The obvious next question is: what features do these apps have in common? Do they share a development platform or ad network? Do they use Firebase or some other diagnostics/debug platform?
Because I suspect that they’re all using some sort of “free” or ad supported component that just happens to be owned by a shell company belonging to either a data broker or a company selling large amounts of data to one.
It’s not in my profile, but if you search my work address, my profile is the single result.
That’s what I do, but they tied my work email to my LinkedIn profile anyway… I keep my personal life offline aside from work and use pseudonyms on systems like this, so they aren’t linking the rest of my life, but they didn’t have any issues tying down my professional identity.
Just a warning that LinkedIn and the like try to link your private and corporate information.
So… in the wake of a murder that had nothing to do with drones, AI, hacking OR terrorism, the FBI feels there will be an increase of all four… why?
Or is the murder being called terrorism because it’s made the 1% feel less safe?
As for the means… obviously these are areas the FBI doesn’t feel it currently has under control, where any citizen can leverage the technologies to bypass the FBI’s current defenses.
And the decryption key is stored… where?
Sure, they COULD be using a TPM in the cars and PKI so that having the public key still only lets them encrypt the data and not decrypt it… but in that case, we wouldn’t have this article, because they’d have properly secured the data.
Since they only really value that telemetry in bulk and have to foot the compute bill, I’m pretty confident they don’t actually do that, but instead depend on the S3 bucket and the connections to it being encrypted.
Sure there is. Most people don’t have the hardware handy to do it, but at the end of the day it’s just a computer sending IPv4 traffic through an LTS cellular modem to an S3 bucket.
And if you know your car’s UDID you can probably look it up in said S3 bucket, since it was open to the public.
All you have to do is monitor the network traffic and then scan any AWS subdomains/IPs that pop up.
[edit] this makes me think… it’s not really possible for a secure connection from all of VW’s vehicles to an S3 bucket, is it? Anyone can pull the key from any of the millions of vehicles making the connection. Then they can dump whatever they want into the bucket.
“promoting the unauthorized use of NYC traffic cameras”
Er, I don’t think NYC got me to agree to an EULA to use their cameras? Is there some bylaw stating that I’m not allowed to be filmed by their cameras AND look at the footage?
I’m at 15.9 bits of info and an almost fully unique browser. Of course, that uniqueness changes every time and they don’t test for that.
I’m on iOS.
The main defense against VPN timing attacks is to ensure your VPN exit node isn’t somewhere that the same person would have access to as your connecting IP.
That said, if someone runs a website or service where you have a unique login or custom token and they have access to your ISP’s connection logs… a standard VPN will once again give you away. This is why TOR exists.
I generally argue that an exit VPN doesn’t really provide much privacy; the only real services it provides are georelocation and protection against low effort bulk filtering (eg, identifying torrenters or bulk metadata collection).
For everything else, either encryption and third party DNS is enough, or the exit VPN isn’t enough to stop targeted surveillance.
That’s the official dev board. You can build a router with that, but most people don’t build their routers up from components.
GL-iNet definitely predates it though.
Unconvincing to whom? That campaign did an amazing job of equating copyright to property ownership for an entire generation.
It’s not accurate, but I think we’ve seen that it can be very convincing for most people.
As the days go by….
Who says that was me?
I try to blend in and avoid posting my main privacy activities in public.
Despite what they say, while obfuscation may not be secure, it sure helps with privacy.
The US already does that :D
One clarification: carrier towers can still find a phone; GPS is passive; your phone locates itself in relation to the GPS satellites.
Most phones are also broadcasting WiFi MAC IDs and Bluetooth MACs, plus hardware and capability strings over Bluetooth. And then any apps you’ve got loaded may also be calling home with your location unless you have that disabled and rotate your ad ID regularly.
[edit] also worth pointing out that even if you turn a smartphone “off” it still pings the local cell towers with its IMEI regularly. Surprised me the first time I witnessed that.
I think you may be missing his real point: he’s asking people to stop sending anonymous non-attributed emails, as he deletes those.
I do the same; it’s not a proton/gmail/etc. thing, it’s a “did you say who you are in the mail” thing. He then points out that most of these anonymous messages are coming from protonmail/gmail accounts.
He’s essentially saying he doesn’t want anonymous tips/feedback. Nothing to do with the delivery service.