IT Guy retweeted
When you reject tracking while shopping online, you expect that decision to shape what happens next. France’s CNIL identified a gap between choice and behaviour in its September 2025 SHEIN decision, which described cookies placed before consent and problems with refusal and or imposed a €150 million fine over those practices.
The case gives product teams a reason to examine the journey after a choice, including later pages and connected features. A clearly labelled button is only useful when the behaviour behind it respects the decision it offers. Explore how Prynoid tests privacy claims against application behaviour, with findings reviewed by experts and their limits explained.
prynoid.com/services/priva…
Source: cnil.fr/en/cookies-pla…
The case gives product teams a reason to examine the journey after a choice, including later pages and connected features. A clearly labelled button is only useful when the behaviour behind it respects the decision it offers. Explore how Prynoid tests privacy claims against application behaviour, with findings reviewed by experts and their limits explained.
prynoid.com/services/priva…
Source: cnil.fr/en/cookies-pla…
0
1
2
242
A startup co-founded by Gavin Kliger, former Pentagon chief data officer,staffers just broke into Anthropic’s internal systems in under 12 hours.
AI agents. third-party software. employee salaries, job offers, meeting transcripts, Slack messages about advanced models.
Anthropic says the scope was “limited.”
Cathedral says they kept access “to the absolute minimum.”
the startup is valued at $1.4 billion.
three federal agencies are already their clients.
Kliger was involved in the Pentagon’s dispute with Anthropic over Claude’s military use restrictions specifically Anthropic’s refusal to allow fully autonomous lethal operations and mass domestic surveillance. On September 25, a federal appeals court ruled the Pentagon could exclude Anthropic from its supply chain, three federal agencies are already contracted with Cathedral.
a DOGE-connected startup, valued at $1.4B, with federal agency contracts, run by someone directly involved in the Pentagon’s clash with Anthropic ran a security test against Anthropic and published findings suggesting access to sensitive internal data.
AI agents. third-party software. employee salaries, job offers, meeting transcripts, Slack messages about advanced models.
Anthropic says the scope was “limited.”
Cathedral says they kept access “to the absolute minimum.”
the startup is valued at $1.4 billion.
three federal agencies are already their clients.
Kliger was involved in the Pentagon’s dispute with Anthropic over Claude’s military use restrictions specifically Anthropic’s refusal to allow fully autonomous lethal operations and mass domestic surveillance. On September 25, a federal appeals court ruled the Pentagon could exclude Anthropic from its supply chain, three federal agencies are already contracted with Cathedral.
a DOGE-connected startup, valued at $1.4B, with federal agency contracts, run by someone directly involved in the Pentagon’s clash with Anthropic ran a security test against Anthropic and published findings suggesting access to sensitive internal data.
BREAKING: AI cybersecurity startup founded by ex-DOGE staffers breaches Anthropic's internal systems in under 12 hours using AI agents, accessing sensitive employee data & Slack messages.
6
13
77
3,630
The UK just opened an AI biosecurity lab to defend against biological threats.
OpenAI: £100M in model credits.
Anthropic: up to £100M in model credits plus dedicated technical support
Google DeepMind: frontier model access.
UK government: £100M cash.
The companies helping build AI that could accelerate bioweapon design are now also the companies being paid in credits to defend against it.
💀
OpenAI: £100M in model credits.
Anthropic: up to £100M in model credits plus dedicated technical support
Google DeepMind: frontier model access.
UK government: £100M cash.
The companies helping build AI that could accelerate bioweapon design are now also the companies being paid in credits to defend against it.
💀
JUST IN: UK unveils new AI biosecurity lab supported by OpenAI, Anthropic, & Google DeepMind, with up to £200 million in AI model credits to help combat biological threats.
1
8
36
1,420
Block, jack dorsey’s company just released Dessa, a full-duplex voice AI model trained entirely on human speech.
Most voice AI today generates text first, then converts it to speech which is why it sounds slightly off. Dessa skips that step. speech in, speech out. emotion built in. it laughs. it pauses. it cries.
full-duplex means it talks and listens simultaneously actual conversation, not turn-based.
it runs locally on a MacBook M4 Max or better.
Block trained it on a single NVIDIA GPU rack, which is notable given what comparable models have cost to build. it’s not publicly available yet. Block has asked safety researchers to test it first their own blog describes current voice AI as "potentially dangerous” because it can’t hear how users feel.
To be honest the fraud implications are obvious. a model this human-sounding, running locally, with no API to monitor mannn the scam call industry just got a significant upgrade.
Most voice AI today generates text first, then converts it to speech which is why it sounds slightly off. Dessa skips that step. speech in, speech out. emotion built in. it laughs. it pauses. it cries.
full-duplex means it talks and listens simultaneously actual conversation, not turn-based.
it runs locally on a MacBook M4 Max or better.
Block trained it on a single NVIDIA GPU rack, which is notable given what comparable models have cost to build. it’s not publicly available yet. Block has asked safety researchers to test it first their own blog describes current voice AI as "potentially dangerous” because it can’t hear how users feel.
To be honest the fraud implications are obvious. a model this human-sounding, running locally, with no API to monitor mannn the scam call industry just got a significant upgrade.
JUST IN: Jack Dorsey's Block launches “Dessa,” an AI voice model trained entirely on speech that he says is small enough to run on a MacBook.
9
11
81
3,858
Binary Ninja researcher Xusheng Li just published a report of multiple encrypted USB drives. The results are bad.
SecZure (YutianDun): the drive claims to block copying, screenshots and printing of its protected files. what it doesn’t mention: two hidden built-in accounts exist er / 123456
— System / SECZURE.COM
both accounts decrypt the same file key as the administrator password. your password protects nothing. anyone with these credentials which are now public can open your files. Li found them by tracing the login flow with time-travel debugging: the drive was logging into the Buffer account in the background before the user even entered their password.
on top of that: the encryption itself is weak. keys derived from MD5 instead of a slow KDF. effective key length capped at 64 bits. not a product designed to survive scrutiny.
Netac FileLock: Li fed the binary to OpenAI Codex via Binary Ninja’s MCP server with a single prompt. Codex found the flaw in 7 minutes: AES-256 initialized with a fixed 32-byte key hardcoded in the executable. the user password was checked separately and had no effect on the encryption key whatsoever. files were decryptable by anyone, password or not. also: Netac was writing user passwords into diagnostic logs.
two other drives analyzed: KakaSoft and Nexcopy Copy Secure also fell. KakaSoft’s Highest encryption was broken in 26 minutes. Nexcopy in 10.
Software-based encryption on consumer USB drives has a systemic trust problem. if the firmware controls the keys, the firmware can always have a second set.
SecZure (YutianDun): the drive claims to block copying, screenshots and printing of its protected files. what it doesn’t mention: two hidden built-in accounts exist er / 123456
— System / SECZURE.COM
both accounts decrypt the same file key as the administrator password. your password protects nothing. anyone with these credentials which are now public can open your files. Li found them by tracing the login flow with time-travel debugging: the drive was logging into the Buffer account in the background before the user even entered their password.
on top of that: the encryption itself is weak. keys derived from MD5 instead of a slow KDF. effective key length capped at 64 bits. not a product designed to survive scrutiny.
Netac FileLock: Li fed the binary to OpenAI Codex via Binary Ninja’s MCP server with a single prompt. Codex found the flaw in 7 minutes: AES-256 initialized with a fixed 32-byte key hardcoded in the executable. the user password was checked separately and had no effect on the encryption key whatsoever. files were decryptable by anyone, password or not. also: Netac was writing user passwords into diagnostic logs.
two other drives analyzed: KakaSoft and Nexcopy Copy Secure also fell. KakaSoft’s Highest encryption was broken in 26 minutes. Nexcopy in 10.
Software-based encryption on consumer USB drives has a systemic trust problem. if the firmware controls the keys, the firmware can always have a second set.
4
4
41
2,905
Most apps say they respect your privacy. Few get tested on it.
@Prynoid checks what products actually do vs what they promise. AI, apps, browsers, SDKs, consent flows. Expert-reviewed evidence.
Building something? Get it tested before someone else does: prynoid.com
0
0
2
398
Cornell just terminated its flock contract and ordered all cameras off campus due to privacy concerns and unease over law enforcement access to vehicle tracking data.
ithaca already did it. tompkins county did it. trumansburg did it. cayuga heights did it.
The researcher who exposed flock’s full 335,000-device network had it taken down via trademark complaint.
Proton put it back up.
the cameras are coming down one by one looks like flock’s legal team is running out of tricks.
ithaca already did it. tompkins county did it. trumansburg did it. cayuga heights did it.
The researcher who exposed flock’s full 335,000-device network had it taken down via trademark complaint.
Proton put it back up.
the cameras are coming down one by one looks like flock’s legal team is running out of tricks.
JUST IN: Cornell University terminates its contract with Flock Safety & orders the removal of all Flock cameras from campus.
2
17
121
3,189
Most apps say they respect your privacy. Few get tested on it.
@Prynoid checks what products actually do vs what they promise. AI, apps, browsers, SDKs, consent flows. Expert-reviewed evidence.
Building something? Get it tested before someone else does: prynoid.com
0
1
0
451
researcher @log4j just published a teardown of samsung’s TV sensor telemetry. Here’s what the logs show.
samsung TVs without a built-in microphone look for connected devices that have one soundbars, bluetooth speakers, anything paired. They use that mic instead.
the audio isn’t sent raw. it’s classified first. the telemetry path includes named event types:
— EV201/SOUNDSENSOR_ON: logs dog-barking and baby-crying counters
— EV101/LIGHTSENSOR_ON: software flag for ambient light state
— EV301/CAMERASENOR_ON: camera-state and notification fields
— EV302/CAMERASENSOR_OFF: camera streaming duration
the data is formatted as key=value pairs and logged to lcprd1.samsungcloudsolution.net/openapi/log/24… with deviceid=1.
it’s not recovering unique identifiers per device — the ID mode is configured but the module prefix and runtime policy still need independent verification.
what is confirmed: samsung’s TVs are classifying ambient audio including whether a dog is barking or a baby is crying in your home and reporting event counts back to samsung servers.
there’s no wake word these are passive environmental audio events being counted and logged.
samsung TVs without a built-in microphone look for connected devices that have one soundbars, bluetooth speakers, anything paired. They use that mic instead.
the audio isn’t sent raw. it’s classified first. the telemetry path includes named event types:
— EV201/SOUNDSENSOR_ON: logs dog-barking and baby-crying counters
— EV101/LIGHTSENSOR_ON: software flag for ambient light state
— EV301/CAMERASENOR_ON: camera-state and notification fields
— EV302/CAMERASENSOR_OFF: camera streaming duration
the data is formatted as key=value pairs and logged to lcprd1.samsungcloudsolution.net/openapi/log/24… with deviceid=1.
it’s not recovering unique identifiers per device — the ID mode is configured but the module prefix and runtime policy still need independent verification.
what is confirmed: samsung’s TVs are classifying ambient audio including whether a dog is barking or a baby is crying in your home and reporting event counts back to samsung servers.
there’s no wake word these are passive environmental audio events being counted and logged.
turns out it classifies what audio it hears, before reporting back to samsung.
sensor preferences, dog-barking and baby-crying event counters, and camera streaming duration are built into telemetry paths.
9
169
973
32,656
Most apps say they respect your privacy. Few get tested on it.
@Prynoid checks what products actually do vs what they promise. AI, apps, browsers, SDKs, consent flows. Expert-reviewed evidence.
Building something? Get it tested before someone else does: prynoid.com
0
0
0
398
John kiriakou spent 14 years at the CIA, ran counterterrorist operations in pakistan after 9/11, and later went to prison for exposing the agency’s torture program.
he was asked by LADbible whether the CIA can listen through phone and laptop cameras: "yes."
To be honest this isn’t new. In 2017, WikiLeaks published Vault 7, the largest leak of CIA documents in history. It detailed tools the agency used to compromise iPhones, android devices, smart TVs and more.
One tool was called Weeping Angel. it targeted samsung smart TVs. It put the TV into a fake off state, screen goes dark, mic stays live, audio streams to CIA servers.
the CIA declined to confirm the documents’ authenticity. They are legally barred from conducting surveillance on american citizens, a rule that has historically not prevented surveillance of american citizens.
So kiriakou’s Yes is a confirmation of what the documents already showed the tools exist and they’ve existed for years.
We all knew they had thecapabilities.
he was asked by LADbible whether the CIA can listen through phone and laptop cameras: "yes."
To be honest this isn’t new. In 2017, WikiLeaks published Vault 7, the largest leak of CIA documents in history. It detailed tools the agency used to compromise iPhones, android devices, smart TVs and more.
One tool was called Weeping Angel. it targeted samsung smart TVs. It put the TV into a fake off state, screen goes dark, mic stays live, audio streams to CIA servers.
the CIA declined to confirm the documents’ authenticity. They are legally barred from conducting surveillance on american citizens, a rule that has historically not prevented surveillance of american citizens.
So kiriakou’s Yes is a confirmation of what the documents already showed the tools exist and they’ve existed for years.
We all knew they had thecapabilities.
Former CIA officer John Kiriakou says the agency has tools capable of turning phones, laptop cameras and even smart TVs into surveillance devices.
10
30
221
6,807
IT Guy retweeted
Most apps say they respect your privacy. Few get tested on it.
@Prynoid checks what products actually do vs what they promise. AI, apps, browsers, SDKs, consent flows. Expert-reviewed evidence.
Building something? Get it tested before someone else does: prynoid.com
@Prynoid checks what products actually do vs what they promise. AI, apps, browsers, SDKs, consent flows. Expert-reviewed evidence.
Building something? Get it tested before someone else does: prynoid.com
0
2
5
1,490
In november 2025, security researcher joshua michael found that flock's servers were exposing an access token available to anyone. He used it to pull a full inventory of device locations, reported it to flock, and published the data in december.
335,701 flock-associated devices. 00+ secondary hardware units. 27,000 acoustic detection systems. 49 states.
flock publicly claims roughly half that number.
Flock's response: fix the token quietly, tell customers michael was a "malicious actor," notify law enforcement, and send a cease-and-desist. their own customer email acknowledged they found no indication of unauthorized access when they closed the issue which michael says is exactly the problem. someone could have taken everything and they'd never know.
then in september, a brand-protection firm filed a trademark complaint on flock's behalf not on accuracy grounds (they never disputed the data), but arguing the site could cause "customer confusion."
the site came down.
proton stepped in, hosted the map on swiss servers, and published a statement from their head of legal: "this is an attempt to suppress information, not to prevent consumer confusion."
the map is live at proton.me/flock-camera-m…. enter your zip code. see what's watching your street.
flock cameras log 20 billion vehicle sightings a month. a washington post investigation found 50 officers accused of misusing license plate readers, 46 of those cases involved flock. the CEO, when asked how many police contracts had been suspended over abuse, declined to answer.
You weren't supposed to know how many cameras there are. now you do.
335,701 flock-associated devices. 00+ secondary hardware units. 27,000 acoustic detection systems. 49 states.
flock publicly claims roughly half that number.
Flock's response: fix the token quietly, tell customers michael was a "malicious actor," notify law enforcement, and send a cease-and-desist. their own customer email acknowledged they found no indication of unauthorized access when they closed the issue which michael says is exactly the problem. someone could have taken everything and they'd never know.
then in september, a brand-protection firm filed a trademark complaint on flock's behalf not on accuracy grounds (they never disputed the data), but arguing the site could cause "customer confusion."
the site came down.
proton stepped in, hosted the map on swiss servers, and published a statement from their head of legal: "this is an attempt to suppress information, not to prevent consumer confusion."
the map is live at proton.me/flock-camera-m…. enter your zip code. see what's watching your street.
flock cameras log 20 billion vehicle sightings a month. a washington post investigation found 50 officers accused of misusing license plate readers, 46 of those cases involved flock. the CEO, when asked how many police contracts had been suspended over abuse, declined to answer.
You weren't supposed to know how many cameras there are. now you do.
7
34
128
3,938
One of the VPNs with a verified no-logs policy you can use is ProtonVPN.
go.getproton.me/aff_ad?campaig…
Use my Proton VPN link above to subscribe. Thank you 😇 .
go.getproton.me/aff_ad?campaig…
Use my Proton VPN link above to subscribe. Thank you 😇 .
0
0
6
557
There’s a popular cybersecurity researcher on this space whose job post I shared with a mutual, who completed the work but hasn’t been paid.
Honestly I respect their work, but I’d like to understand what‘s going on. I’ll be asking questions.
Stay tuned.
Honestly I respect their work, but I’d like to understand what‘s going on. I’ll be asking questions.
Stay tuned.
0
2
49
2,656
getty images spent years watermarking every photo on the internet.
sued stability AI for training on their library. demanded the AI companies pay up. called it theft.
filed for chapter 11 bankruptcy this week.
the AI companies didn't pay. they just... kept going and designers otos. and the $500 licensing fees stopped making sense when midjourney exists. and the debt piled up.
a company whose entire business model was "we own the visual record of human history, pay us" just got outrun by a model that learned from that record and started giving it away for free.
The irony is that the watermark is still on every image in the archive.
even the ones nobody's licensing anymore.
sued stability AI for training on their library. demanded the AI companies pay up. called it theft.
filed for chapter 11 bankruptcy this week.
the AI companies didn't pay. they just... kept going and designers otos. and the $500 licensing fees stopped making sense when midjourney exists. and the debt piled up.
a company whose entire business model was "we own the visual record of human history, pay us" just got outrun by a model that learned from that record and started giving it away for free.
The irony is that the watermark is still on every image in the archive.
even the ones nobody's licensing anymore.
JUST IN: Getty Images files for Chapter 11 bankruptcy after struggling with mounting debt & growing competition from AI-generated images.
294
1,398
15,645
1,191,258
When post-quantum breaks RSA.
Banks freezing transactions because they can't verify anything. Certificate authorities gone dark. Every HTTPS padlock meaningless, governments pulling sites offline.
VPN useless, Your 2FA app secret is exposed. Every password manager vault encrypted before that day becomes an open file.
IT teams will get alerts at 3am with an incident they cannot close.
And somewhere in a signals intelligence archive, a decade of harvested ciphertext quietly becomes readable.
the PHP situation gave us the preview, two vulns, CVSS 9.2, governments took entire websites offline just to stay safe and update.
When there is no patch watch what happens.
Banks freezing transactions because they can't verify anything. Certificate authorities gone dark. Every HTTPS padlock meaningless, governments pulling sites offline.
VPN useless, Your 2FA app secret is exposed. Every password manager vault encrypted before that day becomes an open file.
IT teams will get alerts at 3am with an incident they cannot close.
And somewhere in a signals intelligence archive, a decade of harvested ciphertext quietly becomes readable.
the PHP situation gave us the preview, two vulns, CVSS 9.2, governments took entire websites offline just to stay safe and update.
When there is no patch watch what happens.
This PHP vulnerabilities are crazy. Gives us a glimpse of how it will all go down when our current encryption systems finally gets cracked.
38
181
1,061
50,267
A welsh broadband company left a test account called Test2 sitting live since 2012.
password: Password1
14 years later, ransomware walks in, takes 42GB of children’s data dating back to 2012, encrypts 182GB, and leaves.
the ICO issued a reprimand.
No fine. A letter.
password: Password1
14 years later, ransomware walks in, takes 42GB of children’s data dating back to 2012, encrypts 182GB, and leaves.
the ICO issued a reprimand.
No fine. A letter.
BREAKING: Hackers steal personal data of thousands of children after a UK company was breached using the password “Password1" — which had remained unchanged for 12 years.
5
10
103
2,598