This week's surveillance report covers three cracks in Apple's armor that users should definitely act on, and I want to make sure you guys know how to proceed forward.
Browsers are quietly getting a little bit less private, a court forcing Google to open the Play Store and that they're not happy with their recent flow, and the usual data breaches, threats, and open source updates.
Welcome, everybody, to the Techlore Surveillance Report, your essential weekly tech news delivering
deep analysis on the latest threats to security, privacy, and digital freedom, and of course,
empowering you to reclaim control and defend your rights.
So the highlight story I'm breaking up into kind of three unique stories, starting with
the first one being this tech radar piece, which I think is quite interesting.
They bring up lots of good points.
Apple has a couple privacy-focused features.
The first one is Apple's iCloud Private Relay. This is essentially their VPN-style feature that
lives inside of Safari. The actual white paper and the methodology behind the feature is very
impressive, but here's the thing. There is a browser called Silo from the security research
team MISC, and they discovered some issues with Private Relay, the first of which was a vulnerability
which involved DNS prefetching, which is a feature designed to speed up browsing, but Safari was
incorrectly resolving domain queries outside that secure proxy tunnel, leaking users' real DNS server.
The second leak is through something called Web Transport, which is a protocol designed to enable
faster communication between the browser and the website. And they found that that exact protocol is
exposing the real user's IP address, even if they had private relay enabled. They also discovered that
the passkey system specifically, which allows passwordless logins, also bypasses the proxy and
reveals users' IP addresses. The second privacy-exclusive feature that was impacted was
Hide My Email, which again is used to hide your email address from different websites. And what's
crazy about this is this was discovered from the founders of Easy Opt Outs. They've been a
recurring sponsor of this podcast, so it's kind of fun to see them discover this issue organically
in the wild. They said that while they were investigating bounce issues to try to figure
out why emails weren't being delivered, they noticed that they were seeing the customer's
real email addresses in addition to their hide my email addresses in the bounce logs.
They reported it to Apple and after a few months of no resolution, they just went to
the media because that was the best way to get things done.
A week after the news came out, they finally got it patched on July 7th.
So those are the two issues.
I thought it was kind of fun that these two people who have privacy based projects actually
were the people who discovered these issues.
So props to the privacy world for figuring these out.
But also the tech radar piece has some really interesting commentary of like, hey,
You know, there are these holes that are starting to open up in Apple's privacy in their ecosystem.
And also the people that discovered these issues, both Murphy from Easy Optouts and also the MISC team,
said that like these issues should have never happened in the first place.
These are pretty embarrassing.
And also Apple's just not taking this seriously.
They seem to wait too long to take actually deal with these issues.
And then it's kind of just leaving their users in the dark.
So when I see security researchers and people who discover these issues all say the same thing,
which is they are unhappy with how Apple deals with these issues, how they respond to them,
and that they don't get them fixed typically in the way that they should until they finally make
a big scene about it and then Apple decides to quietly fix it. That's a real problem. And so I
think that's my biggest concern. And it's something that Apple really needs to figure out if they want
to retain that kind of, I don't know, reputation that they've built up. I mean, Murphy from Easy
Optouts even said, I'm personally a little surprised the hive my email issue ever even
into production. I also think that the private relay issue is something that has been this
recurring issue with Apple that I'm quite annoyed about too, is Apple just clearly does not kind of
care whatsoever about users' IP-based protection. Even if private relay properly tunneled all of
your Safari traffic, why is it only in Safari? Like, why can't they enable it system-wide?
And then even if you get a system-wide VPN, let's say you go with Mullvad or you go with Obscura,
you go with iVPN, Windscribe, Proton, whichever VPN you pick, none of them right now in 2026 can
actually guarantee that 100% of your web traffic on an iPhone actually goes through the VPN tunnel
because Apple still does these random ass exclusions for your web traffic. So this is
something that people don't really know about or think about. And it's something that I think Apple
really needs to take seriously. Apple is trying to sell this idea that we deliver this much privacy
and security to you. And actually, I would say that a lot of it's true. But those little
differences where they actually aren't meeting kind of the marketing that they imply are major
issues, especially for people with higher threat models. Where I push back on TechRadar's coverage
is they say that this is the issue when you just choose one provider to keep you safe.
I don't fully agree with that. I think there are some situations where I'd say there actually is
one provider that can do a few things very well. I think Proton's a good example of this. Tud is a
good example of this. We have some VPN companies that also expand beyond just offering a VPN
provider. I would be making this more of an exclusive Apple issue. I think it almost discounts
the responsibility Apple should be taking if they just say, oh, this is what happens when one company
does, you know, all these privacy things. And it's like, I actually think theoretically,
they can do it right. And it doesn't have to be a compromise. So I actually would like to see a
little bit more blame on Apple here. And what Apple's doing internally, how they're not taking
security researchers seriously. Clearly, their response times are whack. And there's not enough
transparency and disclosure on how they handle this. Now, before moving on to the next story,
just to make it very crystal clear, Apple has not fixed that private relay issue. So if Safari and
your IP address being safe in Safari is something that is a must for you, definitely stop using
private relay. And this is unfortunate because it's a tool that I actually have some appreciation
for and I've used it in the past. But I think in light of this, we should definitely hold off until
there's more information and Apple decides to treat this a little bit more seriously. The hide my email
issue is fixed, though, again, I think it doesn't really fully dismiss maybe the longer term concerns
of how Apple is dealing with these issues. Now, the second story is regarding a vulnerability on
macOS. I'd say this is more of a typical vulnerability that we'll find in different
operating systems and software. But it's a screen sharing bug that let remote hackers log in without
a password. And I think the few takeaways I have to share with you on this one is one,
get yourself updated because Apple already patched it in Tahoe, Sequoia, and Sonoma.
Any computer out there, check your screen sharing setting right now to see if that's enabled. And if
it's not used for anything, turn it off. That's a very easy thing to reduce your attack surface on.
But the macOS firewall opens the port when you enable screen sharing. Routers and dedicated
firewalls generally block the port unless configured to override that setting. So just
check your firewall. The macOS firewall for a lot of people isn't enabled by default. And so this is
another reminder to check your firewall settings in macOS. If you're curious, go into your system
preferences, go to network and then go to firewall and turn that on. And if you have a little bit more
know-how, go ahead and customize it so you can strengthen things a little bit better. And now the
third Apple story I think is actually where Apple shines a little bit better, especially from the
security side of things, which is that Apple has alerted tons of people out there that they are
being targeted by spyware. Some context, if you're new, there are pretty much these, a lot of times
governments, it seems like, but they are using these spyware attacks where they purchase unknown
vulnerabilities for, you know, things like iOS, Android, etc. And they individually target people.
Now, these are typically state-sponsored, and they are typically a lot of money, and it's not
something that is typically, I'm saying typically a lot here, because this isn't the kind of thing I
want just, you know, regular person, a teacher, you know, someone who goes to their small business
in the morning, who is serving, you know, coffee, their cafe, etc. Like, that's not the person who
needs to be worried about this. But what is concerning is that this specific batch of
notifications sent out to people who were targeted, which Apple does do, was higher in number than
normal. So we saw people like iVerify, the cybersecurity firm, and we also saw another
firm called Access Now, who reported that they saw a good significant bump in what they normally get
when people start receiving these notifications. So remember, guys, Hide My Email issue was fixed,
though you can still move to a dedicated aliasing service, which I recommend because that gives you
more ownership regardless. And there's nothing that Hide My Email is doing that's any more privacy
respecting those services. In fact, those services are open source and they have some other benefits
I would say outperform hide my email.
Private Relay is really hard to replicate.
It's actually a really interesting service.
And again, on paper, it's very cool.
But in light of this issue, you should really proceed carefully.
Make sure to update macOS for that vulnerability on macOS and also check your firewall settings.
Enable lockdown mode if you are concerned about those notifications.
And especially if you got one of those, contact some digital rights organizations.
All right, coming soon, we have a judge giving Google one week to fix their anti-competitive
Play Store, and we have France. I actually had some really good news, but before we get there,
we have a quick story on a couple things regarding your browsers that I wanted to flag,
which I think are quite important regarding the privacy of all of your web browsing.
So the first one is that there were hundreds of fake Chrome VPN extensions that route traffic
through a proxy. The specific number was 737 browser extensions that were published on the
official Chrome web store that impersonated well-known VPN and proxy services. These
impersonations impacted things like ProtonVPN, NordVPN, Surfshark ExpressVPN, and even Cloudflare's
1.1.1.1 DNS resolver. What's fascinating is that Google removed more than 200 of the extensions
related to the identified campaign. Over 500 of them, though, at the time of them writing this,
were still available in the Chrome web store. Guys, I continue to say this, and I don't know
how else I can say this to get people just more aware of these issues. Extensions are like crazy
right now. I mean, the Chrome Web Store, all these big tech companies try to come forward and say,
you know, the only safe way to get software is through our app stores because we vet things so
carefully. And then meanwhile, we see stuff like this, or even after they find the issue,
they still haven't actually removed 500 different things that are straight up impersonating
legitimate projects. So it is really bad. I would always, especially the Chrome Web Store,
second guess everything I'm installing. Personally, for me, I almost never install extensions. You
should try to avoid them at all costs just for privacy and security reasons. But if you do need
an extension in your browser, which definitely happens, I'm not saying people should just never
install an extension. But when it happens, go to the official developer's website. So if I'm getting
the ProtonVPN extension, I'm going to ProtonVPN's website and looking for their download extension
button and having it redirect me to the Chrome web store. I'm not going to my search engine where
there could be some search advertisements that takes me to the wrong page. I'm not going to the
Chrome web store and relying on their search, which may or may not actually give me the right thing.
I'm going to the actual website that belongs to the verified developer. And that is a general
thing you should always strive for when you're downloading software. The next story is from
AdGuard, and it's pretty much just a quick announcement that Microsoft Edge is finally
preparing to say goodbye to Manifest V2. So a bit of context here, there is an underlying extension
technology that enables extensions to do things in your browser. Manifest V2 is what we've been
using for a very long time, and it's what's enabled ad blockers and all these wonderful
things that we know and have grown to love. But Manifest V3 is the new version, and while there
are some interesting things that it does. It does a lot to limit things like ad blockers, and it
makes it a little bit more challenging for ad blocker developers to be able to do the same job
they did in v2. They say that there still are some restrictions despite their head start with v3,
which is rule counts are limited. Certain filtering techniques cannot be reproduced exactly,
and most filter updates must still be delivered with the extension itself. Maintaining functionality
close to our MV2 version therefore takes more work, while some improvements may take longer to
reach users. So this is just a heads up. I mean, it's already happened in Google Chrome. Google
Chrome already has, for the most part, largely ruled out MV2. And it's why we see things like
uBlock Origin Lite instead now, which is the MV3 version of uBlock Origin. And this is just to say
that Edge is now following in their footsteps. And so if you want a browser that doesn't do this
and still supports MV2, Firefox has committed to support MV2 kind of indefinitely. I wouldn't
expect these browsers to do it forever, but they still do it. The Brave browser still allows it.
In fact, in the Brave browser settings, if you type manifest, and I'm showing this on screen,
you're going to see a whole section in the Brave browser settings called manifest v2 extensions.
And they literally let you actively enable AdGuard or uBlockOrigin, NoScript or uMatrix in the Brave
browser as the MV2 variants. They actively still support that in the Brave browser. I believe
Vivaldi does as well. And pretty much any other Firefox fork should as well. Pretty much if you're
using a browser that's not from a big tech company, you're still fine. And if you're using a browser
from a big tech company, you're kind of not fine. Coincidence? I think not. All right, guys, we have
a judge giving Google one week to fix their anti-competitive Play Store. And we have France,
which had some really good news. But we have a quick message from our sponsor.
Quick one, go into your email inbox right now and type in unsubscribe. However, many hundreds or
of results you just got, that's how many companies have your real email address. So the moment any of
them gets breached or quietly sells you out, it's your real inbox eating the spam, the trackers,
and the hackers forever. Addy.io is designed to fix this entire problem. The whole idea is you
stop giving out your real email address and instead hand every single site its own alias that just
forwards to the inbox you already have. Think like Apple hide my email, except it's open source and
you can bring it to any email inbox. And my favorite part is that once you get all your
accounts using an email alias, you can always swap the email provider behind the scenes,
like moving from Gmail to a private email provider without needing to update every single account's
email. And it's possible because you're really just putting Addy in front of your email. It's
like your email bodyguard. This also offers a lot of protection. If a site starts to spam you,
or you show up in a data breach, or you realize they sold your data because that one specific
alias suddenly started getting junk, you just deactivate the alias. It's fully open source,
so you're not trusting a black box. And you can even self host the entire thing if you're that
kind of person, which I know many of you are. It's on F Droid, there are browser extensions and
mobile apps so you can spin up a fresh alias right as you're signing up for something. And if you
want to go all in, you can even use it with your own custom alias. It's free to start and they have
a crazy generous free plan to get started. Visit Addiio or just check them out down in the description.
And thank you guys for sponsoring us. Now back to the video.
go. The fun thing about Addy.io sponsoring this is it's actually a really good solution to that
first vulnerability we talked about with Apple, the Hide My vulnerability. So Addy.io is a really
perfect swap in if you use the Hide My ecosystem. Now, the next story here is that a judge has given
Google one week to fix their anti-competitive app store download in Google Play. This has to do with
a story we just recently covered, which is that Google and Epic have this ongoing thing happening,
and Google finally has decided, hey, we're going to allow third-party app stores inside of the
Google Play Store. Now, what's quite fascinating is we have a few things happening at the same time.
We have Google coming forward and making this concept of air quotes, sideloading,
a bit harder to do. You have to go through this advanced flow, you have to activate developer
settings, and then you have to reboot your phone, you have to wait 24 hours, and you have to confirm
that you actually are doing this at your own will. And while they're doing that, they're now making it,
I guess, in theory, possible to get third-party app stores from the Play Store. But that comes
with a lot of kind of caveats. You have to pay to get in there, they have to still let you in there,
and it's kind of Google, in some ways, in my view, still taking a lot more control. Because you have
to go through some confusing menus, the lawyer showed the court that even searching for App Store
and Aptoid, which is the first App Store on there, didn't show the intended results like any other
search. Instead, the Play Store shows an are you looking for banner that links to the third-party
App Store page. They say another problem is the process of actually installing the store. When you
finally get to the page with Aptoid and eventually other stores, there is actually no install button
as you'd get with a normal app or game from the normal store. A view button opens another dialogue
to actually install. They said this additional step was unnecessary and seemed geared towards
discouraging users from downloading alternative stores. He said the button must change to install
instead of view. So that's just one more thing that Google was doing to make it harder. Google's
legal team agreed to make the changes and they gave the company one week noting they should contact
them if there's any problem with that timeline. So it should be a little bit easier. Now, again,
I think that this is maybe winning. Was it winning the battle but losing the war? Is that I think
that's the right order of things, but they're still ultimately making it harder to actually
get these app stores away from the Google Play Store, which has its own problems.
Like, I think, yes, it's good.
You know, we have things going through the Google Play Store, but Google's really still
ultimately kind of winning if they're still requiring people to go through the Google
Play Store.
What happens to users who use custom ROMs who don't want to use the Google Play Store?
How do they get software?
Oh, Google's making that harder and more obnoxious for third-party developers.
So that's still a net loss, right?
So I'm still very kind of mixed on this whole story.
What needs to also be targeted is Google's clamping down of things outside of the Play Store
as they're opening up the Play Store and requiring these third-party app stores to pay them money.
While, again, this is a small win, I'm kind of looking at this overall theme
and trying to figure out how does this impact the broader Android ecosystem,
and is this really fixing those other concerns that I'm kind of watching for?
So keep an eye out on this, and I'll be updating the podcast as more information comes to light.
The next story is genuinely super good news, at least for now.
France's top court has blocked social media ban for under 15.
So these social media bans have been popping up all over the world.
The entire concept is we're not going to actually hold big tech companies accountable.
Instead, we're going to let them do what they've been doing for years, which is manipulating people, giving them infinity scroll feeds, letting them do scroll, letting them do whatever, giving dark patterns, not being transparent about data collection, doing everything possible to exploit humans and their basic autonomy, right?
If you're under 15 or under 16 or whatever age we decide, we're just going to not let you on those platforms.
And that is our solution, apparently, to this problem.
This is a clear privacy issue because now you're requesting that people upload their ID to the very platforms that are a problem.
The only way to verify who's a child and who's an adult is for everyone to upload their ID.
We've seen data breaches as a result of these kind of ID uploads.
And now it feels like, to me, the individual is being regulated instead of the big tech company who should be regulated in these situations.
I've been very concerned about this because many countries like Australia, the UK, and even some places in Europe have either proposed, have already put into law, or are getting ready to put this into law.
And France was one of the recent stories that we've been covering on this podcast.
But thank goodness, France's top court blocked this bill, saying it infringed upon freedom of expression and delivered a setback for President Macron, who asked his government to rewrite the legislation.
Macron, I know we have some French listeners, so I hope you appreciate my embarrassing way of pronouncing the French names.
The council holds that the contested provisions on the one hand disproportionately infringe upon the freedom of expression and communication and on the other fail to provide the legal safeguards necessary to ensure the right to respect for private life.
Now, this doesn't mean that this is completely gone and it's over in France.
So I really don't want to celebrate this as an ultimate win.
But this is a huge win in the right direction, guys.
And I think it really sets good precedent for the rest of the EU because the EU has come
forward as a unit.
And this is a quote from the article.
They have said that they are planning to seek stronger protections for children from harmful
social media features.
Do you know what would keep children safer from harmful social media features?
Actually regulating those harmful social media features.
And all these bans are just pseudo solutions.
right? Like it doesn't change the platform. Children are either going to get around the
bands or they're just going to have their parents let them access the service anyway. And now they're
getting access to the same service as it's always been. Or let's say the child actually does avoid
the platform until they're 16. So what? They turn 16 and now they're back on the same invasive,
crappy platform. I really wish that these politicians would actually take the same energy,
but apply it towards the companies and regulate the freaking companies who are actually actively
doing all these things. That's actually why I'm a little bit optimistic about this recent stuff
that's been happening in the US, which is directly targeting Facebook and these other big tech
companies to say that they are actively making these platforms addictive to children. And they
are targeting those addictive features and holding the companies accountable for the addictive
features. I'll also use this as a shameless plug that you can join things like Mastodon. You can
join things like better social media platforms. We're on these platforms. We have our own peer
Tube server, these things don't use these kind of exploitive algorithms that are just designed to
keep you on them all day. The whole purpose is to give you and deliver you a good experience,
good service, and then you move on with your day. And that's what these platforms could do as well.
So good job, France. And I hope other countries follow in their footsteps because this was a rare
France win. I feel like every time I've covered France on this podcast the last couple years,
almost always it's not for the best reasons for personal privacy, personal security.
But this is one of the good wins. So good job, France.
all right and now we're going to get into the defense bulletin this is split into three sections
the first is the data breaches of the week then we're going to go into the threats of the week
which is things i want to flag to make sure that you're aware of to stay safe and the third thing
is the open source news to end on a positive note so the first data breach comes from health tech
firm which is called care cloud this is a data breach that impacted 3.7 million patients they
disclosed this back in March. And apparently, we are finding out about it now. The blast radius in
terms of what was exposed is pretty large. And so if you have any relationship with ClearCloud,
you should really check out the show notes down in the description. The next data breach is a
supply chain attack and terabytes worth of credentials, many belonging to the world's
biggest and most sensitive organizations was exposed in a supply chain attack on Lite LLM,
which is an open source tool that streamlines AI driven software development. Earlier in the
episode, I said, I always go to the official website. I download the extension. Imagine if
you do that, but it's still compromised. That is how these supply chain attacks work. And that's
what makes them so scary. So if you want to learn more about the story and supply chain attacks in
general and all the people impacted by it, check out the show notes. Again, I keep the data breaches
pretty brief so you guys can investigate the data breaches that impacts you specifically. Otherwise,
this would be a two-hour podcast if I dove into each data breach individually. The next one is
that a hacker claims that 3.6 million Azure accounts records were stolen from major companies.
This apparently started July 31st, and multiple posts from someone using the alias The Hat Man
advertised data dumps from major orgs, including McDonald's, Gap, Vodafone, Tata Consulting Services,
HCL Technologies, Intercontinental Hotels, and Kindrel. So if you want to learn more about that,
check it out in the show notes. RingCentral is a cloud-based collaboration and communication
platform used by over 600,000 businesses. And they also had a data breach, which impacted the
personal information from 1.6 million accounts. And so if you or someone you know has any relationship
with RingCentral, check that one out in the show notes. We also have Sakura, which is a Japanese
cloud and data center service provider, which disclosed that hackers access its sales management
system where customer contract and membership information is stored. And so if you have ever
had this internet provider or still do, this is another data breach to look into.
This one pisses me off because this is one of those services that a lot of people are
probably in, but they never actually created the damn account.
And this is the whole data broker industry.
It's just so frustrating.
But there's a reverse lookup service.
This is a people searching tool called Clarity Check, which just scrapes data about people
that they never consented to directly, at least knowingly.
And they exposed millions of photos of people's faces
because they have all this data
and they weren't properly securing it.
And it's not just their faces.
It also exposed people's email addresses and phone numbers.
These data brokers are just like a bane
of everybody's existence.
They're just, they're mosquitoes, man.
They literally, you don't see them.
They're there.
They take something precious from you
and they just like feed off of you and nobody likes them.
Mosquitoes are still useful, you know,
the circle of life and the environment. And there's actually important reasons for mosquitoes
to exist because other animals feed on them. These things are just straight up parasites that have no
other benefit to the world. I hate data brokers. And this is another reason why data brokers suck.
Next story comes from France. Their French tax authority data breach affected 678,000 individuals.
And so if you are French, I would very much look into this story. The cryptocurrency hardware wallet
SafePal is warning of a data breach impacting 39,798 customers, specifically that number,
which was stolen for sale. Now, this didn't impact wallet seed phrases, private keys,
passwords, bank account information, payment card numbers, etc. But it impacted email addresses,
names, shipping addresses, phone numbers, and purchase information. My concern with these is
that a lot of people who might have wealth are storing wealth on these devices. And so when you
leak the personal information of those individuals, it puts them at much greater risk of further
targeting and phishing attacks. So if you ever purchased anything from SafePal, well, first,
welcome to the club because Ledger and I believe Treasure is the next one. Yes, that is the next
story. They disclosed a data breach affecting nearly 14,000 customers. After ShipMonk, its
shipping and logistics provider was hacked. Very similar kind of scope of what was attacked. So
That means using alias emails, like something like Addy.io or Simple Login.
You can also use privacy.com to purchase them, or you could purchase them with cryptocurrency
if they support it and try to get them shipped to a private mailbox or somewhere safer.
And the last data breach of the week before we get into the threats,
Pokemon Center is notifying customers in the UK and Germany that it suffered a third-party data
breach after a hacker stole customer personal information.
So if you want to learn more about that, check it out in the show notes,
or you probably were already notified if it impacted you directly.
All right, now we're into threats.
And this first one is a Linux botnet, which turns routers into traffic relay nodes.
And fantastic imagery here by Bleeping Computer if they made that.
But it's a Mirai-based modular Linux botnet malware called EV0001Bot,
which has been targeting internet-facing gateway devices, turning them into SOX5 traffic relay nodes.
They've been targeting devices from Alcatel, Netgear, Tenda, Mitsubishi Electric, Telesquare, and D-Link
across various regions by exploiting known vulnerabilities.
I would very much look into the story if you want to learn more.
The main defense that they cite here against botnet malware in general
is to keep your Internet of Things devices firmware updated,
replace default admin credentials, turn off remote access panels,
and replace devices when the vendor no longer provides support for them.
I think one of the most dangerous things I see over the years
is people who have devices who haven't been updated in five, six, seven years.
You can maybe push an old device, I think, for a month, two months, three months.
But you guys have to remember each month, each year that passes where a device is the end of life.
It's just slowly building up more and more things that can be exploited.
I like to think of this as like, you know, if you're running, you have flat ground and the flat ground is good, right?
We like to run on flat surfaces.
Hills are tougher, right?
And so if you keep your devices and they're out of date, you know, you slowly start going.
The mountain starts to creep up.
What originally is just a little hump comes Mount Everest.
And then at that point, you can't really do much in terms of protecting yourself as well, right?
We can always lock things down.
You can make them completely offline.
You can add further multi-factor authentication.
You can do a lot of things to still make it harder to exploit those vulnerabilities.
But ultimately, you got to climb Mount Everest, man.
So keep your devices up to date.
And this is your reminder to do that.
Now, this next story is from Comcast,
who is adding motion sensing to millions of its newer routers.
It's supposed to notify you when there's movement inside your house.
And all it does is notify you of the movement.
So it doesn't really do anything beyond that.
But there are serious privacy implications for this technology.
In fact, there was research published about a week ago
that actually showed that you can identify people 99.5% of the time.
Fortunately, this is opt-in on Comcast's routers.
It doesn't just enable itself by default,
but it should seriously get you wondering about this technology.
how creepy it is and the fact that Comcast literally says they can disclose information
to third parties, which means that they can access your information, including internal
employees. I made a whole dedicated video on this feature where I dive a lot deeper into how it
works, the research behind it, what you can do and what third party routers look like and why I
would consider using those in this kind of situation. So check out that video. I put some
good time into it and I hope you guys enjoy it. This one was another healthy reminder that I think
people forget about, right? When you have a relationship with a company, in this case,
Spirit Airlines, you think that your data is only being shared with Spirit Airlines and you only
have to trust Spirit Airlines. But what happens when Spirit Airlines goes under? Well, what happens
is Google buys all that data to feed its AI models. Yes, that is the story here. They halted all their
operations in May, Spirit Airlines went under, and now Google says we want all that data. So they buy
it. This is not the first time we saw it. I think another egregious example we saw was with 23andMe.
23andMe is the DNA company, and they kind of went under because I think the original founder lady
lost control or it went bankrupt. And then there was multiple people who wanted to buy it,
and then people wanted to just buy the data, but then she bought it back. It's very confusing what
happened there. But either way, there was a long stretch of time here where we were doing coverage
on this where it was like, oh my God, is this DNA data that people gave to 23andMe, which I would
still say wasn't a good idea, but is that now going to be sold to just random tech companies
who just want to buy it? That seems kind of wrong. But guys, there's no legal framework for that.
There's nothing stopping these companies from doing that. In fact, if you read the terms and
conditions and privacy policies of lots of big tech companies, they specifically say that your
data might be transferred to another party in the event of bankruptcy or the business going under
Or an acquisition is another common example where a company gets acquired by another company,
and now it's that company's data.
We saw this with Fitbit.
Same thing.
Google bought Fitbit and now took Fitbit's data from all the previous customers.
So again, always keep that in mind, and it's something to flag before you register for any
service.
There was a DDoS attack against Threema, the end-to-end encrypted messenger.
So this is just kind of flagging that.
If you are a Threema user, that's probably why that was happening if you had any kind
of downtime.
Microsoft Copilot revealed secret input that allowed it to be hacked.
And so if you want to read about this Copilot attack, check it out.
We're running low on time, so I'm not going to dive too much into that.
It's just another example of Copilot being a little bit reckless.
So I would suggest all of you either use Copilot extremely carefully and limit where it's used,
or just don't use it at all.
All right, everybody.
And now we are in the final little bit of the podcast here, which is the open source news.
So we have Tor Browser, which is the anonymity privacy-focused browser,
and they released version 15.0.20.
There's a full changelog if you want to see it.
It seems like mostly security updates and minor fixes.
Waterfox is a Firefox fork.
They hit version 6.7, which they're calling Supernova.
It moved to ESR 153 and now features native tree tabs,
the Nova style, which is, I believe, the redesign,
and 12 color palettes.
It also boasts a rebuilt ad blocker panel,
legacy extension support, a new setup flow,
and update controls that finally deliver on their promises.
And it looks very pretty.
The Radblocker looks really nice.
I got to say, I'm looking at the screenshot here.
I haven't personally tested it, but it looks very brave inspired in terms of like what it
visually tells you about each site.
So super cool stuff.
Speaking of Firefox and ad blockers, Firefox for iOS now has an experimental native ad
blocker.
It's off by default and you can try it out if you use Firefox for mobile.
And it uses a filter list based on easy list to block a variety of ads.
Also, speaking of Firefox, they have added Startpage.
And so Start Page is now another option you can select easily within Firefox.
Brave version 1.93 has been updated with GPU fingerprinting protections.
So if you want the latest and greatest on fingerprint protection, Brave now has some extra stuff there.
This one I actually saw organically before I saw the story, which is quite rare.
But ProtonMail now has categories inside of the mail experience.
Personally, for me, it is not my thing.
I tried using even these categories in Apple Mail back when it came out.
I can't stand it.
I'm an inbox zero kind of person, and so I don't want things split into folders.
And now it feels like I have to check four or five different folders.
That's the way I see it.
But if you are not like me, I know this is something a lot of people love.
I know this is what Gmail does now.
It's what Apple does now.
And I think from that perspective, this is crazy important because now you have those
categories and they default to primary social promotions, newsletters, transactions, and updates.
And for the record, this is on by default, but it prompts you and I just turned it off right when I
saw it. This is not my kind of feature, but I am so happy this exists because I know for a lot of
you out there, you want this feature. Let me know what you think and let me know how you handle your
email inbox because I'm quite curious. The next article is also from Proton and I just wanted to
showcase this new feature. And the reason I found out about this was from our signal group. So if
you're not already supporting us and making this podcast even better as time goes on and making it
sustainable, check out how to support the podcast down in the description. We have a fun little
community. And you guys kind of started playing around with that. And then I saw you talk about it.
But it's called AI Paper Trail. And it's a new, I think it's new feature that Proton released.
The way it works is you go to your OpenAI or your Clot account, and you pretty much export your data
from the account and you upload it to Lumo AI. And what it does is it just tells you what does
your AI know about you. And a lot of people in our signal group were like, holy crap, it like knows
so much about me. And it's not until it really lists it out in this creepy manner that you really
understand how it works. Now, of course, Lumo does this in a privacy respecting way. It's from
Proton. And of course, it's meant to be a tool to kind of like showcase how things aren't as private
as they can be.
So maybe you should consider using Lumo.
So it is partially a marketing tool, of course.
But I still think it's a useful tool
to maybe share with friends or family.
And either way, I plan to run it after I record
because it looks pretty fascinating.
Next story comes from Entei,
who has put out a blog
talking about their first steps to post-quantum.
They are end-to-end encrypted photo storage.
And so they're trying to get ahead of that.
And again, I think post-quantum
is something that is nice to have right now in 2026,
but I'm not looking at this as a must.
So it's always cool.
And it kind of shows the bleeding edge nature
of a lot of the privacy and security organizations
when they're looking at things like post-quantum already.
Linux kernel 7.2 was just released
with a lot of new features.
So if you are a Linux user, check it out
if you want to learn more about the kernel update.
This one I am very excited for,
but Fairphone has released the Gen 6 Plus,
which is now available in the US.
I am very excited about this, guys,
because I have been wanting the Fairphone
to be easy to access in the US for a long time now.
So it's not an entirely new phone,
but it is an upgraded version of the regular Fairphone 6.
I was chatting to one of my friends recently about this,
a European friend of mine,
and they were like, oh my God,
it seems like they really tried to make it like an iPhone.
And it's like, yeah, but that's the thing.
I think the US is so iPhone heavy that Fairphones,
again, I'm just guessing here.
I'm guessing that Fairphone was like,
hey, so why don't we make a more iPhone-esque version
of the Fairphone for US users?
And I think that might be what they're going for.
And so why I'm excited about this and why I'm sharing it is typically these Fair phones are supported by custom ROMs.
And so we'll see what the support looks like as we learn more about it.
But I'm excited to have a repairable device in the U.S. that I don't have to go through tons of hoops to get through.
SimpleX, the messenger, they've previously sponsored this podcast.
They are doing an equity crowdfunding launch.
So you can invest in this on WeFunder and they are looking to raise money.
I don't think I've ever seen this before.
This is a first on the podcast.
There aren't many firsts on this podcast.
After years of doing this, episode 271, I can't tell you many situations where I'm like,
okay, yeah, this is a first.
But I have not seen a crowdfunding investment opportunity yet for a privacy-based tool that
is commonly recommended throughout privacy circles.
So if you're interested in this kind of thing, check it out.
I am going to stay clear of any kind of like financial advice or anything like that,
just because I feel like it muddies the waters.
And the last story of the week, sadly, isn't the most positive, but Pine64, which is, you
know, they make a lot of Linux hardware, specifically their phones.
The Pine phones are quite popular, but they also make the Pine tab, the Pine Watch.
They said that they have no plans to continue producing more Linux devices in the near future.
Even more concerning, the company says the situation may not be reconsidered until after the middle of 2027.
They're saying this is because of the DRAM and the eMMC shortage, aka the memory slash RAM shortage.
And there isn't any more plans to continue producing more Linux devices in the near future.
This is really sad because this is one of the few organizations that's really, I think, pushing the limits of what you can do in terms of mobile devices and Linux right now.
And even though I don't think they're quite ready for mainstream use yet, this has been, I think, kind of setting the standard for what developers can do.
And it's just creating and trying to create the ecosystem around Linux for mobile.
I really hope that we figure this out.
I hope that they continue when they get things going.
So very sad news, but I'm still going to try to be optimistic.
And if you can do something to help support them, please look into them.
They do a lot of good work.
And that everybody is going to conclude the surveillance report.
If this analysis helped you reclaim control, become a Techlorian down in the description.
It's a huge help for us back here.
We could really use it.
We're still trying to develop kind of our perks.
And so if you have things that you wish that we did that could make it more enticing, please let me know.
Right now you get access to our signal group.
You get shown in the outro of our videos.
And also you get access to my private RSS feed.
So if you don't want to wait every single week to get access to the news, I personally curate the news throughout the week.
And I flag things pretty much on a daily basis.
So you could just follow that RSS feed instead of having to follow hundreds of sources like I have to do.
If you don't want to support us, you can also leave a rating on Apple Podcasts or Spotify or leave a like on YouTube.
You can also share a specific story or just share the episode with any friends or family.
And of course, don't forget that there's a written version of this if you just want the newsletter variant.
And you can access that on our website on techlore.tech.
Thank you all for watching, and I'll see you next week for the next Surveillance Report.