• 0 Posts
  • 35 Comments
Joined 1 year ago
cake
Cake day: June 1st, 2023

help-circle
  • https://www.bleepingcomputer.com/news/security/genetics-firm-23andme-says-user-data-stolen-in-credential-stuffing-attack/

    The information that has been exposed from this incident includes full names, usernames, profile photos, sex, date of birth, genetic ancestry results, and geographical location.

    The threat actor accessed a small number of 23andMe accounts and then scraped the data of their DNA Relative matches, which shows how opting into a feature can have unexpected privacy consequences.

    • Usernames Profile Photos DoB

    They can be linked to other online accounts. This allows for phishing, potentially scamming or getting additonal information on them which can lead to more sophisticated/personalised scams. Older, less tech savvy users are better targets for scammers.

    • Username Sex DoB Genetic Ancestry Location data

    Data aggregators can sell this info to Health Insurance Companies or any other system who can then discriminate based on genes sex age or location

    • All of this information

    Can contribute to people committing fraud with their information if they collect enough information from different sources.

    • DNA relatives

    Having enough information about a user to use it to target their now known relatives in personalised scams.

    The people that did this probably didn’t know what information they were going to get, maybe they were hoping for payment info, and settled for trying to just sell what they got.

    Any information, no matter how useless it might seem, is better than no information and enough useless information in the wrong hands can be very valuable.

    Theres countless data breaches every year and people will collect it all and link different accounts from different breaches until they have enough information. Most people use the same email address for every website and a lot of people reuse the same passwords, which is how this data leak occurred. Knowing that these users reuse the same email/password combination here means theres a very good chance they’ve reused it elsewhere.

    You can check out what data breeches have occured and if your email or password has been posted in any of these dumps here https://haveibeenpwned.com/

    Once the information is out there, its out there for good and what might seem trivial now to you could be valuable tomorrow to someone else



  • For me the issue here is, why put so much time and energy into basically rebranding an LLM. I’ve seen LLMs running on RPi and android phones. Why not write a blog post showing how to run LLMs locally with existing tools for the best privacy instead and put more focus on their existing services. It just seems like they’re jumping on the AI bandwagon and charging a premium for an already freely available LLM.

    I see some benefits of AI like quality tts when using OSM and stt when transcribing/translating audio but other things like Googles AI answers and Microsofts Copilot leave me scratching my head wondering why consumer would want this




  • Every few months I like to clear out my password manager of any accounts I don’t need anymore, usually just throwaway emails aliases.

    I’ll usually attempt to log into any services that I know I’ve deleted/requested to delete to make sure they’re not accessible anymore and so far I haven’t been able to log in to any of them so I can only assume my requests are working.

    I suppose if a service had a data breach, after my information was meant to be deleted, and I found my information there then I’d make a complaint to my regulator about not deleting my data. I would have proof of my request and their acknowledgement of the request so it’d be pretty silly of them not to delete it after saying they did

    I rarely use anything but email aliases and fake information anyway and I never let online retailers save my card information. And if my address in on my account I change it to P. Sherman 42 Wallabyway Sydney before I delete/request to delete my account.


  • I spend too much time reading emails so I try to keep mine short, especially when they’re going to a generic email like support or privacy.

    https://gdpr.eu/right-to-be-forgotten/

    The GDPR does not specify what a valid request to erasure entails. An individual can make a request for erasure verbally or in writing. This request can also be made to any member of your organization, not just to a designated contact. As long as a request meets the conditions above, it is valid, even if it does not refer to “Request for Erasure” the “Right to be Forgotten,” Article 17, or the GDPR.

    There’s no template to follow for a request. Once GDPR is mentioned, they usually just email back saying that they’re doing it or its done.

    I haven’t come across any difficult companies but I’ve heard some make it as hard as possible and follow the Erasure Request form template in the link above and ask for proof of I.D etc


  • I usually just write

    Hi,

    Please delete my account and all data associated with this email in accordance with Article 17 of GDPR, I’m an EU citizen

    Thanks x

    I just assume if they haven’t made it easy to delete your account by now then they never will but these are really good points that will hopefully make companies change their policies, especially since its all things that benefit them



  • The “media network” is https://kinectivemedia.com/ and they have a link for US customers to opt out that leads to here https://uniteddigital.iad1.qualtrics.com/jfe/form/SV_88OQmAbr20oeHn8 but of course you’re going to want to also read Qualtrics privacy policy before using their services https://www.qualtrics.com/privacy-statement/

    Clicking https://kinectivemedia.com/ privacy policy links to https://www.united.com/en/us/fly/customer-data-privacy-policy.html

    They collect the usual stuff you use for travel like name, address, payment details, biometrics, I.D etc and also

    Information collected in your use of our mobile application(s) includes, but is not limited to:

    • With your consent, your pinpointed physical location information from technologies like GPS, Wi-Fi, or cell tower proximity (geo-location tracking)
    • With your consent, while at or near certain airports in the U.S., your pinpointed physical location will be tracked continuously to provide you location-based offers, services and other information. For more information, see the Location Services FAQ located on the side menu of the United App;
    • Your domain name;
    • Device ID or alternative ID where required by the platform provider;
    • Electronic data concerning operating systems and computing devices/browser, including types;
    • Features you use and links you click;
    • Amount of time spent in the application;
    • Installs and uninstalls;
    • Transaction details and history.

    We may combine this information with information that we already have collected about you.

    We collect information about you from third parties. If you make a reservation through a travel agent, we will obtain your travel information from that agent. We may also obtain information about you from our marketing partners, advertisers and other third parties.

    We primarily use your information, including personal information, to provide our services to you and to fulfill your requests. In certain circumstances, such as for advertising purposes, we combine your information with other information that we have about you, that is publicly available and/or that we have obtained from third parties (either individually or in the aggregate)

    We also use your information for the following purposes:

    For marketing and advertising. United uses your information, consistent with applicable law, individually, in the aggregate, and/or combined with demographic information that we maintain or collect from third parties, for marketing and advertising purposes (via email, direct mail, telephone, web or other electronic advertising) and to send you news and newsletters. Specifically, information that we collect about you may be used to send you email, direct mail, or telephone communications about offers from United, its partners or other third parties, that might be of interest to you (please see the section on Disclosing your information below and the section on Changing your marketing preferences below). We also use your information to determine appropriate advertising channels and venues and to place ads on such channels and venues, including placing advertising on social networking sites.

    I’m sure the money they make from this will subsidies flight costs that will be passed on to the end user for cheaper flight!


  • Ha, we’ve been doing the same thing for the past few months! I just made a generic Immich account that we all log into and upload to that. I auto backup the library to other places as we go, just in case. Once we’re done, we’ll all get copies of the directory to do with as we please.

    I have Immich set up to keep the name of the files instead of giving them a random name. As we scan we name the files with the peoples names and generic tags like Tom.Mary.Birthday.1992 and putting Mary before birthday indicates that it was Mary’s birthday. So that if I decide to try and add meta data to the files it will be easier.

    I haven’t figured out a plan for adding meta info to the files so they at least have the year/month they were taken and I don’t know if I even want to since we’re 1000’s of photos in now


  • Yeah, carrier unlock and OEM unlock are completely separate and have nothing to do with each other. People will say ‘unlocked’ and mean carrier unlocked because most people don’t know what OEM unlocking is so it can get really confusing when trying to buy second hand and explaining the difference. Its a really common misconception that has been an issue for over a decade that’s why I always try to explain they have nothing to do with each other

    I don’t know any other carriers that do this but I wouldn’t be surprised if more did. I never recommend buying from a carrier since most just carrier lock their phones anyway so its just more hassle if you decide to switch carriers.

    I find buying from the manufacturer works out cheaper than from any carrier where I am. Its also better for privacy since I don’t have to deal with bill pay and can just pay cash for PAYG without giving any personal information and can switch to whoever has the best deal without faffing about, just get a new Sim card and I’m ready to go


  • OEM unlocking is not the same as carrier unlocking

    Carrier unlocking is to allow you to use your phone with a different network e.g switching from Verizon to T-Mobile and putting a T-Mobile Sim in the Verizon phone. This can be done with both Android and iOS

    OEM unlocking is an Android setting that enables the end user to modify the firmware of the device e.g unlocking the boot loader, installing custom boot images, ROMs and gaining root access.

    AFAIK both T-Mobile and Verizon have custom Android settings that completely grey out the OEM unlock option in Android settings. There is no way around this as an end user, even if you had got customer support to carrier unlock your phone it would have made no difference, OEM unlocking would still be disabled.

    AFAIK There is no way around this and the only solution is to never buy from either carrier.

    I bought a refurbished Pixel a few years ago from the Netherlands and it ended up being originally from Verizon, I found a Verizon system app still preinstalled in settings and it was impossible it enable OEM unlocking.

    Either buy directly from Google or buy second hand on the condition that you can check to make sure OEM unlocking is possible before purchase




  • All my drives are encrypted and have an encrypted backup of 2FA, a whole bunch of drives and my phone would all have to fail at the same time. This is following 3-2-1 so not all are in the same place or running at the same time

    I use veracrypt to make encrypted portable files that contain 2FA and I back them up to random cloud storage using simplelogin email accounts, no 2FA on these for this exact reason. I know my password manager passphrase but I also do the same thing with it as the 2FA file just on a different account.

    If any of the accounts gets hijacked then all they have is a throwaway email and password for that account and a random tiny encrypted file.

    My codes aren’t labeled with the email that they are for, just the service, e.g Proton1, and the passphrase has no other information stored with it so even if they magically managed to decrypt either of the files and gain access to the codes/ passphrase they don’t have any idea what accounts any of them are for.

    Log in to a cloud storage -> download the file -> decrypt it -> add it to any compatible app -> login to the password manager



  • I’ve been deGoogled for years, the battery saving was probably from not having Gapps running in the background, I know that Googles and Co are constantly phoning home but to say that they are turning on peoples mics and either running a service locally to transcribe the audio or sending whole audio files to themselves for marketing is unsubstantiated and a bit ridiculous, there’s way easier ways to profile users through behavior analysis on their phones whether it be what apps and how long they use them or what posts/ ads user either scroll past slower or actually tap on.

    There’s a very obvious difference between a few kilobits of text and a few megabits of audio and people would easily see if megabits of data were constantly being sent to from their phones every day

    Why waste so much energy and bandwidth trying to figure out what the mic picks up when the majority of it would be inaudible because of background noise or phones being in peoples pockets/bags when they can glean so much more data from how a user interacts with their phone for so much cheaper


  • Facebook isn’t randomly turning on your microphone to sell you more targeted ads, as some conspiracy theories have asserted

    the company admitted that it had been employing third-party contractors to transcribe the audio messages that users exchanged on its Messenger app.

    They’re using data that people sent to their servers. If they were turning on peoples mics and sending the recordings to themselves then anyone that monitors their network traffic at all would notice all of that data being uploaded.


  • The amount of battery used and data that your phone would be sending if it was constantly recording and sending the data to Google would be very obvious

    Its more likely that Google and Co have just profiled you really well and or you searched for that specific topic before. Or that topic was an ad that you clicked on in the past or that you slowed down when scrolling to look at

    Newer android version notify you in the top right when your microphone is active and you should also be able to see when the last time, down to the minute, that any app accessed the mic in settings