• 0 Posts
  • 143 Comments
Joined 9 months ago
cake
Cake day: February 10th, 2025

help-circle

  • I do wonder though if the targeted advertising ban on under 17’s would push websites to do age verification like so many other places are doing

    I don’t think it would be needed. The advertisers Google knows with a strong statistical certainty which age bracket you’re in. It would be illegal to target that market segment.






  • Apple calls two different things ‘Find My Phone’, the phone’s location tracking of itself and then there’s the entire network of Apple devices across the world that constantly monitor for the AirTag’s Bluetooth Low Energy beacons allowing you to find the AirTags (and any attached valuables) anywhere in the world.

    There are many things that let you ask your phone where it is (or have it report it’s location to a server that you host).

    There is nothing that matches the worldwide network of Apple devices which are listening for your airtag’s BLE beacon.




  • I can’t imagine how such a system would work and also be privacy friendly.

    The tags are picked up by other people’s phones and reported to a central service. The nature of the reported information unavoidably gives private data like your location to the owner of the service. You could technically build your own network, but you’d have limited users so it wouldn’t have the reach of the AirTag network.

    Find my Phone software could work in a self-hosted/privacy friendly environment. You’d just need an app that reports its location to a server that you’re running. Something like this: https://github.com/LINKIWI/orion-server which seems to use MQTT to periodically report the phone’s position information to your own server.




  • I vaguely remember getting into a WPA network (that I owned!) using kismet about 15 years ago with relative ease, but I’m struggling to remember details about that process.

    The 4-way handshake crack was the only key recovery attack until 2018 when the PMKID-based attack was discovered (here: https://hashcat.net/forum/thread-7717.html). The PMKID crack attack still required brute-forcing the key, but it didn’t require the 4-way handshake so you didn’t have to depend on a de-authentication attack to get started.

    At that time there was another WPA vulnerability, if you were using WPA-TKIP, but it only allowed sending a few small packets every 10-12 minutes so it wouldn’t allow you to gain access to the network.

    Later there were a few WPS-based attacks but they were slow (4 hours to recover the WPS PIN) and/or limited to specific manufacturers (weak hardware random number generation).







  • It’s almost certainly some traffic analytics package for the website.

    They sound good in their marketing, they provide a bunch of useful statistics about visitors so the site can be tweaked for ease of access or to lower bounce rate.

    The downside is that they often have rights to that data under their TOS because aggregation of data from multiple sites is how they provide a service.

    The concern is that this data can be used to locate individual people and to learn of their associated identities. This is true even if they claim the data is “anonymized”, it’s a trivially simple process to use a second data set to correlate details and deanonymize the data.


  • It was said in a Discord chat. Discord chats are not private, you agree to that in the TOS when you sign up.

    There are always people monitoring the chats, voice and video, looking for illegal activities. Something was said in that conversation that their algorithm flagged for human review and that person sent it to law enforcement.

    You have zero privacy on any social media. Everything that you write is viewable by the service owner and they actively look for things to report to law enforcement.

    Companies pay lip service to your privacy, but at the end of the day they’ll turn you in the instant it suits them. If you want privacy, you use encryption so that your privacy is guaranteed by mathematics.