CalyxOS is back in public releases,
some good news for privacy in the US,
and what would you do if a flock
microphone appeared in your yard
overnight?
All this and more coming up with This
Week in Privacy, so stay tuned.
Welcome back to This Week in Privacy,
our weekly series where we discuss the
latest updates with what we're working on
within the PrivacyGuides community and
this week's top stories in data privacy
and cybersecurity.
I'm Nate,
and with me this week is Jordan.
How are you doing, Jordan?
I'm doing great.
So excited to jump back into some more
privacy news this week.
Yeah, it was a busy week.
Thankfully, not super, super overwhelming,
but definitely no shortage of stories to
choose from.
And I think first up here,
we're going to go with some news from
CalixOS,
who is officially back in a public
release.
So some of you may remember,
to kind of give you the full drama,
let me go back to the beginning.
So I believe it was about...
Oh, God,
it was about this time last year.
Holy crap.
Maybe a little after this,
maybe closer to the fall.
But CalyxOS, which is a –
I know this is going to be controversial
just to say this,
but I think it would technically qualify
as a de-Googled Android in the vein of
something like Lineage or EOS,
arguably graphene,
just in the sense that it's like Android,
but they try to reduce some of the
Google bits that are in there by default.
We'll get into all that later, I'm sure.
But CalixOS,
they announced that a few of their key
members were leaving,
including their lead developer and
Nicholas Merrill,
who founded the organization.
And they also announced that coinciding
with that,
they were basically going to freeze
releases and completely redo their
backend.
And there was a lot of speculation because
it was really weird, right?
They were basically like, like a,
They were like,
we're going to rotate our keys.
We're going to come up with this new
key signing thing.
We're going to streamline our process.
Like,
we're just going to overhaul everything
from the ground up.
And there was a lot of speculation, like,
that's really weird.
Like, is there evidence of compromise?
Like,
did Nicholas take the keys with him when
he left?
Like, what happened here exactly?
And so they did put out a statement.
They were like, no, like,
there's no evidence of compromise.
But they still never really said why now.
Like, they didn't just say if it's like,
look,
we've been meaning to do this and now
is a good time or what the case
was.
But they said about four to six months.
And for the record, I'll admit my bias.
I like Kallax.
It was like one of the first...
I mean,
it was the first de-Googled OS that I
ran full-time.
So I have a soft spot for it.
But I do have to admit that they
really, really overshot that goal.
I think they finally...
um they finally released and here's what i
was gonna say some of you guys may
remember a couple months ago i think it
was around february or march uh maybe
january i'm bad with time they finally
announced um you know okay we have this
like beta release that you can go and
download um but they weren't fully back
yet like this so that's what this is
they are like we are back we have
a full release you can go download it
now you can use it um
Their communication could have been better
during this almost year long process.
They only issued like three or four status
updates.
And again,
they really never explained like,
why are we running behind?
Why is this taking so long?
What are the roadblocks?
Just a personal pet peeve of mine.
Like I'm, I know I'm kind of,
doing the analysis already.
But, like, I'm a really big fan of,
like,
if something is taking longer than
expected, tell people why.
Don't just be like, oh,
we're working on it.
We're working on it.
Like, tell people, like,
we ran into this issue.
This broke.
This turned out to be harder than we
expected.
Blah, blah, blah.
Just let people know, man.
But anyways.
So, yeah.
So, it's fully back.
There's version seven dot two dot two dot
zero,
which unfortunately is still based on
Android sixteen.
They have not upgraded to Android
seventeen yet.
But...
On the plus side,
they do say that there is,
they do support a new phone now.
Where did that go?
I can't find it.
I probably scrolled right past it.
But they are supporting a new phone now.
I think it's the Shift Phone six or
something like that.
So that's pretty cool.
They say that they are.
Oh, yes, there it is.
The Shift Phone eight.
They say that they are working on Android
seventeen.
So what they did is they switched to
HSM based open source signing solution,
which HSM, from what I understand,
I'm a little bit outside my expertise
here.
But from what I understand,
it's kind of like a
it's almost like a physical server that
handles the signing keys.
That's probably like a really grossly
oversimplified version,
but it's supposed to be like really super
secure.
So they've got this new,
like really secure way of handling the
signing process.
They did release the security audit and
the provisioning ceremony and everything.
Uh, they also did do some things and,
um, here's what I'll be interested to see.
So they say in response to Google's less
frequent AOSP source code releases,
which for anyone who missed that Google
used to release the Android open source
project, um,
I think once a month and now then
they switched to like once a quarter.
And I think now it's even gone down
to like twice a year.
Um, I could be wrong about that,
but it's definitely a lot less often.
So now all these, these, uh,
I don't want to call them derivatives.
These forks of Android that we like to
use in the privacy community now have to
do so much extra work to try and
get this.
And that's like the least of things that
Google did,
but that's a whole different story.
Anyway, sorry.
In response to Google's less frequent AOSP
source code releases,
our team developed scripts to reduce
overhead in applying monthly patches and
updates.
So that's pretty cool.
They say they have set up a cleaner
server structure to streamline each
release.
And currently,
our lead engineer is continuing
maintenance on the base device trees for
both Lineage and Calix to bridge the gap
created by the absence of Google Pixel
device trees, which is, again,
another thing that Google stopped
publishing that makes the job so much
harder.
So they said we'll share a timeline soon
for releasing Kallax VIII with Android
XVII.
And last but not least,
they did have some personnel changes
again.
Like I mentioned,
they said that their core developer
working on the Aurora store is leaving for
another opportunity.
I think they said...
I don't know if they've replaced him yet,
but they said they did welcome somebody to
replace someone else who does
infrastructure.
So yeah, it's definitely...
So I guess let me start by saying
that Calix is not officially recommended
by privacy guides just because we feel
like it doesn't really bring anything
meaningful to the table in terms of
privacy and security.
Like, I think it's not bad.
And I think the decisions,
at least in my opinion,
I know there's some people who argue that
it's a downgrade in security.
There's, I think...
Personal opinion,
I think the decisions they make make
sense.
Like for example, they say that,
I think it's the clock server still pings
Google because they're basically like,
well, it makes you blend in better.
But at the same time,
I think that's a matter of what do
you want out of a device?
Like that's kind of a personal opinion
thing.
Like,
do you wanna blend in with everybody or
do you want Google to not get your
IP address in the first place?
I don't think there's really a wrong
answer there necessarily,
but I guess my point is like,
I think their decisions make sense even if
they're not the right decisions.
but um i will be interested personally to
see i guess i i think one of
the big reasons again there's several
reasons but one of the big reasons that
we don't recommend calyx is they've
historically been very slow to provide
updates and uh they did kind of fix
that shortly before this reboot like a
year or two it was a couple years
um before this reboot they released the uh
what is it called,
the Security Express channel,
which is basically you can go into your
settings and you know how you can sign
up for like the beta releases,
the stable releases.
Well,
they added a third option called Security
Express,
which is only the security releases.
So you still have to wait for the
features to hit stable,
but you will get those security patches
usually within a couple days of when they
publicly released by Google.
So that was really cool to see.
But then there's this whole thing that,
like I said,
was supposed to take four to six months,
took almost a year,
not a lot of communication.
So personally,
I will be really interested to see with
all these infrastructure improvements and
the scripting that they've done.
And I'm really interested to see.
if this is going to make a difference
with their release schedule.
Because I think that will go a long
way to addressing at least some of the
biggest concerns with Calix.
Now, again,
they don't do the hardened memory
allocator.
I think we have a page somewhere on
the website that I'll go find while Jordan
gives their thoughts.
But they don't harden the memory.
They don't really introduce any additional
sandboxing.
They replace Google services with Micro G.
And unfortunately they do give micro G
elevated permissions in order to run
reliably for like notifications and stuff.
So that's kind of one of the examples
I talked about where some people will
argue that it's a step backwards because
now you're giving this third party
program, some extra permissions, whereas,
you know, graphene will like isolate the,
um,
the Google Play into its own sandbox,
which is really genius.
So it's definitely,
I think Eteru here said that even with
the recent update,
it's still a trade-off between security
and convenience.
Using MicroGene signature spoofing means
sacrificing core system security for
usability.
Exactly.
So yeah,
it's definitely not our top
recommendation,
but it's still a popular choice in the
community.
And the fact that it is back now
is definitely really big news.
so i think i have rambled on that
plenty um jordan did you have any thoughts
about this story
No,
I think you did a good job covering
like a lot of the main things.
Sorry, everyone,
I'm a little bit sick this week.
So if I sound a bit funny,
that's the reason why.
But so basically this is kind of the
reason why I'm covering this is because
obviously this is news in the privacy
community because I think this is
I think while CalixOS doesn't have,
you know,
it doesn't compare to GrapheneOS in terms
of security, I think, you know,
it's possible that, you know,
I think there's privacy benefits over
stock Android and, you know,
other operating systems.
But I think, you know, like Nate said,
like we kind of do push people more
towards GrapheneOS because that is just
like the pinnacle at this point of privacy
and security and,
you
I think it's also the gap has widened
even more because Grapheneus has the
sandbox Google Play services,
which offers a good level of privacy from
Google by not allowing it to be a
privileged app.
That is, you know,
a benefit of Graphene OS.
But then there's this comment here from
Dag Overhaul.
Does Kallax OS support a wider set of
devices than Graphene?
Exactly.
So that is, like,
the benefit of Kallax OS is, you know,
if you do have, like, a Motorola or,
like, Nate was saying, like,
a Shift Phone Eight or any of these
other, like, custom devices.
I know they support Fairphone as well.
So, you know,
if you do have one of these other
devices, then...
boom, that's your solution.
But I think we should all be very
cautiously cautious about this because as
we saw,
they haven't released a single release
because they had a whole restructuring and
everything, which, you know, it happens.
I think it's hard to
hard to keep managing a project for an
extended period of time there were you
know they had a very cemented workflow
that they had for probably you know four
or five years so i think it's reasonable
to uh to have to take a pause
on updates for a little bit um to
restructure that so i don't think that is
super concerning but i do think you know
it is extremely unfortunate especially
when it's like the threat landscape that
we're in is where you know people's
devices
are constantly under attack and if they're
not receiving updates then that is kind of
a that's kind of a massive problem
especially because you know there's
there's so many attacks that can that can
that can be
that can be exposed to if you don't
make sure your device is updated.
So I hope that, you know,
this is the first official update.
I hope they continue making sure they're
keeping on top of updates as well.
Graphene OS is already updated to Android,
whereas Kallax OS is still on Android.
So they've always been behind.
It's just always been,
it's the nature of it.
Graphene OS is also behind as well when
it comes to, you know,
big releases like Android, they took,
I think it was a couple of weeks,
maybe two weeks,
I think to have a stable,
a stable build out.
So, you know,
there's always going to be a delay.
Um, but I think, you know,
when we compare the projects graph,
you know, this is just such a,
it's a much bigger project.
They've got much, um,
much more developers working on it.
It's, it's just a bigger project.
So that kind of means that these,
these sort of maintenance tasks get
completed more quickly, which,
It's fine.
There was another comment from Dag here.
Can you run Google Play services slash
store on Kallax,
install and run banking apps, et cetera?
So I guess I think Nate, I believe,
has used Kallax OS quite a bit.
So maybe I can throw that back to
you and you can answer that question.
Yeah, sure thing.
So technically, no,
Google Play services does not work.
The Play Store, as far as I know,
does not work.
Usually they recommend using Aurora
instead.
Instead of Google Play services,
you'll use Micro G,
which in my experience works fine.
I'd say like ninety percent of the time
where you run into issues is so there
was there's one app that I use.
It's like a habit tracker.
And on Google,
because I was kind of bouncing back and
forth between the two for a minute to
kind of compare them.
On Graphene,
I would get notifications that it's like,
hey,
our premium version is fifty percent off
for the next week or whatever.
And then you click it and it takes
you to the Play Store and you can
sign up.
And it's one of those apps that I...
Actually,
I think maybe you could have gone straight
to the website.
I can't remember.
Um, but on Calix, for example, that,
that I think I would still get the
notification, but it wouldn't work.
Like I would click on it and it
would just be like, oh,
there's an error because, uh,
Aurora does not support and micro G do
not support, um, the,
the subscriptions like that.
Um,
Yeah,
I'm pretty sure I was able to pay
for it directly on the website and get
around that.
But sometimes you can't do that.
Some apps don't let you pay directly on
the website, which is unfortunate.
So there's little things like that that
don't work very well.
The banking apps, in my experience,
work pretty well because it still locks
the bootloader.
So it still gets that security feature
that it's looking for.
But also,
I know that Google is changing how Android
verifies stuff.
So we may have more issues in general
going forward.
that I would expect to see Graphene handle
a little better just because of the
compatibility layer thing.
So when I was using it,
banking apps worked good enough,
but there's always a possibility that they
don't work as well now because I
absolutely stopped using it when they
stopped getting updates.
Like right after they paused for this
whole thing, there was like a big...
there's like a big update for Android in
general that fixed a lot of like really
serious security vulnerabilities.
And people were like, yeah,
you should definitely get off Calix at
least until they fix this.
So, yeah.
I think we'll, you know,
we'll watch cautiously on this because...
It's an evolving situation,
but I don't think unless anything huge and
major changes,
there'll be any recommendation from
privacy guides.
Just because, like Nate said,
there's not really any significant benefit
to this over GrapheneOS,
which seems to have more focus on privacy
and security than CalixOS does.
I think it'll be interesting to see how
well the maintenance goes over time,
but we'll definitely make sure we're
testing this and seeing how it evolves
over time.
Yeah,
I think you really hit the nail on
the head.
It's really good if you don't have a
Pixel for whatever reason.
Personally,
I would recommend Calix over stock Android
because at least it will cut down on
some of the Google telemetry.
But yeah,
if you have the option for Graphene,
it's definitely the way to go.
And real quick,
I don't want to belabor it,
but I did find that article I mentioned.
I just want to throw it up on
screen real quick.
This is an article from twenty twenty two.
That's why I couldn't find it.
I thought it was an actual page,
but it's an article.
So it is a little old.
So some of the information was outdated,
but it kind of shows you graphene versus
calyx update frequency sandbox Google Play
versus micro G ESM activation extensions
profiles,
which that part might be outdated by now.
So yeah.
Definitely go check that out.
It'll at least give you a rough idea
of why we recommend graphene instead of
calyx.
I think you are muted.
There's been some updates to that article,
so...
It's not a hundred percent correct,
but it does have some general things that
should be still correct.
I believe the things that are not correct
is the privileged micro G and also the
privileged app extensions might've been
removed possibly, but.
I think micro G is still privileged.
I know they've said that they do want
to figure out a way around that because
that is a common criticism they get.
But last I checked,
they hadn't fixed that yet,
but I think the app extensions one,
you might be right.
Okay, yeah, I'm not sure,
but definitely that'll be something you
have to look into yourself.
But yeah,
so that's kind of everything we had to
cover on this story.
I guess we can move into the next
one here.
And this one is a story here from
Foraform Media.
Apple's hide my email vulnerability
reveals people's real email addresses.
hide my email users deserve to know that
it may be possible for attackers to
discover their hidden email addresses the
person who reported the issue said um so
basically if you okay this seems to be
paywalled so um that is a bit of
a problem uh
Here,
I'll hop in because I have a subscription.
I'll say that, to be honest,
that's kind of all there is to the
story because they said that...
So one thing that I will say was
interesting is apparently this came from
Tyler Murphy,
who is the co-founder of Easy Opt-Outs,
who we do recommend on Privacy Guides.
I've been using them for years,
very happy with them.
They were,
I don't know if they still are,
but they were sponsoring surveillance
support back when I was on surveillance
support.
Um, but apparently, yeah,
he discovered this vulnerability and they
have not disclosed it because they said
that Apple hasn't fixed it yet.
And I think that's kind of part of
what this article is,
is I think four Oh four is kind
of teaming up with Tyler to like pressure
Apple into fixing this,
because I think they said they reached out
like all the way back in may and
Apple was like, Oh, okay, thanks.
We'll fix this.
And then like stopped responding.
So, um,
we don't know exactly what this is or
how it works,
but I think this was an interesting story
to cover because, um,
Um, you know,
email aliasing is definitely getting a lot
more popular.
We're seeing more, um, like IVPN,
I think has an email aliasing service now
and AdGuard has an aliasing service.
And of course there's like Firefox relay,
simple login, Addy.io.
There's just,
it's becoming more and more common.
And I think Apple's introduction of this
really kind of shot it into a mainstream
attention.
Um, yeah.
So yeah,
it kind of defeats the whole purpose if
people can easily figure out a way around
this.
And I don't know,
I guess I've seen some discussions.
Do you happen to know, Jordan?
I mean, again,
we don't know the exact vulnerability,
but I know some of the people in
the comments of this article were
wondering, like,
do we think this might apply to some
of the services we do recommend,
like SimpleLogin or anything like that?
I have a feeling that the way that
this works
vulnerability works is somehow tied back
to the Apple account itself,
like the Apple ID,
because the way that the hide my email
aliases are created is tied to your iCloud
account.
I have a feeling it's something to do
with that, but I could be wrong,
obviously,
because they're not revealing
what it actually,
what actually is the problem here.
They're just saying that it's,
that it might be possible.
So yeah, it's not, we don't have,
I mean,
I can't see what's in this article,
but like,
it sounds like there isn't a whole lot
of information in addition to that.
Well, Joseph here in the comments,
I'm scrolling through the comments of the
article and Joseph Cox,
the author said that, uh,
it reveals the email link to the Apple
ID.
So I think you might be onto something
with that.
yeah um i think you know we've never
we've never recommended apple's hide my
email so you know it's not like this
is a direct threat to people in our
community but i can't i can say that
i've used hide my email stuff just because
it was convenient like signing up to a
new account with like my apple account and
stuff like that um
I've used it before.
So, you know,
maybe someone can find my real email
address or something, but I mean,
I don't think it's a huge issue,
but I can see how this would be
kind of a problem,
especially if you're like a whistleblower
or like someone doing something a little
bit, you know,
you don't want something tied back to your
identity.
So it's,
Yeah, it's not really great,
especially when that's kind of implied
with the service.
It's called hide my email.
It's literally in the name.
So if it can't do what's in the
name, then that's a bit of a problem.
So I'm not really sure what the outcome
of this is going to be,
but we can kind of circle back to
our website here.
And we do recommend a couple of different
email aliasing services,
so
You can kind of take your pick,
I guess.
So I guess first off,
we recommend Addy.io and SimpleLogin.
There might be more added at some point,
but this is kind of what things are
looking like at the moment.
Addy.io is a free service,
same as SimpleLogin,
but they limit some of the requirements.
I think it's...
you get like ten domain aliases on Addy
and you get like ten on SimpleLogin as
well.
So, you know,
you've got some options definitely.
And I think, you know,
maybe it's time to switch away from
Apple's closed ecosystem.
I think usually they're pretty good on
privacy related stuff like this.
So I think they'll fix it.
But it could be a better time to
start looking at
better alternatives.
And I think one benefit of Addy.io and
simple login, at least the paid plans,
is you can send emails to any address
from any of your aliases,
which is something you can't do with
Apple's hide my email,
which I found really annoying.
So don't make that mistake.
But yeah,
so that's kind of what we recommend.
I would say
There's no need to panic at this point
because as far as we know,
it's not publicly disclosed or anything
like that.
Apple is usually pretty quick,
but we'll probably have an update for that
next week if Apple does actually decide to
change this.
Yeah, for sure.
We'll keep people updated.
But yeah,
I think we just wanted to include this
story because I know hide my is kind
of popular.
There are some people who still use Apple
for any number of reasons.
And they're like, well,
I'm already using Apple.
I'll go ahead and use the hide my
thing because it's so cheap.
So it's important to know that.
Um,
I will call out a couple of quick
comments.
Like Cisco here said,
I've been buying a custom domain and
having a catch all email address.
Honestly, I, I do the same thing.
I really like it.
I have a custom domain that I use
through simple login and, um, yeah,
I can just make things up on the
spot or, uh, whatever.
And personally,
I like that because if simple login ever
in shitifies,
I can go to Addy or I can
go to, you know, uh,
whatever the one from IVPN is called that
I keep forgetting.
Like I can, I can switch very,
very easily, which I think is cool.
Um,
And then Dag Overhaul here said,
use aliases for spam control,
not anonymity.
I don't... He says,
make them forward to an anonymous email
address.
I mean, yeah.
I mean,
I guess if you want to go hardcore,
I want to nitpick a little bit and
point out that anonymity is not privacy.
And the idea of privacy is to be
able to control who has access to your
data.
And that's the whole idea is like,
you're not supposed to be able to see...
the main email address.
Like, that is the one job.
That is the whole job of alias emails.
So, I mean, that's certainly a way,
a very advanced technique if you're super
concerned about it.
But, yeah.
MailX, thank you.
You just posted that in the chat.
And yeah, DuckDuckGo is also an option.
I found it difficult to use personally,
but
Yeah,
you kind of need a third party extension
to make DuckDuckGoesOne work well,
which probably is not a good sign.
But someone asked,
what's up with the floating head?
Privacy, I guess.
I don't know what to say.
This is the privacy channel.
You should know why.
But yeah, that's the reason.
Just don't want to show my face if
I can avoid it.
And yeah,
I don't really have much more to add
here,
unless you want to talk a little bit
more,
but could jump into this next story here.
Sure thing.
Do you want me to take this next
one?
Or would you prefer to take it?
How about I give the rundown quickly and
you can add some of your U.S.
perspective because I think you're going
to have a lot more to talk about
on this one.
Supreme Court ruling guts government's use
of geofence warrants.
SCOTUS falls short of deeming geofence
warrants unconstitutional, though.
The Fourth Amendment protects the user's
location history.
The Supreme Court ruled on Monday.
The same logic already applied to a cell
phone's tracking,
and the High Court found no good reason
exists to reach a different result for
location history collected by third
parties like Google.
Split six three,
the majority agreed that the government
needs a warrant and must show reasonable
cause to turn a phone's location tracking
services into a government surveillance
tool.
So the decision came in a case where
cops used a so-called geofence warrant to
track down an armed bank robber from a
list of all phones logged in the area.
Applying a three-part process,
cops worked with Google to narrow down the
list of suspects and eventually arrested
Akello Chatri,
who had opted in to share his location
with Google every few minutes.
Chatri was sentenced to twelve years in
prison but challenged the geofence warrant
as an unconstitutional search.
So the US tried and failed to argue
that no search was conducted under the
Fourth Amendment,
partly because they only searched a little
bit of Chowdhury's location data,
which the government considered too small
to warrant privacy protections.
They also claimed that Chowdhury was aware
that voluntarily sharing his location with
Google could mean that law enforcement
might get access
to the data and along similar lines the
government argued that Chatterjee's data
simply showed his movements in public
where he supposedly had no reasonable
expectation of privacy okay so I guess
that's like the main rundown of this um
Unless you have, like,
it definitely goes on a lot more.
So I don't know if you have more
to add on this.
I mean, of course you do.
So what are your thoughts on this?
Yeah, I do want to...
Real quick,
I do want to run through what the
judge said, because I think it was really,
it's one of those things where it's like,
oh, you're so close to getting the point.
She said that Google repeatedly prompts
users to turn on the service,
often warning that their devices will not
work correctly otherwise,
while not disclosing in that prompt how
frequently location information would be
recorded, how precise it would be,
or how it might be given to the
government.
She said that much like carrying a cell
phone is part of modern life,
sewing is allowing a third party to track
your movements,
and that doesn't diminish a person's right
to privacy.
And then Justice Sonia Sotomayor noted
that even short-term monitoring of a
person can reveal a wealth of details
about his family, political, professional,
religious, and sexual associations,
particularly if he's been visiting
sensitive locations like a clinic,
attorney's office, or strip club.
Yeah, so I mean, it's really like,
it's one of those, it's like, oh,
you get the point.
Come on, like, just take it further.
But yeah, it's, I mean,
that's kind of all it is right there,
I guess,
is the police tried to be like, oh,
but it's, you know,
he's moving around in public,
like that whole, you know,
no expectation of privacy thing.
And I think they even tried to make
the argument.
So like the police tried to make the
argument that it's like,
the phone itself has no expectation of
privacy.
or something like, no,
like the phone itself does,
but the apps don't or something like that.
And the Supreme court was basically like,
yeah, but let's be real.
We live in an age of smartphones.
Like who's not going to have apps on
their phone.
That's the stupidest argument I've ever
heard.
So, um, I'm not,
The Supreme Court surprises me in a good
way sometimes.
I'll just say that.
Yeah, I think my only other thought is,
you know, at the very beginning,
that little subheader, it said, like,
the Supreme Court falls short of deeming
geofence warrants unconstitutional.
And I think that is an important thing
to know, is, like,
this doesn't ban geofence warrants.
But I think this might almost be...
better I'm not a lawyer and I would
happily welcome any input from actual
lawyers on whether I'm right or wrong but
I feel like this is almost better because
like saying that geofence warrants are
unconstitutional I feel like would be
relatively limited like the way US law
works is you can always cite that as
precedent in other case and expand it and
stuff like that but I feel like like
that was still much more limited as
opposed to this where it applied to like
third party collection of location history
I feel like just is so much more
broadly applicable so I'm kind of hoping
This is almost like in the long run
an even bigger win because it can apply
to so many other things.
Again, not a lawyer.
Happy to hear from any lawyers out there
if I'm right or wrong.
But I think that was my only other
thought that I wanted to add.
I guess like this kind of makes me
think, does this apply to, you know,
other data collection?
Could this apply to Stingrays being used
to collect IMEI numbers?
Or could this affect Facebook or any other
company?
Or is this specifically about Google's
location tracking?
Or is this just like...
That's a great question.
I mean,
the article said third parties like
Google.
Um,
they said the fourth amendment protects
the user's location history and the same
logic applies to a cell phone's tracking
and no good reason exists to reach a
different result for location history.
Um, so my thought would be,
I don't know about the stingrays cause I
feel like that's probably like a law
enforcement exception kind of thing,
which I mean, granted,
I guess they didn't do here with the
geofence warrants, but my,
my guess would be if anything,
this will only apply to location data
until,
cause that's kind of the way that us
law works is like everything is built
based
by cases.
And, um, I mean,
I don't want to go on too long,
but basically that's why it's so
important.
It's so strategic to like,
see if we can get this in front
of the Supreme court.
I think, uh,
Cindy Cohen talks about this in her book,
actually privacy is defender.
Like you want to get a judge who's
sympathetic to your case because once they
hand out a ruling,
there's certain criteria that makes
something legal precedent that I learned
from her book.
And anyways, long story short, it's like,
basically it's not always enough to just
be like, well, here's what the law says.
The court has to interpret it and deliver
a
affirms or clarifies that law.
So I feel like it's one of those
things that like, okay,
location history is more or less settled
now,
but all the other things like messages,
metadata, timestamps,
like those things are probably not
protected until somebody comes along and
has a case, a precedent setting case.
That would be my guess.
Okay.
So like, you know,
all the other data that's collected by the
apps on your phone can be hoovered up
by this is what you're saying.
Exactly.
That would be my guess.
Again, not a lawyer,
but as I understand it,
that's probably how it's going to work,
at least until further notice.
Well, I think we take these wins.
This is a win, I think.
Definitely.
That's why I wanted to include this story.
We get so few wins.
It's like, you know what?
I'll take it.
This is a good one.
True.
Yeah, that's good.
So real quick,
want to point out a dag here said
robbing a bank while carrying a phone with
location sharing enabled smart guy.
I know, right?
Like everybody knows that phones, even,
even quote unquote,
normies know that your phone is constantly
spying on you.
Like what idiot brings their phone to rob
a bank?
That's insane.
Yeah.
They're basically like tracking devices at
this point.
So it's a bit, uh, I mean,
maybe it's a spur of the moment thing,
you know?
Maybe.
I've heard weirder things.
But I think that will take us into
site updates,
unless you have anything to add to this
story.
No, let's dive in.
Alrighty, yeah.
So in a little bit,
we're going to talk about surprise flock
devices,
which that's going to be a fun story.
But first, I mean,
so I'm going to level with you guys.
We actually forgot to talk about what our
site updates are this week.
But I know we've got a...
Let's see,
I know we put out a video recently
and I filmed, oh my gosh,
the weeks are starting to jumble together.
Oh, yes.
No,
I filmed a video last week about some
NSA history and the crypto wars.
And I think that is over with Jordan
now for the good editing.
I think I've told you guys this before.
I do like the rough edit where I
cut out all the long pauses and the
stutters.
But Jordan is the rock star who adds
all the special effects and the graphics.
And so I'm really excited to see how
that's going to turn out.
That's going to be super awesome.
Um, but honestly, it's been kind of a,
one of those slower weeks where it's all
stuff happening behind the scenes.
Um,
so I don't know if I have too
much more to add other than that.
Um, have you guys done anything, Jordan?
I think you and Jonah have been working
on a project,
but I don't know if it's published yet.
Yeah,
so Jonah did sit down with Rudy Wang,
who's the product manager at Cape,
Cape Mobile, which is like, I guess,
for people that are not super aware
because, you know,
we kind of wanted to make people aware
of it or at least answer a lot
of people's questions because I think
people are
rightfully so quite suspicious about this
sort of service you know you see like
this this so-called private and secure
mobile carrier it's like it looks kind of
sus so you know obviously we had some
questions and
Jonah did a really good job of asking
technical and also just general questions
about the service.
So hoping to get that interview out soon.
It's all edited.
It just needs some extra bits to make
it flow together a bit,
like an intro and outro and stuff like
that.
But otherwise, it's looking good.
So hopefully we can get that out to
people soon because I think that we've had
so many questions about this service,
especially on the forum.
Like there's been a lot of questions and
people being rightfully suspicious
because, you know,
I think when we see these new services,
it's hard to...
know whether they're legit or not.
And I can say after watching the interview
and seeing their responses to the
questions,
they truly do know what they're doing,
which is interesting.
It's not something that Privacy Guides
recommends at this point, obviously,
but maybe it could be at some point.
It's definitely an interesting service,
but
It's one of these really annoying things
that I think people outside the U.S.
always kind of get annoyed about is all
these cool privacy services.
They're all U.S.
only, like privacy.com, like this service,
all these sort of more niche things.
Voice over IP, yeah,
there's just like more of an appetite for
that thing in the US, which is good,
because, you know,
when things get popular in the US,
it basically means like it'll bleed over
everywhere else eventually.
So, yeah, there's...
That's kind of what I've been working on
this week, kind of been finishing up that.
I've not been super busy this week,
so not a huge amount to report on.
But it doesn't seem to be any site
updates this week either, really.
We definitely need to push through some
pull requests on the website.
So we'll be working on that soon.
But yeah,
I don't really have anything else to add.
Yeah.
I think last thing I can add is
just as always,
privacyguides.org slash news.
Fria was on fire this week.
We have articles about how there's a town
in Massachusetts that got their flock
contract canceled after public backlash.
So remember that stuff does work.
Um,
Google is trying to make recapture even
worse and something about like,
I don't think it's biometric hand
scanning,
but they want you to like move your
hands certain ways.
It's so dumb.
Um,
brave is adding containers to the browser
if you're a brave user.
So yeah, lots of, uh,
Really cool stuff.
Freya's been crushing it with the
articles.
But that is all I got.
I think on the flock cameras,
we talked about it last week,
but check out dflock.org.
That's how you can find local groups and
stuff.
So you can get flock kicked out of
your city.
So definitely check that out.
But yeah.
Cool.
Um, yeah,
so all this is made possible by our
supporters.
You can sign up for a membership or
donate at privacyguides.org slash donate,
or we still have the merch shop over
at shop.privacyguides.org,
which is where I got this awesome water
bottle, which, uh,
is really coming in clutch this, uh, I'm,
I'm on the East coast and we had
a nice little heat wave and, uh,
Yeah,
Privacy Guys is a nonprofit which
researches and shares privacy-related
information and facilitates a community on
our forum and matrix where people can ask
questions and get advice about staying
private online and preserving their
digital rights.
And now, some exciting news from WhatsApp.
Yeah,
so WhatsApp usernames are already raising
impersonation red flags.
So I guess if anyone here has been
using Signal,
which I kind of assume everyone here is
using it or has used it at some
point, Signal's kind of had usernames for,
I think, probably a good while now,
like maybe two years,
a year and a half.
I was going to say a couple of
years, yeah.
At this point,
so that was kind of a huge...
amazing feature because you could give
people a username instead of giving them
your phone number, which, you know,
it's nice to not have to give people
your phone number every time.
So that's...
That's kind of awesome.
But WhatsApp is rolling it out now.
And WhatsApp usernames are being used to
impersonate people.
So WhatsApp this week started rolling out
username reservations ahead of the broader
launch planned later this year.
The feature,
which lets people find and message each
other by handle instead of phone number,
is already raising impersonation concerns.
drawing scrutiny from security experts and
regulators in India,
the app's largest market,
with over five hundred million users.
The rollout marks a shift in how people
identify one another in WhatsApp.
Instead of relying on phone numbers as the
primary identifier,
users will increasingly interact through
platform managed usernames
a change that Meta says improves privacy,
but that critics argue could create new
opportunities for impersonation.
So I think one interesting thing about
this and how this relates to Signal is
with Signal,
it kind of removes the impersonation
concern because the usernames are actually
randomly generated.
So like
If you put your name as,
let's say I put my name as Jordan
in Signal,
it will automatically add two or three
numbers to the end.
So I'm not reserving a username
specifically.
There's extra numbers at the end to make
it more randomized.
And it allows more people to have a
nicer and easier to enter username, right?
But the way that I see this working
in WhatsApp is that it doesn't have that
extra number at the end.
It's just a handle,
which I think is what this is kind
of raising concerns about.
Because, you know, when you have
usernames like that especially when you
allow reservation of a username basically
a bunch of people can just it's basically
always been an issue right with any
platform if someone reserves a username
that you that you own or for your
brand or for your company then you're kind
of screwed right like you can't you can't
take that over unless they're using it to
impersonate you so
That's kind of what we're seeing with
this.
And this has already been, you know,
a concern where this article says the
concerns have already reached regulators
in India where cyber fraud schemes
frequently exploit messaging platforms to
impersonate police,
banks and government officials.
In a notice sent to WhatsApp on Wednesday,
reviewed by TechCrunch,
the Ministry of Electronics and
Information Technology said the feature
could materially increase the incidence of
online fraud, phishing,
digital arrest scams and impersonation
attacks by enabling bad actors to contact
users without exposing their phone
numbers.
So, yeah, this is...
I feel like this Ministry of Technology is
like taking this in the wrong direction.
They're almost saying like,
this is offering people too much privacy.
We should have everyone be identified by
their phone number.
I don't think that's the solution here.
I think the solution is to allow this,
but to add an extra number or to
not allow people to basically squat a
username.
I think allowing it to be,
basically ephemeral or something that you
use specifically to connect with someone
and that expires or something like that,
that could be a little bit better in
my, in my opinion.
Um, because yeah, like,
like this article says,
it can be kind of used to impersonate
companies and governments.
Um, but do you have anything,
you had any thoughts on this one, Nate,
or?
Yeah, it's interesting, because...
Let's see,
I'm actually double-checking here,
because, yeah, so Signal...
There's not a lot of details in...
I actually have two articles here,
and one was the initial WhatsApp is
rolling out usernames announcement.
But even that one really doesn't explain a
whole lot about how...
this actually works um the only thing they
said that i thought was interesting they
said users can optional users will be able
to set an optional key that others will
need to know before messaging them via the
new username so that's like one way to
cut down on spam and stuff but i
remember when signal usernames came out i
thought they were going to be abused and
then people pointed out it's like but
people can't see your username like people
can see your username if you share it
with somebody um but like let's say
let's say I give you my username and
you message me, I can't see your username.
So it's not like you can do an
impersonation, I mean,
any more than you could with like any
other messenger, right?
But it's not like, you know, where like,
like Twitter or Mastodon,
where you could make it, you know,
Nate B at whatever.
And it's like, oh,
now I'm impersonating Nate,
like you could change your display name,
but that's about it.
So that's kind of what I'm wondering here
is like,
is
Is this, are these usernames visible?
Like, is that what the concern is?
Is that people are going to see that
they're getting messages from some of the
examples they use here where like,
what is it?
India Modi is still not open or is
still open for registration,
which for those who don't know,
Narendra Modi is the prime minister of
India.
So it's like,
are people going to think that they're
getting messages from India?
Narendra Modi, the Binance founder,
Chepang Zhao,
said that he couldn't reserve CZ
underscore Binance,
which is the handle he already uses on
Twitter.
So it's like somebody's probably already
using that, and it's just really weird.
And WhatsApp says that there's certain
handles that they're reserving to verify
that they're legitimate users,
but they didn't explain...
what those handles are or like how they're
deciding.
Cause you know, they're,
they're meta and they're never super open.
So yeah,
there's just like a ton of questions here
about like, how does this work?
How are you going to protect people from,
from impersonations like this?
I'm seeing here,
I'm doing some additional research and it
could be wrong.
Usernames must be three to thirty five
characters long.
Let's see.
You can,
You can change or delete your username at
any time,
though deletion reveals the phone number
again for fourteen days.
Oh, and when you delete a username,
it can be reclaimed,
which I think is true of Signal as
well, but it's also just like, again,
if somebody's squatting on a username,
it's, I don't know,
it sounds like this was not rolled out
as thoughtfully as Signal,
which is probably not surprising coming
from Facebook.
But the only other thing I will say,
Cisco here said it sounds like another way
for them to sell verification
subscriptions like Instagram.
That's entirely possible because this
article from TechCrunch did note that they
did say, oh, where'd it go?
I know I had to scroll pretty far
down for it.
It will let users claim their existing
Instagram or Facebook usernames by linking
their accounts,
saying that the option is intended to help
creators, businesses,
and organizations maintain a consistent
identity across Meta's platforms while
reducing impersonation.
So,
Yeah.
I don't know.
They'll probably charge for that down the
road because why not, right?
But yeah,
I think those are kind of all my
thoughts.
It's just I don't understand how this is
supposed to work and why didn't they just
copy Signal?
It was already there.
I mean, okay,
so I'm just reading an article about how
this works and you did mention like the
WhatsApp username key and it looks like
it's a four-digit code that's linked to
your username.
So it sounds pretty similar to how Signal
does it with like a number at the
end of your username.
So...
That does make sense,
but that doesn't seem to really...
I don't think people are going to use
that.
People just use the default thing.
They're not going to use this extra
privacy feature, I don't think.
Yeah, this is kind of a problem,
I think.
But which, you know, meta never really...
With meta,
they always don't take the right path.
They always go the wrong direction with
stuff.
Like we saw,
they removed end-to-end encryption from
Instagram DMs.
All sorts of bad decisions on their part.
So this is going to affect a lot
of people,
like a ridiculous amount of people.
So I hope that they do fix this
or make it a little bit better because
so many people use this app.
So to clarify, yes,
if my research is correct,
if you do not have the person's phone
number saved in your contacts,
they will see your username instead of
phone number.
But if they do have the phone number
saved,
they will see your phone number instead of
username.
So that's what the issue is here,
is if I message you and my username
is Indy Amodi,
I can pretend to be Narendra Modi.
That was...
Sorry,
every once in a while my brain needs
to reboot because I'm like,
why do people make so much money to
be this irresponsibly stupid?
And it makes me so mad.
Yeah, text Eddie here.
People talking about the Instagram DM
thing you said.
People weren't using the encryption
feature that we had disabled by default
and hidden deep in the settings,
so we removed it.
Yes, yes, exactly.
God, that was so annoying.
I feel like this is not like a
– I feel like meta sort of does
this thing where they're like,
here's this feature, and then, like,
here's the added protection that, like,
literally no one is going to use because
it's, like, hidden deep in, like,
the settings.
It's like, okay.
Like,
the default setting on Facebook is to,
like,
share your phone number and contact list
by default.
It's like, well, yeah,
but you shouldn't do that.
But it's like by default it does that.
So –
yeah anyway we can we can uh we
can be mad at meta all day sorry
oh yes i can i certainly can but
uh let's be mad at flock for a
minute instead so we'll uh we'll move on
to the story here about um a woman
was surprised when a flock surveillance
tower appears in her yard without warning
um so there's
I'm going to say there's a silver lining
here, but it just raises more questions.
So this woman, Kat Vaughn of Roanoke,
went to the park
Like, that's how quick this happened.
I mean,
I don't know how long she was at
the park.
It says she returned home from a brief
trip to a nearby park.
So maybe she was there for thirty minutes.
Maybe she was there all day.
I don't know.
But either way,
it's not like she was gone for a
week or something.
And when she came back,
she discovered that there was a freshly
installed device sitting in the parkway
strip,
which is a section of public land between
her lawn and the street.
So to be fair,
this is the first caveat.
It wasn't technically her lawn,
but it was right in front of her
house,
which is one of those things where it's
like...
if you put a camera right in front
of my house, like what gives dude?
Um, so it actually wasn't a camera.
It was a flock Raven audio detection unit,
which is flocks knockoff of shot spotter,
which is, um,
basically a microphone that they stick on
a pole that is supposed to tell if
there's a gunshot nearby, but it is, uh,
what's, what's the word I'm looking for?
Um,
cartoonish, uh,
shout out stuff they don't want you to
know.
Uh, it is cartoonishly inaccurate and bad.
It constantly, uh, gives false positives.
It constantly remembers or not remembers,
um,
it constantly flags things like the manual
oversight.
People are just like, ah, that's like,
whatever, just dismiss it.
That's not a gunshot.
It's just, it's so bad.
It's so bad.
Um, but you know, Hey,
somebody is making money.
So why not the psychopath running flock?
So anyways, they installed this thing.
Um, here's,
here's where I say there's a bit of
a silver lining,
but it just raises more questions.
Um, so, uh, Vaughn called the police and,
uh,
the cops came out to take a look
at it.
And even they were just like,
Like she said, OK,
so when the officer got out here,
he wasn't sure what it was either.
So we went and got a tall ladder
to be able to get up to take
a picture of it closer.
And he said, yeah, I think you're right.
It's a gun surveillance device.
And they weren't supposed to be installed
until July.
By the way,
it is July third for anyone listening
after July.
after time um so this was god what
was this article written june twenty
eighth so they're ahead of schedule and
then on top of it so uh they
went and checked the city records they
said that the city council had approved
the deployment of seventy five of these
sensors at various locations throughout
the city and the patch of land in
front of von's house wasn't on the list
so that's why i'm like this raises further
questions like okay on the one hand
I mean, first of all,
these things shouldn't exist in the first
place.
Like I said, they don't work.
They're garbage.
They're just somebody's get-rich-quick
scheme because somebody has no moral code.
But putting all that aside,
it wasn't supposed to be in front of
her house, which is good because, again,
what the hell is setting up a surveillance
device in front of somebody's house?
But how did it get there?
Who put it there?
Why did they put it in early?
I have so many more questions,
but I don't know.
This was just such a wild story when
I read this one.
I was like,
I really want to share this story,
but I don't know if there's any real
takeaways here.
Just a very insane story.
Yeah, that's incredibly wild.
I guess one question that I do have
is, like, what is this?
So wait,
it says Flock Raven Audio Detection Unit.
So is this,
am I understanding correctly that it's,
like,
listening for the sound of a gunshot and
then it's going to, like,
do something with that?
So the idea is that it's supposed to
detect sounds
And I mean,
I'm sure it goes without saying,
but you're supposed to put it in like
rougher neighborhoods where gun crime
actually happens.
But the idea is that it detects a
gunshot and then alerts the police.
So we don't have to wait for a
nine one one call or, you know,
especially in,
I'm not trying to stereotype here,
but in some of these poorer neighborhoods,
it's like, you mind your own business,
right?
Like you heard a gunshot.
No, you didn't.
Not if nobody got hurt,
you'd mind your own business.
So the idea is even with,
With ones that don't get called in,
it'll alert the police and they can come
by.
But like I said, they're proven.
You can look these up online.
I can't remember who covered it,
but somebody did a really deep dive.
It wasn't four or four because this would
be four or four.
Actually,
four or four may have covered this too.
But it's been proven that they have like
this ridiculous false positive rate that
they detect like...
like car backfires or fireworks,
like things that any human would hear and
be like, that is not a gun.
And it thinks it's a gun.
And then on top of it,
there's always the privacy concerns too of
the slippery slope, right?
Like, okay, sure, today it's a gun.
What happens tomorrow when it's like
speech?
And you're like, well,
we're just listening for violent crime.
You know,
we're listening for the two people on the
corner doing a drug deal or like planning
a crime.
And it's like, okay, today,
what happens when tomorrow they're
planning a protest?
Or, you know, it's just...
it's no yeah these things are there's
literally no redeeming quality about these
things except to make somebody at the top
rich i i'm gonna say that full stop
but yeah i mean i my question with
this though is like what if you just
like want to fire your gun on your
own property like what what what about
that like what are you not i thought
you're allowed to do that oh no
Yeah, or like Dag said,
don't watch any action movies with the
window open.
Yeah, I mean, it depends.
I would imagine that in a city,
it's probably not cool to be firing a
gun in your property.
But I don't know.
I mean, that is certainly a good question.
Like, yeah,
there's all kinds of scenarios I could see
where it's like,
I'm not doing anything wrong.
Why is, I don't know.
Yeah, that's crazy.
Yeah, it's wild.
But yeah, that's a pretty short one.
I don't think I have much more to
add to that one personally.
Yeah, fair enough.
I guess we can dive into some forum
updates here.
So in a minute,
we'll start taking viewer questions.
So if you've been holding on to any
questions about any of the stories we've
been talking about so far,
go ahead and leave them on our forum
thread or in the comment section on the
live stream.
For now,
let's check in with our community forum.
There's always a lot of activity.
And here's a few of this week's most
interesting discussions happening there.
So I'm going to take this second one
here.
This one is about Reddit.
So if anyone here has ever had the
displeasure of visiting the Reddit
website,
then you'll know that it's frequently
become harder and harder to access Reddit.
information on Reddit,
especially if you're using a VPN,
especially if you're using
it logged out,
especially if you're using any sort of
privacy protection.
And one way to get around a lot
of these restrictions was to use the
old.reddit.com website instead.
So basically, instead of reddit.com,
you would use old.reddit.com instead.
And that would basically load the old
less JavaScript heavy version of the
website.
And that bypassed a lot of the issues
that the newer version of the website has.
But this reporting here from Ars Technica
says that Reddit will require you to log
in to use old.reddit.com.
So logged out old Reddit access is a
significant source of abusive scraping.
So Reddit will start
Requiring people to be logged into Reddit
to use old.reddit.com,
the new requirement will take effect over
the next month.
A Reddit employee going by the username
BoatBotany announced on the social media
platform today.
The person claimed that the change is part
of an ongoing effort to tighten how
automated systems access Reddit.
So basically the excuse that they're using
is this is basically becoming a source
for, I think,
let's read in between the lines.
This is an issue with AI scrapers.
It's kind of always been a concern,
but I feel like a lot of like
large language models are basically
training a lot of data off Reddit because
it's so openly accessible.
So this is kind of just a move
by them to
restrict the access.
And I guess by having people log in,
then, you know,
you kind of can track activity.
So you can see that someone's visiting
every single subreddit,
every single post on every subreddit.
You can see that they're scraping and
block their access.
So by logging in,
we get a lot more signal that allows
us to detect whether an account is
breaking the rules,
and then we can block that traffic or
enforce those accounts, both Botany said.
As of writing,
Ars Technica was still able to use
old.reddit.com without logging in.
And the news is likely to upset some
longtime Reddit users who've relied on
old.reddit.com for a familiar look that
they find easier to navigate and digest,
and who also want to view Reddit without
logging in for convenience and or privacy.
So...
Yeah.
Anyway,
this old.reddit.com website is kind of a
source of scraping.
So, you know,
there's also in this article,
they also said that old.reddit.com might
not exist forever.
So it might almost be time to retire.
That's what they said.
So it's,
they said they can't promise it'll be
around forever.
So that'll be interesting to see.
But Nate,
do you have anything you wanted to add
to this story here?
Not too much.
I think I just wanted to share this
story because I know that old.reddit.com
is a very popular thing in the privacy
community.
Like they said in the article here,
it doesn't really contain any less
trackers per se, as far as I know.
But...
if you can do it without logging in
and you're using a privacy respecting
browser like brave or Firefox, um, then,
you know,
it's still a better privacy thing.
Cause like you said, yeah,
I've noticed it too.
It's not as bad as it used to
be,
but there was a period where Reddit was
like really being a stickler for like,
if you had a VPN on like nope,
instant login page with their stupid
little trying to be cute mascot that I
swear to God,
I wanted to punch it every time.
But, um,
Yeah,
it's getting harder and harder to use.
And also they make a point about a
familiar interface because I just noticed
I'm not super active.
I go through ups and downs if I'm
being totally honest.
I don't think I'm super active on Reddit,
but every once in a while I'll be
super active for like a week and then
stop using it for like three months.
But I've noticed this week I've been on
Reddit a little more and I logged in
and now they're doing that same crap that
everybody else is doing.
It's not bad enough that they had...
an algorithmic timeline,
now they have a suggested timeline and
your actual following timeline.
And of course, by default,
every time you log in,
it goes back to the suggested timeline.
So it's not just the subreddits you
subscribe to,
it's also a bunch of other crap you're
not subscribed to that's popular,
like AskReddit or r slash what is this
or whatever.
And it's like, I don't care.
If I cared, I would subscribe.
Stop trying to show me more subreddits.
So it's just...
you know, the,
the eternal problem of in shitification,
right?
Like it's just, it's frustrating.
And it's,
it's sad that cause Reddit does have
objectively,
I think it does have some value in
the sense that a lot of the time
when you look up something,
even without the AI summaries,
a lot of the time you look something
up and especially if it's something more
niche, like, Hey,
what are the reviews on these shoes?
Or like, um, you know,
I'm having trouble with this, uh,
I'm trying to think of something I'm
actually having trouble with recently,
but you know,
I'm having trouble with a thing.
Like I'm looking for a little life hack.
Like Reddit is really good for that kind
of stuff.
And it would be really nice to not
have to log in to use Reddit just
to check somebody's thread.
Um, so it's,
it's really a shame and it's really
annoying.
Although, to be fair,
Reddit is so astroturfed,
I'm not sure how much I trust a
lot of those answers anyways.
But yeah, so just I guess, again,
I just wanted to share because I know
that is a really popular trick to use
in the privacy community.
So you guys should be aware that it
is going away, unfortunately.
Yeah,
I think one thing that I saw an
interesting comment on this article,
actually,
someone was saying they don't really need
to require a login.
Like there's other ways that we can,
we can detect humanity, right?
There's like, oh, Anubis, like using,
yeah, exactly.
So Dag said,
you can do that tracking or bot prevention
measures without forcing a login.
Smells more like preparation for age
verification.
Yeah.
And I think a lot of third-party apps
actually rely on old.reddit.com to like
basically scrape it.
And it's not scraping, but it's like,
I don't know what you would call that,
but it's like...
Are you talking about a lot of the
front ends?
No, just like apps like Infinity.
There's an app for Reddit which is called
Infinity and there's another one on iOS.
But I believe they just...
scrape old.reddit.com and then just use
that to display the content to bypass some
of the,
because there was API restrictions.
They don't use the API.
I was wondering what happened to that
because I remember there was a big deal
about it and then Reddit said they were
going to work with some of the more
popular apps like Apollo and then just
never went anywhere with that.
I was curious what happened to that story.
Everyone just went and didn't want to give
Reddit money.
So, yeah.
That's everything I had on that story
there.
Okay.
And in that case,
we'll jump over to our other...
forum thread,
which is the kids act has passed the
house.
So again,
this is just like a really quick signal
booth boost.
If you live in the U S um,
definitely please check the newsletter for
a link.
Uh,
so this person links to the text of
the bill and how each representative voted
and how to find your representative at
house.gov, which is awesome.
um, excuse me.
So I think this still has to go
through the, uh, let me see here.
Yeah.
It still has to go to the Senate
and then the president has to sign it.
Um,
but this is basically an age verification
law.
You know, it's, it's, uh, I think correct.
I could be wrong.
Um,
but I think it's kind of just like
an amalgamation of a bunch of bad bills
that have not passed.
Um, but you know,
it requires specified online platforms to
establish safeguards for minors,
such as limiting access to sexual
material, um,
providing parental controls and requiring
AI chatbots to disclose information to
users who are minors.
And, you know,
that's the first thing is like,
how's the chatbot going to know if you're
a minor, they have to age verify you.
Right.
And, you know,
the whole like limiting access to
specified sexual material.
Sure.
That's great.
Until just general,
like sexual education becomes specified
material.
It's just,
these things are just a slippery slope and
will not end well.
So if you are American, um,
find your senators because, um,
No offense to this person.
Thank you so much for sharing this.
But like your representative already
voted.
I guess you can feel free to vote
him out.
We actually I think we have a primary
coming up.
I should do some research, but.
find your senators I would say because
it's already past the house like you can
call them and yell at them but it's
not going to change their vote so what
we need now is to call the senators
and say do not vote for this or
I don't know if this actually works but
my thing is I tell them I'm like
if you vote for this I will actively
campaign against you like if I'm being
real I probably don't have the time for
that but like I will happily tell everyone
why they should not vote for you so
yeah call your senators if you live in
the US because this is this is not
good
Yeah.
They should provide parental controls and
leave it to the parents.
We've, I mean, we've,
we've covered this topic like five or six
times now.
And yeah,
that's definitely a thing we say all the
time is like, at least in other countries,
when you start a new phone,
like an iPhone or whatever,
the first thing it asks you is like,
is this,
does this phone belong to a minor?
And if you say yes,
it walks you through all the parental
controls.
And I don't understand why they can't just
do something like that, but.
Whatever.
I guess one interesting,
I guess to talk about this a bit
more, is this whole act,
is this something that is bipartisan?
Is this some certain part of the
government that's pushing for this?
Is this something like that?
That's a good question here.
Let me see this link.
So it was a Republican who introduced it.
But, no, it's pretty bipartisan.
A hundred and sixty-two yeses from the
Republicans, thirty-two noes,
twenty-four not voting.
Democrat, a hundred and four yes,
eighty-five no, twenty-three not voting,
one independent yes, everything else zero.
Oh, that must have been Bernie Sanders.
I think he's an independent.
Is he a senator?
I don't know.
We don't have a lot of independents.
But, yeah,
two hundred and sixty-seven for,
a hundred and seventeen against,
forty-seven not voting.
So it's...
unfortunately kind of bipartisan why do
our politicians work together on the worst
loss why can't you guys unite on something
good they'll squabble about like really
silly stuff and then they'll just like all
unite to like do the most dystopian like
ninteen eighty four stuff like what it's
so bad um
Yeah, it's I mean, Dag is right.
I've said this before, too.
No one can say no to protecting the
kids.
They do this on purpose because then if
you don't protect the kids or if you
vote against it,
then people are just like, oh,
you hate children.
Like it's a rhetorical device and it's
absolutely awful.
So.
Yeah, kind of off topic,
but Cisco is like Bernie's independent.
I think he's independent.
I could be right.
I know he was independent.
No, he's independent.
Nineteen seventy eight till present,
according to Wikipedia.
So, yeah, Bernie's independent.
I think when he ran for president,
he ran on the Democratic ticket because we
live in a two party country and like
he has a better chance of living to
walk on Jupiter than winning as an
independent.
But other than that,
I think he's always been independent.
Interesting.
Okay.
At least what I'm seeing is, well,
I guess to kind of ask this,
I mean,
I'm seeing there's predictions of whether
this bill will pass.
But do you think this is something that
will pass?
Like,
is this something that is most likely to
not have any issues passing through the
Senate and the President or...?
Honestly, I don't know.
I'm not politically aware and educated
enough to really be able to speculate
reliably.
Although I will say like two thirds of
the people voted yes.
So I mean, that's a pretty big margin.
It does say on this website that I
found govtrack.us that there's a thirty
four percent chance of being enacted.
So I don't know really what that means.
in that.
It means we should still call our
representatives and not trust that to be
the case.
Because all I'll say is the Eurovision
odds that I read every year are
hilariously wrong and off.
So I don't know if I trust the
odds on anything at this point.
Yeah.
So I guess how can people access a
list?
How can they find who their senators are?
Because you said it doesn't really matter
because it's past the House at this point.
So
Um, so yeah, no, good question.
So there is senate.gov.
And honestly,
if you just type into any search engine,
um, if you just type in like,
who is my representative,
there are so many websites that, uh,
you will have to put in an address.
I'm telling you people that right now,
because they need to know what district
you're in.
But to be fair,
when we're talking about the national
level,
probably doesn't have to be like your
exact address.
Maybe it can be the house across the
street.
I don't know.
But, um, there are so like, okay,
so I just typed it into brave search.
Who is my representative?
Okay.
First result, House of Representatives,
house.gov.
Second result, congress.gov.
Third result, commoncause.org.
This one's for New York City specifically.
This one's for California specifically.
USA.gov, senate.gov, Texas, Pennsylvania.
So, I mean, yeah,
there's no wealth or no shortage of
websites that will help you.
Ballotpedia, I've seen them around a lot.
Some of them, like...
house.gov and senate.gov and congress.gov
focus on the federal level but i've seen
some websites i think it's common cause
will literally go all the way down to
like here is your local school board
superintendent like some of them get
really really deep down there so um yeah
you definitely don't have to dig too hard
to find the national ones for sure yeah
it's interesting i've seen uh quite a lot
of coverage about this like kids act thing
and i've actually been seeing like stuff
about people saying it doesn't go far
enough
it needs to go further.
Please, please, please, please,
please don't make this happen.
Cause I think once this passes in the
U S I think it's, it is,
it's such a massive precedent for
everywhere else.
It's like, Oh,
it's in the U S you know,
like it's,
if it's good enough for the U S
it's good enough for everywhere else.
Like,
Um,
so hopefully we can avoid that happening.
Um,
and that it doesn't get even worse than
what it already is.
Can it change?
Can the bill change once it gets,
or does it have to re go through
the house again?
I think it would have to go through
the house again.
I could be wrong,
but I think it can change.
Yes.
They,
it can get to the Senate and somebody
could be like, no,
we need to amend this part.
But I think if they make changes,
it has to go back to the beginning,
but I could be wrong about that.
Okay.
So we still have, there's still hope.
Okay.
Yeah, that's, that's,
the US has got nothing on the EU
plans,
like chat control and age verification for
all the things.
Um, yeah,
I think there's different problems.
There's different problems in different
countries, right?
Like,
I think there's the US has a massive
problem with data brokers,
which is not really the case in Europe.
A lot of data is public in the
US.
So that's another issue.
You know,
every country has different concerns,
I think.
And I think it's not super smart to
just, you know,
start a ranking contest about which
country is better and all this silliness
because, you know,
it doesn't really get us anywhere.
I think we can be critical of every
bad law that every country wants to put
in place.
And there's definitely some terrible stuff
going on in the EU as well,
which we've talked about extensively as
well.
It's not like we're only focusing on the
US in this case too.
Yeah.
another comment here from cisco i don't
know if you've seen but bill c-thirty-six
in canada it's banning social media for
people under sixteen yes we've been kind
of following that there's c-two and
c-twenty-two and c-thirty-six um they're
all pretty
pretty terrible stuff.
I did see that currently the Canadian
parliament is on break.
So there's a bit of time to contact
people, your representatives about that.
Dag Overholt said,
EU protects you from corpos as long as
the government has complete control.
Okay.
It's definitely a different way of running
a country.
Let's just say that.
Yeah,
so that's kind of all we've got on
this,
unless you had anything else to add on?
Yeah, not really.
Yeah,
I guess we can move into the Q&A
section.
So we'll start by...
Excuse me.
We'll start by taking questions on the
forum from our paying members.
And as a reminder,
you can become a member by going to
privacyguides.org slash donate or anywhere
on privacyguides.org.
You can click the red heart icon in
the top right corner.
Um,
so we had one reminder on the thread
to consider adding XMR chat.
Um, Jonah is actually off this week.
So, uh, again,
he handles a lot of the higher level
decisions like that.
I know he's expressed interest in adding
XMR chat.
It's just, um, again, yeah, it's, uh,
there's a lot going on here.
You know,
he did the Cape interview and there's
just, uh,
I don't know where it is on the
list,
but I'm pretty sure it is on the
list.
And, uh,
Again,
reminder that you can just donate Monero
directly.
I know it's not quite the same as
XMR chat, but it is there.
Yeah.
Any donation is always appreciated.
There's also a comment here from...
Cisco five, five, six,
one who said I'm planning on contacting my
rep,
but I don't really know what to say.
Okay.
So for people in Canada,
there is open media is who you probably
want to look at.
They have been running a really good
campaign against basically every privacy
invasive thing.
I think they've, yeah,
they've got a press release already out
about the,
um bills c-thirty-four bills c-sixty-three
so a whole bunch of them there um
so check out open media openmedia.org um
they've got a lot of good resources and
I think they also have yeah they have
other related stuff as well not just like
privacy related stuff there's stuff
related to other um
I guess consumer protection stuff.
So it's worth checking out that as well.
It's probably stuff that you'd also
support.
So they're a great organization.
Um,
I don't know of any more in Canada.
That's the only one that I know.
Um, but I know they do good work.
So if you need, if you need some,
I guess, extra info on what to say,
they've got, I've got you covered.
So I thought of the American route and
I,
my first thought
Hot take,
let me finish to the people in the
audience.
My first thought is this could be a
good use for an LLM,
like Leo or Lumo,
like one of the privacy respecting ones.
But like, hey,
I want to oppose this act.
I don't know what to say and it'll
walk you through it.
Alternately, if you prefer not to use AI,
which I totally don't blame you,
I literally just typed in oppose the kids
act into Brave.
And okay,
I don't know anything about this
organization,
but the very first result that popped up
was a website called fivecalls.org.
And it has,
if you click that link and scroll down
to the bottom, it has a script.
Hi,
my name is blank and I'm a constituent
from city and zip code.
They will ask for your zip code in
my experience.
That's like the thing they care about.
I'm calling to demand that representative
slash Senator who oppose HR seven, seven,
five, seven,
the house pass kids act and any other
legislative package that includes COSA and
age verification requirements.
Broad legislation like this does nothing
to protect anyone.
Instead it blocks state's level laws and
shield big tech companies from
accountability.
It must be opposed.
Thank you for your time.
Pretty straightforward.
Sorry,
I know I read that kind of fast.
But, you know, just, I mean,
maybe post in the forum,
like on this actual topic,
like you could get some opinions from
other people.
Or honestly,
what I've done in the past is,
because I was opposing,
I think it was like the,
was it called like the LEAD Act?
Like the Lawful Law Enforcement Access to
Data or something.
I don't know, it was a backdoor act.
But I would literally call them,
because I had like three federal or state
level organizations
state level, federal level.
I had three like federal level reps I
had to call.
And so I would literally just call them
on my lunch break,
every single one of them.
And I would say that like, hi,
I'm calling from this zip code.
I'm a voter.
I oppose this thing.
And they would just take it down,
write it down and go, okay, thank you.
And that's it.
Like,
I don't know if it's less effective than
giving them a why,
but you don't have to say much is
what I'm getting at.
Just expressing any opposition.
Just the thing I always tell people,
please be sane.
Don't tell them they're evil.
Don't tell them they're stupid.
Be polite.
Just like I oppose this.
This is not the right way to solve
this issue.
I do see we actually just got a
question in the forum thread.
Oh, sorry.
That says,
how important is threat modeling for
privacy?
I've put that off for the longest time,
which has led to a lot of underprotecting
or overprotecting.
I don't feel like it's talked about
enough.
That's funny, because I...
I harp on threat modeling constantly,
and I still feel like there was a
point where I was like, okay,
I think we've talked about this enough.
But in general,
so I mean it's – I think it's
personally – I think it's really important
because like you said,
without threat modeling,
you don't know if you're doing too much
or doing too little.
And especially I think a lot of people
in the privacy community have a habit of
doing too much.
And not realizing, you know,
to the point where it starts to impact
like mental health or, you know,
relationships with friends and family.
And it's like, OK,
you can pull back like you're you're not
you're not a spy operating in North Korea.
You don't need to be that hardcore.
But alternately, yeah,
it could lead to a lot of like,
oh,
I'm using Linux with – I'm using cubes
and graphene and all this super secure
blah, blah, blah, blah, blah.
And it's like, okay, cool.
Have you taken your data down from the
internet from before you got into privacy?
So I think it is really important,
although I will say that I don't think
it –
Um, number one,
I don't think it necessarily has to be
a formal process.
Like,
I don't think you need to sit down,
like you're making a budget at the dinner
table.
And the other thing that I haven't found
a good way how to explain this yet,
but I think something that doesn't get
talked about enough is the fact that a
threat model is less of like a specific
thing, like a specific consistent thing.
And it's more of like,
I guess I would say it's more of
a philosophy for how you approach data
because in the sense of like, um,
Like,
I'm trying to think of an example here.
So, okay, no, so this is an example.
I don't know if this is a good
example, but I...
In non-privacy online spaces,
because I do hang out on those sometimes,
I typically don't post photos of myself
because I don't want,
even though it's very unlikely,
I know Privacy Guides is not that famous
and neither is the new oil or anything,
but I don't want the off chance of
somebody like, oh my God, you're Nate,
like I recognize you.
But I mean, like offline, you know,
if my wife is like, hey,
can I take a selfie of us doing,
you know,
this this Christmas event together?
Like, yeah, of course.
I don't care.
Like it's it's it's not about a consistent
like no photos of me ever.
Right.
It's it's contextual.
It's like, where is this photo going?
What is it used for?
Who's it being shared with?
what are the risks of this photo?
My wife might send it to the group
chat, the family group chat,
but who cares?
Everyone there knows what I look like.
And I don't know,
maybe that wasn't the best example.
I'm working live here off the cuff.
But my point being is like,
it doesn't have to be the same level
of protection across the board because it
can be very contextual on like,
what are the risks?
What are the likelihoods?
That's all part of threat modeling and it
will vary from situation to situation.
I don't know if that made sense.
No, I think you're,
you brought up some good points.
Yeah.
I mean, I don't think it's, uh,
I don't think you have to, uh,
do anything super quickly as well.
Cause I do feel like some people they've,
they were like, oh my goodness,
I found out like how my data's being
used for all these like terrible things.
And now I've got to like update every
password and like,
secure every account,
delete hundreds of accounts today.
It's like, no,
like you got to slow down a little
bit.
Like don't, don't, don't go too fast.
You know, don't, um,
think things through and yeah, it's,
it can definitely,
you can definitely go too far.
I think, um, yeah, I don't,
I don't really know.
I mean,
I don't personally share a whole lot about
stuff that I do on the internet with
people in real life.
Um, so it's always just a nebulous,
I work on internet things and that's kind
of it.
Um, but I think, you know, it's,
it's good to think about like what your,
uh,
what your threats are because you know,
me and Nate,
cause we're on this public podcast are
going to have different,
a different threat model than you as a
person just participating in our forum,
I guess.
Um, not drastically different, but like,
you know, obviously we're sharing names,
Nate's sharing his face,
I'm sharing my voice.
Um, so, you know,
you have different threats to consider.
Um,
and I definitely think don't rush into
things because um yeah you can make you
can make decisions that you can't undo
like for instance if you show your face
well you kind of have to show your
face forever right like you know um so
you know just take that with uh
take that as something as a warning,
I guess.
I've definitely made mistakes.
I've definitely fumbled along things,
but yeah,
we're trying to work on more educational
stuff to help people make their threat
models and stuff like that.
We did have a threat model series that
we're working on at some point.
It's just a lot because every week we
have like a new video coming out or
like, you know,
stuff that we're working on and like,
Other projects that we feel are more
timely or whatever.
So things kind of get swept down a
bit sometimes.
But it's something we do want to try
and push to get done at some point
to help people with that.
Because it is like one of the most
common questions that we do get about
privacy related stuff.
We should talk about that in the next
staff meeting.
Maybe now's a good time to do the
threat modeling video.
Yeah.
Yeah,
just to back up what you said at
first,
like the phrase I like to use is
Rome wasn't built in a day, you know?
And it's like,
a lot of people will say that in
like personal finance, right?
Like if you wake up and you're like
tens of thousands of dollars in debt and,
you know, screaming towards bankruptcy,
a lot of personal finance people will
point out like, well,
you probably didn't get there once, right?
Like you probably didn't just go out and
buy like,
a mansion in the Beverly Hills and now
you're screwed.
Like it was probably a lot of really
bad decisions that added up.
And so you're not going to fix it
overnight.
And it's the same thing with privacy.
Like you, you didn't,
you didn't just wake up one day and
like mainline all your ID straight to like
a ransomware gang.
It's happened over years of data breaches
and sharing too much on social media and
this and that.
So yeah,
definitely like pacing yourself going
slow.
I do agree with your last part,
but it's, it's,
I want to say yes and no,
because there are certain things that,
like you said,
like you put your face out there.
I wouldn't say you have to keep doing
it, but it's certainly harder,
especially the more you do it.
Like at this point,
my face will probably never be off the
internet, but you know,
if you do it once,
like you could probably take it offline,
but you do have to acknowledge that you
might not,
maybe somebody screenshotted it,
maybe somebody archived it, whatever.
Um,
but also there's a lot of other things
in privacy that I think are reversible.
Like, um,
I think I've shared this before.
When I first got into privacy,
I deleted Steam because I was like, oh,
I'm going to be into privacy.
I'm not going to use Steam.
And then over time,
as I kind of adjusted and got a
better feel for it, I'm like, actually,
I'm willing to take the hit and keep
using Steam.
And I know in retrospect,
I probably should have gone with some
other platforms that are less problematic
in terms of DRM.
But from a privacy perspective,
I was like,
I'm willing to take the hit because these
are games that bring me value and I
enjoy playing them and
And now I have to like repurchase all
those games that I had over all those
years.
So instead,
what I wish I had done is like,
okay,
just log out of Steam for like six
months, you know, or, you know,
you can always, if you delete Facebook,
you can always sign back up.
Like some decisions are reversible.
And so I think there's,
Um, it's just a balance.
Like, yeah,
some decisions are not easily reversible
and you should put a lot of thought
into them and not act right away.
But then other ones are also like, eh,
you know, you can always delete that app.
You can always read, read,
download that app.
Like,
so I can't really give you like a
hard and fast rule, obviously,
but just something to think about,
I think.
You are.
Okay.
There you go.
Yeah.
I think it's,
I think the thing is definitely be careful
with like email accounts and stuff like
that.
That's like probably one of the biggest
mistakes that I made was like,
Having a Gmail account and I was like,
oh, I want to nuke it so bad.
And I just nuked it like too quickly.
And there was stuff that was... Oh, no.
So it becomes a nightmare.
So I would say keep it around for
a couple of years.
You can delete it.
It'll feel a lot better once you finally
are at a point where you're like,
I can actually delete this.
Because I guarantee you, you'll be like...
Oh, wait,
I remember I've got that account that I
made on that website from like ten years
ago.
Oh,
it's with my old email that I deleted.
It's like, oh.
You'll be able to sort it.
For sure.
Yeah, definitely.
I feel like I had another quick thought
on that one, but I can't remember it,
so it must not have been that important.
Yeah,
I guess if nobody else has any questions,
that's all I'm seeing on the forum.
I guess we can close out here.
Sounds good.
Yeah, let's do it.
Alrighty.
All right.
Well, thanks everyone for watching.
All the updates from this week in privacy
are shared on the blog every week.
So sign up for the newsletter or subscribe
with your favorite RSS reader if you want
to stay tuned.
As always,
a reminder that we send it right when
we start streaming.
So it also serves as a good little
notification that the stream has started.
For people who prefer audio,
we have a podcast available on all podcast
platforms and RSS.
And this video will be synced to PeerTube.
Privacy Guides is an impartial nonprofit
organization that is focused on building a
strong privacy advocacy community and
delivering the best digital privacy and
consumer technology rights advice on the
internet.
If you want to support our mission,
you can make a donation on our website,
privacyguides.org slash donate.
Or again, on any page of the website,
you can click the red heart icon located
in the top right corner of the page.
You can contribute using standard fiat
currency via debit or credit card,
or you can donate anonymously using Monero
or your favorite cryptocurrency.
Becoming a paid member unlocks exclusive
perks like early access to video content,
priority during the live stream Q&A,
early access to the show notes, actually,
so you can see what stories we're
considering.
You'll also get a cool badge on your
profile in the Privacy Guides forum and
the warm,
fuzzy feeling of supporting independent
media.
So thank you all for watching,
and we'll be back next week.
See you next week.