Dan Goodin

Reporter covering security at Ars Technica. DM me on Signal: DanArs.82.

Public Key

npub1yyl6ktycvjymch9hyzq5yqphj89kalfqmtswcjpjmp7s67ms6g9sdp6r3v

NIP-05 Address

Profile Code

nprofile1qqszz0at9jvxfzdutjmjpq2zqqmerjmwl5sd4c8vfqedslgd0dcdyzcpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dssc776n

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1yyl6ktycvjymch9hyzq5yqphj89kalfqmtswcjpjmp7s67ms6g9sdp6r3v

Show more details

Last Notes

2026-06-05 21:48:56 GMT

You too can turn a Bluetooth device into a PC-pwning proxy
https://arstechnica.com/security/2026/06/highly-reviewed-speaker-can-be-hacked-over-the-air-to-infect-connected-devices/

2026-03-26 16:23:23 GMT

Filippo is spot on. The question we should be asking now is: "What does Google know that the rest of us don't?"
#nevent1q…9m0l

2026-03-25 16:21:10 GMT

Google is dramatically shortening its deadline readiness for the arrival of Q Day, the point at which existing quantum computers can break public-key cryptography algorithms that secure decades’ worth of secrets belonging to militaries, banks, governments, and nearly every individual on earth.
https://arstechnica.com/security/2026/03/google-bumps-up-q-day-estimate-to-2029-far-sooner-than-previously-thought/?comments-page=1#comments

2026-03-24 16:49:22 GMT

Wow, TeamPCP is hacking open-source developers faster than we can report on them. The latest (that I'm aware of, anyway) is LiteLLM. They worked with Trivy but didn't bother to change their credentials after Trivy was hacked, despite an ample amount of advice to do so.
Folks, if any of you used LiteLLM, now is the time to change your credentials, at an atomic level. Now, as in immediately.
https://news.ycombinator.com/item?id=47501729

2026-03-09 17:26:51 GMT

- reply

@nprofile…44dh
Agreed. Most sites far prefer subscriptions over serving ads.

2026-03-09 17:23:36 GMT

Dear readers. If you're not willing to support the families of those you want to read then we regretfully will be preventing you from obtaining our work for free.
https://infosec.exchange/@[email protected]/116199534759633586
https://infosec.exchange/@[email protected]
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/200/370/455/839/715/original/f04687eb1e612879.png

2026-03-03 17:58:03 GMT

Tire pressure "transmissions are sent without any encryption or secure mechanisms and include a unique identifier. This allows anyone with affordable equipment like a low-cost spectrum receiver and a standard off-the-shelf antenna to capture and track them throughout time and space."
https://www.securityweek.com/researchers-uncover-method-to-track-cars-via-tire-sensors/

2026-03-03 17:47:32 GMT

RIP burner accounts
https://arstechnica.com/security/2026/03/llms-can-unmask-pseudonymous-users-at-scale-with-surprising-accuracy/

2026-02-27 19:02:21 GMT

Google has devised a means for securing HTTPS certificates against quantum computing attacks without massive performance hits stemming from the considerably longer size of data required to be included.
Is anyone following this work?
https://security.googleblog.com/2026/02/cultivating-robust-and-efficient.html

2026-02-26 15:54:24 GMT

That guest SSID you set up for your neighbors may not be as secure as you think
https://arstechnica.com/security/2026/02/new-airsnitch-attack-breaks-wi-fi-encryption-in-homes-offices-and-enterprises/

2026-02-06 19:25:07 GMT

Microsoft's former Windows head, Steven Sinofsky, sent Epstein secret company documents and sought Epstein's counsel on his departure from Microsoft.
https://www.neowin.net/news/former-windows-chief-shared-internal-secrets-with-jeffrey-epstein-documents-reveal/

2026-02-06 18:18:23 GMT

Regular reminder to activists, journos, and others: broligarch-owned centralized platforms will cancel you for any reason or no reason. Ween yourself off them now.
#nevent1q…3s9q

2026-01-15 18:18:27 GMT

Anyone have any general attacks about the details of the US cyberop the preceded the capture of Maduro?

2026-01-13 16:40:54 GMT

Moxie Marlinspike—the engineer who set a new standard for private messaging with the creation of the Signal Messenger—is now aiming to revolutionize AI chatbots in a similar way.
https://arstechnica.com/security/2026/01/signal-creator-moxie-marlinspike-wants-to-do-for-ai-what-he-did-for-messaging/

2026-01-13 01:27:36 GMT

Curious to know if all the Trump haters who refused to vote for Harris because Gaza still stand by that decision.

2026-01-08 18:21:06 GMT

Has anyone compiled the privacy policies of various LLM platforms, ideally in a comprehensive way? OpenAI said today that private health data and conversations shared by ChatGPT Health won't be used for training purposes. Does this mean OpenAI won't sell it either or give it to law enforcement when presented with a warrant? What about other AI chat services.
I'm looking for responses from experienced privacy professionals or advocates with empirical data. Please, no responses airing cynicism or grievances about AI privacy in general, no matter how valid.
https://openai.com/index/introducing-chatgpt-health/

2026-01-08 03:18:12 GMT

- reply

@nprofile…4kzv @nprofile…myvq
@nprofile…myvq
kudos on the move, but I can't help wondering: what took so long? This site has been spewing content that's at least this toxic ever since the Nazi saluting billionaire sociopath bought it. we should all be actively working on moving off Meta, discord and all the other platforms too.

2026-01-07 21:58:22 GMT

- reply

@nprofile…l9z3
I for one don't welcome our new drone delivery overlords.

2025-12-17 16:23:03 GMT

Security pros: what are the 3 things you'll be helping relatives at family gatherings do to better gird their online lives?

2025-12-03 20:14:41 GMT

"Even if your app does not implement any React Server Function endpoints it may still be vulnerable if your app supports React Server Components."
Can someone explain what this means?

2025-11-21 22:43:13 GMT

The International Association of Cryptologic Research has cancelled the results of its annual leadership election after an official lost an encryption key needed to unlock results stored in a "hyper-secure election system."
https://www.nytimes.com/2025/11/21/world/cryptography-group-lost-election-results.html?unlocked_article_code=1.208._aCi.O706MR3i3l3K&smid=url-share

2025-11-19 20:41:03 GMT

Critics scoff after Microsoft warns AI feature can infect machines and pilfer data
https://arstechnica.com/security/2025/11/critics-scoff-after-microsoft-warns-ai-feature-can-infect-machines-and-pilfer-data/

2025-11-19 00:42:10 GMT

To placate all "war-on-Chrismas" cranks, I'm going to start saying merry x-mas.

2025-11-18 19:05:06 GMT

- reply

Microsoft says in the post (see toot above) that the agent isn't enabled by default and that only experienced users should enable it. What are these users to do to prevent the attacks Microsoft is warning of?

2025-11-18 18:54:33 GMT

Thoughts about this Microsoft advisory?
"Additionally, agentic AI applications introduce novel security risks, such as cross-prompt injection (XPIA), where malicious content embedded in UI elements or documents can override agent instructions, leading to unintended actions like data exfiltration or malware installation."
https://support.microsoft.com/en-us/windows/experimental-agentic-features-a25ede8a-e4c2-4841-85a8-44839191dfb3

2025-11-14 20:14:06 GMT

- reply

@nprofile…370p
CyberScoop and Bleeping Computer just published great articles that also elaborate on all the nuances suggesting this isn't the watershed event Anthropic and many others say it is:
https://cyberscoop.com/anthropic-ai-orchestrated-attack-required-many-human-hands/
https://www.bleepingcomputer.com/news/security/anthropic-claims-of-claude-ai-automated-cyberattacks-met-with-doubt/

2025-11-13 18:55:12 GMT

- reply

@nprofile…scce
The WSJ link is in the OP. A non-paywalled link is: https://web.archive.org/web/https://www.wsj.com/tech/ai/china-hackers-ai-cyberattacks-anthropic-41d7ce76

2025-11-13 18:02:34 GMT

I could really benefit from experts' analysis of this WSJ article reporting that China-backed hackers used Anthropic’s Claude to automate 80% to 90% of a September hacking campaign targeting corporations and governments.
There aren't a lot of specifics, but among those provided:
The eﬀort focused on dozens of targets and involved a level of automation that Anthropic’s cybersecurity investigators had not previously seen.
In this instance 80% to 90% of the attack was automated, with humans only intervening in a handful of decision points.
The hackers conducted their attacks “literally with the click of a button, and then with minimal human interaction."
Anthropic disrupted the campaign and blocked the hackers’ accounts, but not before as many as four intrusions were successful.
In one case, the hackers
directed Claude tools to query internal databases and extract data independently.
“The human was only involved in a few critical chokepoints, saying,
doesn’t look right, Claude, are you sure?’”
‘Yes, continue,
’ ‘Don’t continue,
’ ‘Thank you for this information,
’ ‘Oh, that
Stitching together hacking tasks into nearly autonomous attacks is a new step in a growing trend of automation that is giving hackers
additional scale and speed.
We've seen so many exaggerated accounts of AI-assisted hacks. Is this another one? Are there reasons to take this report more seriously? Any other thoughts?
https://www.wsj.com/tech/ai/china-hackers-ai-cyberattacks-anthropic-41d7ce76

2025-11-12 22:41:01 GMT

In 20 minutes NY AG Letitia James will participate in the Conde Nast union rally supporting 4 of our colleagues who were illegally fired. If you're near WTC in Manhattan, please show your support.
#nevent1q…70zl

2025-11-12 20:26:53 GMT

Wow, the lack of ANY factual support for such a claim amounts to hyperbole. And from a CEO peddling a service to "guarantee content integrity." File this one under "Umbrella salesman predicts torrential rain."
https://www.wgcu.org/science-tech/2025-09-23/detection-expert-says-hackers-likely-used-ai-to-penetrate-airport-system

2025-11-12 19:24:41 GMT

ICYMI: 4 Conde Nast employees were illegally fired for exercising permitted speech in their workplace. Tonight, NY AG Letitia James will call out this union-busting move by Conde management. Please attend. Please also sign our petition to reinstate our fired colleagues. https://actionnetwork.org/petitions/tell-conde-bosses-to-reinstate-the-fired-four-reverse-the-suspensions-and-end-the-union-busting.
Please boost for reach.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/538/353/371/204/178/original/6f8993aeed3c4c01.jpg

2025-11-09 22:16:04 GMT

- reply

@nprofile…699p @nprofile…6zuf
All 5 malware families google analyzed fail to work and are easily detected. For now, AI assisted malware poses zero threat. That obviously may change, but for now, these scary stories to more harm than good.
https://arstechnica.com/security/2025/11/ai-generated-malware-poses-little-real-world-threat-contrary-to-hype/

2025-10-31 15:59:19 GMT

"The former executive of Trenchant who pleaded guilty this week to selling his company's software hacking tools to a zero-day broker in Russia, sold at least one of these tools to the Russian firm even after learning that a previous tool he sold the broker was being used by a South Korean broker – indicating that the stolen tools were being passed on to others downstream."
A reminder that if you're not following @nprofile…5adu you should be.
https://www.zetter-zeroday.com/former-trenchant-exec-sold-stolen-code-to-russian-buyer-even-after-learning-that-other-code-he-sold-was-being-utilized-by-different-broker-in-south-korea/

2025-10-30 21:37:44 GMT

People working on post-quantum-proofing vulnerable encryption protocols (and curious onlookers) can find lots of value in this new post from Cloudflare. It discusses the herculean engineering challenges of revamping anonymous credentials that will be broken by a quantum computer. There's a growing need for this kind of privacy (for instance to make digital drivers licenses privacy preserving), which allows individuals to prove specific facts, like they have had a drivers license for more than 3 years, without divulging personal information like their birthday or place of birth. The long and short of of the challeng is that engineers can't simply drop quantum-resistant algorithms into AC protocols that currently use vulnerable ones. Instead, engineers will need to collaborate with standards bodies that build entirely new protocols, largely from scratch. The post goes on to name a few of the most promising approaches.
https://blog.cloudflare.com/pq-anonymous-credentials/

2025-10-23 21:30:54 GMT

- reply

@nprofile…scce
As @nprofile…5adu reported recently, a CISA official blamed democrats during a press call. very concerning that even securing the nations infrastructure isn't immune from politicization.

2025-10-19 02:31:49 GMT

- reply

@nprofile…2ard @nprofile…4unj
The helpless little thing with the dirty mouth /
Who's always got something to say
I miss Elliott terribly.

2025-10-17 17:01:00 GMT

- reply

@nprofile…2war
I miss seeing you on the Fedi.

2025-10-16 20:39:59 GMT

"Godfather of Silicon Valley" Ron Conway resigns from Salesforce board after its CEO revealed his authoritarian leanings by calling on Tump to send national guards to San Francisco. "“It saddens me immensely to say that with your recent comments, and failure to understand their impact, I now barely recognize the person I have so long admired,” Conway tells Marc Benioff in an email.
https://sfstandard.com/2025/10/16/ron-conway-resigns-salesforce-foundation-board-marc-benioff/

2025-10-16 20:24:15 GMT

My profound thanks to Susan Stamberg, probably the biggest single reason I gravitated to journalism in my late teens. She was also a trailblazer for women. She died today at the age of 87. My condolences to her family.
https://www.npr.org/2025/10/16/1184880448/susan-stamberg-obituary

2025-10-15 20:45:00 GMT

- reply

@nprofile…j4xh
Oh dear.

2025-10-15 19:52:03 GMT

- reply

@nprofile…j4xh
Do tell.

2025-10-14 17:27:02 GMT

- reply

@nprofile…4unj @nprofile…exf3 @nprofile…u059
Agreed. I'm lucky enough to have known him when as well.

2025-10-14 16:57:45 GMT

- reply

As the wave of authoritarianism has crested, I've been challenging myself and others to ween ourselves off of centralized platforms that leak our private data (through breaches or voluntarily) and deplatform us for any reason or no reason, leaving us high and dry with no warning. You know this is awful when labor unions, civil rights groups and other groups under threat continue to trust Slack, Gmail, Xitter and the rest now of the broligarch-owned gatekeepers more than ever.
Some of you (and in some cases I) have responded with criticism of those still using these platforms. Many of you say unions should use decentralized alternatives such as Zulip, PGP on top of Slack, Mattermost, Matrix. Besides victim blaming, this response is misguided because it expects groups divert resources from their core missions to making immature and hard-to-use platforms work inside their organization.
All of this reminds me of the struggles we had with our dependence on unencrypted email in the 2000s and early 2010s. Back then, the only alternative was PGP, which was unusable for 50% or more of email senders. Then @nprofile…exf3 came along and solved most of the sticking points, almost overnight.
The lesson: decentralized, privacy-preserving platforms don't happen by accident. And they can't be cobbled together in beta form. They require funding and smart engineering that prioritizes usability as much as security.
I'm still not sure how we ween ourselves off of centralized platforms, but I think the success of Signal may serve as a useful model. Maybe we don't try to replace all platforms at once, Maybe for now we focus on finding an alternative to, say, Slack and use the momentum of that to tackle other platforms afterward.
I obviously don't have answers yet. I don't think anyone does yet. But it's important we start asking questions and stop blaming non-technologists who just want a platform that works.

2025-10-14 16:15:35 GMT

This is fantastic research from Wenyi Morty Zhang, Annie Dai, @nprofile…h7hk, Dave Levin, @nprofile…g9gy, and Aaron Schulman:
They created their own $800 satellite receiver, pointed it at the sky, and recovered calls and text messages on T-Mobile’s cellular network, data from airline passengers’ in-flight Wi-Fi browsing, communications to and from critical infrastructure, and US and Mexican military and law enforcement communications—all unencrypted.
Great reporting, too, from @nprofile…dllf and @nprofile…rka7 of @nprofile…n6ma
https://www.wired.com/story/satellites-are-leaking-the-worlds-secrets-calls-texts-military-and-corporate-data/

2025-10-13 17:11:48 GMT

- reply

The fact that my labor union, like probably the majority of unions around the world, trusts slack is horrifying.

2025-10-13 17:10:17 GMT

- reply

Now that Marc Benioff, owner of Slack and Salesforce, has confirmed he sides with authoritarianism, it's more incumbent on us than ever to move off central platforms, which can dump communications we presumed were private or cut us off for any reason or no reason at all.
https://sfstandard.com/2025/10/10/marc-benioff-national-guard-sf/

2025-10-01 17:27:41 GMT

- reply

Here's another reminder that it's best to resist as much as possible the siren's call of relying on AI and other services from Big Tech. Gemini is blocking questions about Trump showing signs of dementia even as it answers the same question when applied to Biden. When we turn to AI we are abdicating our own judgement and research responsibilities to a broligarchy that bends to the whims of billionaires.
https://www.theverge.com/news/789152/google-ai-searches-blocking-trump-dementia-biden
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/300/061/864/400/127/original/e4f45a53e42d7c4d.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/300/072/991/347/661/original/66812af424a32782.png

2025-10-01 04:27:37 GMT

The more this 2nd term goes on, the more I think we in security circles are ignoring the elephant in the room.
https://youtu.be/AhGeNPJlIK4?si=mneL-heMEJTuNaPy&t=5183
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/297/003/332/709/613/original/90b9b9284ae841ba.png

2025-10-01 00:58:12 GMT

“San Francisco and Chicago, New York, Los Angeles. They’re very unsafe places, We’re gonna straighten them out one by one. It’s a war from within."
"I told Pete [Hegseth], we should use some of these cities as training grounds for our military."
https://sfstandard.com/2025/09/30/trump-military-san-francisco/

2025-09-30 20:44:21 GMT

The chipmakers say physical attacks aren't in the threat model. Many users didn't get the memo.
https://arstechnica.com/security/2025/09/intel-and-amd-trusted-enclaves-the-backbone-of-network-security-fall-to-physical-attacks/

2025-09-30 18:49:37 GMT

Is there no company that will stand up to this shameless bullying by a sitting president?
https://www.nytimes.com/2025/09/29/technology/youtube-trump-lawsuit-settlement.html

2025-09-30 16:41:02 GMT

After 25 years, I still struggle to find an intuitive way to describe computer "state" to non-techies. Such a simple thing and yet I still don't know how to give it a simple description/definition.

2025-09-05 16:32:20 GMT

- reply

@nprofile…5k2y
As @nprofile…gtq7 demonstrates in a new paper, these types of operations are easy and cheap to build at scale.
https://arxiv.org/abs/2508.20186

2025-08-11 18:02:17 GMT

When I look at the mess unfolding all around me in this country, I can't stop thinking about the ~15 million people who showed up in 2020 for Biden but couldn't be arsed to show up in 2024 to vote for the competent black woman.
There's a reason for the saying: Elections are decided by the people who DON'T vote.
https://www.pewresearch.org/politics/2025/06/26/voter-turnout-2020-2024/

2025-08-08 16:03:57 GMT

Californians, particularly those in SF, aren't doing anyone a favor by allowing rampant shoplifting to go go unpunished. Go to a neighborhood Walgreens on most afternoons and you'll find shelves bare after being cleared earlier in the day. The thieves responsible sell the stuff at a corner literally one block away. In most states, police vice squads would stop this shit in its tracks, but we Californians are too enlightened for that. So law abiders have to pay much higher prices to subsidize these crooks and wait for a tube of toothpaste to be fetched from behind a locked counter. Not to mention, we make ourselves easy targets for conservatives.
https://sfstandard.com/2025/08/08/san-francisco-prolific-shoplifter-justice-system/

2025-08-08 03:28:57 GMT

Question for the malware analysts: are we seeing strings or comments that try to drop prompt injections yet?

2025-08-07 17:49:36 GMT

A reminder that software makers, hardware makers, cloud services, payment processors, and the like will throw their customers under the bus whenever it suits them. Your payment card, food delivery account, AWS instance, Gmail address -- all can be taken away on a whim for any reason or no reason. These providers are NOT your friend. Make plans now. Have backups in place. Practice self-reliance. Ween yourself off these one at a time.

2025-08-07 17:40:29 GMT

- reply

@nprofile…5k2y
Motherf**kin' wind farms!
https://media.infosec.exchange/infosec.exchange/cache/media_attachments/files/114/985/976/072/307/954/original/13afd591a84d4d7b.mp4

2025-08-04 19:37:25 GMT

- reply

@nprofile…a0g8
"In reality, all we’ve created is a bot which is almost perfect at mimicking human-like natural language use, and the rest is people just projecting other human qualities on to it. Quite simply, “LLMs are doing reasoning” is the “look, my dog is smiling” of technology. In exactly the same way that dogs don’t convey their emotions via human-like facial expressions, there’s no reason to believe that even if computer could think, it’d perfectly mirror what looks like human reasoning."

2025-08-04 19:36:50 GMT

Once again, @nprofile…a0g8 nails it, this time calling out the "gluttony of myopic visionaries" shilling the wonders of AI.
https://malwaretech.com/2025/08/every-reason-why-i-hate-ai.html

2025-07-30 22:41:12 GMT

Is the activating of the Minnesota National Guard an over reaction to the ransomware attack on St. Paul? I have yet to hear an explanation of what exactly these folks are doing or what they can do that normal incident response people can't. Also, how many troops have been deployed? I haven't seen any of these questions answered let alone asked in the coverage I've read.

2025-07-25 17:14:39 GMT

- reply

@nprofile…flsq
Y'all are doing great work, Andy.

2025-07-22 18:25:47 GMT

Ozzy brought so much excitement, energy and creativity to multiple generations over the past five decades. Thanks and rest in power, Ozzy, and to his family, my deep, deep condolences.
https://www.nbcnews.com/news/obituaries/ozzy-osbourne-pioneering-heavy-metal-singer-black-sabbath-frontman-die-rcna42423

2025-07-16 18:31:54 GMT

Am I the only one who can't bring themselves to delete contacts who are no longer living?

2025-07-07 17:49:03 GMT

- reply

@nprofile…naem
I'm not following what you're saying here. How is an email sent from Exchange or Gmail to a Proton address end-to-end encrypted? How would Proton be unable to read the content of such emails?

2025-07-07 16:44:46 GMT

I'm all for moving off of centralized platforms controlled by broligarchies. That said, how do we know platforms like Proton are any less horrible? Genuine question with no snark intended.

2025-07-07 15:43:22 GMT

- reply

@nprofile…r0kn
💔

2025-06-24 17:48:48 GMT

Ubuntu is now allowing users to disable security mitigations Intel has baked into its GPU components. People are claiming the setting provides up to a 20% boost in performance. I'm still trying to understand more about the mitigations, but they appear to involve defending against Spectre-based attacks. Is this wise? On the one hand, I'm not aware of a single Spectre-based attack in the wild. On the other hand, you're leaving yourself potentially exposed. Thoughts
https://www.phoronix.com/news/Disable-Intel-Gfx-Security-20p

2025-06-11 18:25:46 GMT

If the only masterpiece Brian Wilson ever made was PetSounds, his work on this earth could have been finished. Instead, he did so much more to bring happiness and beauty to the world. Rest in power, Brian.
https://www.rollingstone.com/music/music-news/brian-wilson-beach-boys-dead-1234810073/

2025-06-10 19:08:11 GMT

Found in the wild: 2 Secure Boot exploits. Microsoft is patching only 1 of them.
https://arstechnica.com/security/2025/06/unearthed-in-the-wild-2-secure-boot-exploits-microsoft-patches-only-1-of-them/

2025-06-03 14:19:36 GMT

Tracking code that Meta and Russia-based Yandex embed into millions of websites is de-anonymizing visitors by abusing legitimate Internet protocols, causing Chrome and other browsers to surreptitiously send unique identifiers to native apps installed on a device, researchers have discovered. Google says it's investigating the abuse, which allows Meta and Yandex to convert ephemeral web identifiers into persistent mobile app user identities.
https://arstechnica.com/security/2025/06/meta-and-yandex-are-de-anonymizing-android-users-web-browsing-identifiers/

2025-05-21 21:11:30 GMT

- reply

https://arstechnica.com/security/2025/05/signal-resorts-to-weird-trick-to-block-windows-recall-in-desktop-app/

2025-05-21 17:07:04 GMT

- reply

Signal writes:
"We hope that the AI teams building systems like Recall will think through these implications more carefully in the future. Apps like Signal shouldn’t have to implement “one weird trick” in order to maintain the privacy and integrity of their services without proper developer tools. People who care about privacy shouldn’t be forced to sacrifice accessibility upon the altar of AI aspirations either."

2025-05-21 17:06:22 GMT

Signal Messenger is warning that Recall, the AI tool rolling out in Windows 11 that will screenshot, index, and store everything a user does every three seconds, poses a risk to its users. Effective immediately, the Windows Desktop version will by default block the ability of Windows to screenshot the app. Of course, Microsoft provides no API to disable Recall from screenshotting specific apps, so Signal is getting creative. They are invoking a digital rights management API that blocks the screenshotting of copyrighted material.
https://signal.org/blog/signal-doesnt-recall/

2025-05-20 19:54:24 GMT

New from @nprofile…d9tn: The United Arab Emirates military is seeking to build out its work in AI by offering high-paying jobs to about 30 former Defense Department workers who resigned last month amid encroachment by the Elon Musk-led Department of Government Efficiency.
https://www.zetter-zeroday.com/uae-recruiting-us-personnel-displaced-by-doge-to-work-on-ai-for-its-military/

2025-05-16 20:46:23 GMT

@nprofile…uvqf never fails to deliver
https://arstechnica.com/information-technology/2025/05/the-empire-strikes-back-with-f-bombs-ai-darth-vader-goes-rogue-with-profanity-slurs/?utm_brand=arstechnica&utm_social-type=owned&utm_source=mastodon&utm_medium=social

2025-05-14 16:44:21 GMT

Folks, there is 0 evidence that Steam passwords have been breached. Unless and until credible evidence occurs, please do NOT urge people to change their login credentials and please do NOT boost other people's toots doing the same. Creating unjustified anxiety about a non event does a disservice to us all.
Please boost for visibility.

2025-05-14 16:39:55 GMT

- reply

@nprofile…au8t
There is 0 evidence any such breach has taken place. Posts that advise people to take safety precautions based on debunked information do a disservice to all of us. Please consider updating your toot.

2025-05-09 03:29:09 GMT

- reply

@nprofile…5lc3
Oh man, I'd forgotten all about that.
https://arstechnica.com/security/2023/08/windows-feature-that-resets-system-clocks-based-on-random-data-is-wreaking-havoc/

2025-05-02 17:32:51 GMT

Microsoft writes:
"For example, if you have a password and “one time code” set up on your account, we’ll prompt you to sign in with your one time code instead of your password. After you’re signed in, you’ll be prompted to enroll a passkey."
I don't understand this. Why would Microsoft remove the password requirement and rely solely on a 1-time code? And what happens if the user decides not to use a passkey?

2025-05-01 22:56:40 GMT

April was the first full month since I installed my 4.1 kW solar system and accompanying batteries. And just like that, I went from drawing 200-250 kWh per month from the grid to 3 kWh. For the month, I produced 583 kWh, 284 kWh of which I exported 284 kWh to the grid.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/435/036/168/526/123/original/0d40dc72a404ce84.jpg

2025-04-30 18:51:00 GMT

- reply

@nprofile…fle4
I'm not aware of a Mastodon account or a public write up. I'll DM him and let him know you're interested.

2025-04-30 18:48:37 GMT

From the department of head scratches comes this counterintuitive news: Microsoft says it has no plans to change a remote login protocol in Windows that allows people to log in to machines using passwords that have been revoked.
https://arstechnica.com/security/2025/04/windows-rdp-lets-you-log-in-using-revoked-passwords-microsoft-is-ok-with-that/

2025-04-25 21:04:37 GMT

Researchers at HiddenLayer have developed a prompt injection that successfully bypasses instruction hierarchy and safety guardrails across ChatGPT, Gemini, Copilot, Claude, Llama, DeepSeek. Qwen, and Mixtral. It bypasses
model alignment and produces outputs that violate AI safety policies. The outputs concern Chemical, Biological, Radiological, and Nuclear; mass violence; self-harm; and system prompt leakage.
I'm still on the fence about whether these sorts of prompt injections are newsworthy. I mean, how valuable the information they yield is already easily found on the Internet. Anybody want to weigh in?
https://hiddenlayer.com/innovation-hub/novel-universal-bypass-for-all-major-llms/

2025-04-25 00:00:56 GMT

PSA for iOS Android users everywhere: it's fine to use biometric authentication to unlock your device. It helps you choose better passwords. So instead of turning fingerprint and face scans off completely, when you find yourself in a less secure environment, simply press the power and volume up buttons simultaneously for a few seconds. On iPhones, your phone will immediately require a password. For Android users, you'll need to click the lockdown button presented on the screen. Then, practice the move a couple times per week each week. #UsableSecurity

2025-04-18 01:18:30 GMT

ICE officers in paramilitary gear appear to be inquiring about the citizenship status of passengers on a Amtrak Empire Builder train. As someone who rides Amtrak a lot, what should I say and do if I'm ever stopped like this?
https://www.havredailynews.com/story/2025/04/17/local/ice-questions-amtrak-passengers-in-havre-about-citizenship/547792.html#

2025-04-11 22:09:49 GMT

- reply

So, send an email or DM that even passes through a Windows machine with Recall turned on and it's screenshotted, swept into OCR, processed by Copilot and stashed away in perpetuity. Recall reminds me a lot of the backdoor the FBI wanted Apple to build. The FBI said it would be safe because only the FBI would have access to it. Apple rightly pointed out that no, something that powerful would inevitably get hacked and abused in ways no one could control. Now, Microsoft is trying to say that the guardrails it has put on Recall will curb any unintended consequences and we're supposed to take that at face value?

2025-04-11 22:01:39 GMT

- reply

People in comments keep saying, oh well, time to move to Linux, as if that somehow insulates them. They forget that even then every interaction their Linux box has with a Windows 11 installation will STILL be compiled into a database that can be abused.

2025-04-11 21:58:39 GMT

Snapshotting and AI processing a screen every 3 seconds. What could possibly go wrong?
https://arstechnica.com/security/2025/04/microsoft-is-putting-privacy-endangering-recall-back-into-windows-11/

2025-04-10 19:38:44 GMT

Yet another aviation accident in the US. WTF is going on here?
https://www.nbcnews.com/news/us-news/plane-5-house-members-clipped-aircraft-taxiway-dcs-reagan-national-air-rcna200692

2025-04-09 17:40:54 GMT

Spammers used OpenAI to generate messages that were unique for each recipient, making it possible to bypass filters and spam 80,000 sites since September. OpenAI said it has disabled the spammers' account. Is there anything more OpenAI could or should be doing to more proactively prevent this kind of thing. Probably not, but I want to ask people with experience in LLM security.
https://www.sentinelone.com/labs/akirabot-ai-powered-bot-bypasses-captchas-spams-websites-at-scale/

2025-04-07 16:12:39 GMT

- reply

@nprofile…0ajr @nprofile…u2fw
Thanks.

2025-04-07 16:11:25 GMT

- reply

@nprofile…5lc3
The problem is someone is using his current account to masqurade as him. Creating a new account from scratch won't stop that.

2025-04-07 15:57:21 GMT

- reply

Reupping this request for help from someone at Facebook to help restore a journalist's hijacked account. As mentioned before, he has sent Facebook a scan of his driver license on multiple occasions and received a reset links, but they always fail to work. Please boost for reach.

2025-04-04 21:10:30 GMT

No, I won't be going to RSA. In fact, I encourage everyone else to stay away. It's not fair to penalize people overseas for not traveling to the US because they don't want to jeopardize their safety. Besides, RSA is a really crappy conference with nearly zilch news value.

2025-04-02 18:06:39 GMT

- reply

Indiana University contacted XiaoFeng Wang in December to ask about a 2017-2018 grant in China that listed Wang as a researcher. [It appears] IU was concerned that Wang failed to properly disclose the funding to the university and in applications for US federal research grants.
https://www.wired.com/story/xiaofeng-wang-indiana-university-research-probe-china/

2025-04-02 07:41:22 GMT

- reply

@nprofile…5lc3
I dunno. I think they were going to provide some sort of explanation or account of what happened (likely whitewashy or handwavy).

2025-04-02 07:37:55 GMT

- reply

@nprofile…5lc3
When I asked Oracle for comment, a PR person responded and offered a comment on the condition I not attribute it in any way to Oracle. When I said no, the PR person said Oracle was declining to comment.
#radicalopacity

2025-04-02 00:42:22 GMT

- reply

Here's the latest on XiaoFeng Wang, the a distinguished computer scientist who was summarily fired on Friday from his tenured position at Indiana University, where he had spent 20 years racking up accolades for his research in cryptography, privacy and cybersecurity. It comes from Alexander Tanford, president of the Bloomington chapter of the AAUP, the union representing IU professors, and colleagues of Wang's.
In February, an anonymous person filed a complaint alleging research misconduct against Wang. "The charge seemed trivial -- that he had failed to properly disclose who was principal investigator on a grant application and had not fully listed all his co-authors on an article," Tanford told me.
On March 13 or 14, IU temporarily suspended Wang, banned him from his office and denied access to his computer, research and data while the investigation continued. This is permitted under IU's research misconduct policy. The reasons, though, aren't publicly known.
On March 28, Provost Rahul Shrivastav informed Wang he was being terminated immediately. Shrivastav provided no reason (he mentioned Wang taking a job at a university in Singapore, but this is permitted and not grounds for dismissal). What's more, policy ACA-52, approved by the IU Board of Trustees, prohibits summarily firing a tenured professor.
Also on March 28, homes that Wang owns in Bloomington and Carmel, Indiana, were raided by the FBI. The FBI says the raids were court approved, but so far no one has seen a warrant. The US Attorney's Office for the Southern District of Indiana will neither confirm nor deny an investigation.
Indiana University has steadfastly refused to provide any reason for the termination or its failure to follow its own policy. Students and fellow faculty remain in the dark. His PhD students are frantically scrambling to find new advisors. One such student learned of Wang's firing only a few weeks before his PhD defense.
I reached out to Wang's attorneys 24 hours ago, and still haven't heard back.
We really need answers here. IU is tarnishing its reputation for academic independence. The lack of transparency here, both by IU and the FBI, truly sucks.
https://arstechnica.com/security/2025/03/computer-scientist-goes-silent-after-fbi-raid-and-purging-from-university-website/

2025-04-01 18:48:51 GMT

- reply

@nprofile…r26y
That's not correct. "a cloud service" but not Google's. It's a cloud service, or card key, that the organization has an account on.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/264/193/217/758/939/original/faba24d40356f9a2.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/264/193/182/080/826/original/fe03d9481aea190e.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/264/193/237/936/190/original/4b0d45d587d0ce4f.png