately WhatsApp has been copying Signal with a lot of things, like they're copying usernames.
This is exactly kind of the system that Signal has set up as well for their native backups feature as well.
This doesn't solve WhatsApp's issues with metadata and the fact it's owned by Meta.
There's lots of other concerns with WhatsApp, but this is a step in the right direction,
I think, for them.
This is an update to a smaller project.
It's called Briar.
It's an open source, end-to-end encrypted messenger that is like balls to the wall on
the anonymity side of things.
It's Tor routed.
You can even use it without an internet connection over Blitz mode.
The app will still receive essential security updates and bug fixes, but no kind of feature
plans at the moment.
I don't think this is necessarily a permanent decision, but it's safe to assume now for the foreseeable future that Breyer is in this maintenance mode that they're calling, which I think is a good way to put it. And I'm glad they came forward to clear it up so we don't have to wonder anymore.
All right, this next one. You know, I really didn't want to cover this topic because it's not fun to cover. These aren't the reasons why I do this podcast. I don't like talking about random annoying controversies because I think everybody deserves the right to have digital rights. And so these stories are annoying for me. And actually, I wasn't going to do any coverage for this Mullvad story. But Mullvad themselves put a blog article about it on their own freaking website. And now I kind of can't because they have now taken this controversy and attached it to themselves on their own website.
site, so I got to talk about it. Now, Mullvad has a co-founder whose name is Daniel, and they don't
say who Daniel is in the very first beginning of the article, which is fantastic. So that's a good
start. I have to pull up his article, and it's Daniel Bernstein, who is a libertarian anarchist,
as he calls himself. And he made a pretty large donation to a political organization in Sweden.
That donation, a lot of people were not happy about. And especially if you're a Mullvad subscriber,
A lot of Mullvad users feel a bit betrayed because they don't align with the political beliefs of Daniel necessarily.
And it was a pretty massive donation.
I believe it was about like half a million dollars.
And it was, I think, the largest or one of the largest donations made to that party.
In terms of my role here for this podcast, my job is to educate you all.
And you guys should be able to make a decision on what is best for you.
And so I'm alerting you of this issue.
It's in the show notes if you want to learn more about it.
They even linked to Daniel's blog.
And that's where I think it's a bit annoying.
It's like, hey, this is what's really
taking a lot of people off.
They don't like this.
By the way, here's his blog.
You can read it for yourself.
And by the way, now it's on our website.
And we are, as a company,
adding commentary to this,
which now involves them.
And this doesn't have anything to do
with Mulvaz's privacy and security.
It's more about an ethical choice
that you all need to make.
Regardless of how you feel about him,
sometimes private individuals of these companies
donate to things that we don't agree with.
And it's very hard to draw a line in the sand on this
and be consistent about it.
Now, I think the one thing that is universal, and yes, it is, I guess, something that I can promote of my own as a result of this crazy fiasco,
is that there are kind of a lot of alternatives to Mullvad.
And so if you do feel strongly about this and you don't like the way they handled this, our VPN tool is literally perfect for you.
VPN.Techlore.tech, this is literally just data.
It has tons of filters on it.
You can sort by no logs.
You can sort by disk lists.
You can sort by anonymous registration.
And you can be like, I want Monero.
And then you'll see the three providers.
are Mullvad, Windscribe, and AirVPN, and you can just compare them. And there was a funny
Mastodon person who asked, is there a filter for avoided political controversies? Sadly,
there isn't. It would be quite hard to, again, draw a line in the sand on that.
But the tools are out there for you all to make your own choices about how you feel about this,
and I hope that is the best that I can kind of communicate to you all. The only thing I would
flag is that if you do personally not like Mullvad, and Mullvad's like off your list now,
Obscura VPN still routes through Mullvad.
And so I'm guessing some of the money you pay to Obscura would end up in Mullvad.
And or Mozilla VPN as well is also a Mullvad partner.
So just things to flag.
Also, Tailscale uses Mullvad, but that's a little bit more clearly disclosed that it's Mullvad.
Either way, I want you all to make your own decisions about this.
It's really hard to communicate nuance and complexity on the internet.
But I really do feel like you all appreciate that.
And it's why you come to this podcast and why you listen to these longer news
coverages that I make. So I'm hoping that it's what you all want. And again, the point is to
empower you all to make your own decisions, which is really everything I'm about. Again, check it out
in the show notes if you want to learn more. And speaking of the VPN finder, actually the last
story of the week is my own. I published the July version of our tools with some big updates. Again,
there are three tools. There is our quiz, which I think everybody should take. It's going to tell
you what your threat model is based on an archetype. And you just answer some basic questions about
yourself. It's kept only inside of your browser. You get to keep a private link when you're done,
and it's going to score you out of 100 on how well you're doing and match it to your archetype.
It's meant to be a practical tool to make you see what's going on and make things actionable
and expose any gaps in your privacy and security. We also have our tools themselves, which is kind
of like the starter pack kind of thing where I share what I think are really good services across
different archetypes. So it covers different threat models on the tools page, but it covers everything
from browsers and search engines, etc. And then I also have the VPN finder as well. And the main
updates from this month is that I added a lot more accessibility features, which don't impact maybe
most of you. But for any of you out there who are using screen readers or keyboard shortcuts,
I also moved the wiki, which was a new tool back to just the Techlore.tech website, it was just a
little bit harder to maintain. And I actually felt like it was smarter to put it as just its own tag.
So if you want to keep up with the guides that I'm making, all those guides are now on just our
main website, Techlore.tech. I think it's actually a bit more useful than asking people to go through
an entire wiki to find what they're looking for. They're meant to be very friendly for people in
your life as well who aren't tech savvy and don't know about this. I think the whole scoring thing
for the quiz is extremely effective at getting people to see if they're private or not. And most
people probably would be surprised by their score. All right, everybody. And that is going to conclude
this week's surveillance report. If this analysis helped you reclaim control, make sure you subscribe
to the newsletter in the description.
It's completely free
and it's just a written five minute version
of this podcast.
And while you're doing that,
you can also become a Techlorian in the same place.
You'll gain access to our private signal group.
You're also gonna get other perks
while keeping the podcast growing
so that we can keep publishing this for free
every single week.
And I really enjoy doing it
and I wanna keep doing it and I love it.
So I hope that you all can also support back
if you're able to.
If you're not, you can still leave a rating,
share this episode to spread digital freedom
to people around you.
That also is equally helpful.
And I just want to thank you all for being here,
taking control of your privacy and security
a little bit more every single week.
And I'll see you in the next episode of Surveillance Report.