🔵 Discord 用户的消息将出现在网页并被搜索引擎索引；若非所愿请更新设置。
- 11/16 起，Discord 将为 Discoverable Server 创建网页。
- 用户消息可能会匿名地出现在网页上并被搜索引擎索引。
- 用户可以在设置中 "Data & Privacy" > "Show my message content from Discoverable channels on web pages" 项调整偏好。默认是开启。
support.discord.com/~
linksrc: t.me/landiansub/17148
#Discord #Privacy
Telegram 原文
🔐 The offline master keys were not offline. Zimmer, who ran the largest group of hijacked Tor relays, said so in his post-mortem. Copies sat in a backup on his management server, encrypted with a password the attacker already found. 😬
He was just as blunt about the cause: The root cause was ours: one password reused for SSH login, sudo, and the backup passphrase, stored in plaintext on both servers, plus SSH password authentication left enabled on the internet-facing management server. Credit to him for putting that in writing. 👏 I'd guess plenty of servers out there would earn the same sentence, maybe a few of yours.
In early October, attackers took over more than 300 Tor exit relays and rerouted SSH connections to 12 interception servers. At the peak on October 4, those relays carried 7.46% of Tor's exit capacity, according to an analysis of public directory data. Zimmer's own break-in came earlier. On August 28, the attacker logged into his management server with the account password on the first try and gained root within five minutes.
The victims got hit through passwords too. To get burned, you had to accept the interceptor's host key and type a password. Some people saw an OpenSSH warning that the server had changed... others just got the usual prompt to accept a new key. If you used key-based login, the attacker couldn't pass it through to the real server because the signature is tied to that session.
The backdoor is Ebury version 1.8.3, a single library file that leaves the packaged library alone, so the normal package checks come back clean. Zimmer's servers showed none of the host-level signs on the Tor Projects checklist. The only thing that gave it away was the changed exit policy.
🚨 If you run anything with SSH open to the internet, turn off password login and use keys. If you accepted an unfamiliar or changed host key over Tor between October 1 and 5, assume that password is stolen, change it, and check the server. And if you're poking around a box you suspect, log in with a key, since Ebury captures typed passwords.
Nobody knows yet how the other 58 operators got hit. On FranTech, the network behind BuyVM, 71 of 101 relays switched to the attackers' policy, compared with 13 of 9,054 hosted elsewhere. The researcher who spotted this asked whether the attackers got in at the hosting provider level, and so far nobody has answered.
thehackernews.com/2026/10/atta…
#Cybersecurity #InfoSec #Tor #SSH #Linux #Malware #ThreatIntel #IncidentResponse #RiskManagement #security #privacy #cloud #darkweb
Attackers hijacked over 300 Tor exit relays to intercept SSH connections and steal passwords from users who accepted changed host keys.The Hacker News
Router TP-Link nel mirino degli USA: sul piatto un miliardo di dollari
📌 Link all'articolo : redhotcyber.com/post/router-tp…
Carolina Vivianti
#redhotcyber #cybersecurity #cybercrime #hacking #cti #ai #privacy #news #technology
TP-Link ha proposto di investire 1 miliardo di dollari nella produzione di router negli Stati Uniti per ottenere un'eccezione alle normative sulla sicurezza nazionale. La FCC sta verificando i legami dell'azienda con la Cina.Carolina Vivianti (Red Hot Cyber)
🔴 Google 或会自动添加登录设备手机号到账户。
- Google 默认启用「手机号码验证」功能。此功能会将手机号绑定到设备上所有登录了的 Google 账户上。
- 用户关闭此功能的方式是在「设定」>「Google」>「所有服务」标签>「隐私权与安全性」节>「验证电话号码」中，关闭「自动验证电话号码」功能。
- 用户可能还想要在 Google 账户设置 [1] 移除已经添加过的电话号码。
androidauthority.com/~seealso: HackerNews:50090349
1. myaccount.google.com/phone
linksrc: blog.gslin.org/~
#Google #Android #Privacy
Telegram 原文
🔴 Google 或会自动添加登录设备手机号到账户。 - Google 默认启用「手机号码验证」功能。此功能会将手机号绑定到设备上所有登录了的 Google 账户上。 - 用户关闭此功能的方式是在「设定」>「Google」>「所有服务」标签>「隐私权与安全性」节>「验证电话号码」中，关闭「自动验证电话号码」功能。 - 用户可能还想要在 Google 账户设置 [1] 移除已经添加过的电话号码。 androidauthority.Telegram
We did it: The EU Parliament continues to OPPOSE #ChatControl 2.0! 🥳
Thanks everyone for writing to representatives. 🫶
The next trilogue is scheduled for November, we must make sure that end-to-end encryption and private communication remains to be protected!
🚨🇪🇺 The #ChatControl trilogue starts on Tuesday & the EU Council is trying to pressure Parliament into giving up its opposition. We must stop them once again! 💪🏼And the proposed compromise isn't targeted policing, it is mass surveillance!
Because no matter the framing, the truth remains the same: There's no backdoor for the good guys only!
We at Tuta will continue to fight for your right to #privacy. Make your voice heard as well, today is the day!
Fight Chat Control - Protect Digital Privacy in the EU
Learn about the EU Chat Control proposal and contact your representatives to protect digital privacy and encryption.fightchatcontrol.eu
🚨🇪🇺 The #ChatControl trilogue starts on Tuesday & the EU Council is trying to pressure Parliament into giving up its opposition. We must stop them once again! 💪🏼
And the proposed compromise isn't targeted policing, it is mass surveillance!
Because no matter the framing, the truth remains the same: There's no backdoor for the good guys only!
We at Tuta will continue to fight for your right to #privacy. Make your voice heard as well, today is the day!
Learn about the EU Chat Control proposal and contact your representatives to protect digital privacy and encryption.fightchatcontrol.eu
🚨Canada is about to destroy #privacy with Bill C-22 — one of the worst surveillance laws.
We stopped Bill C-2 just last year (details: tuta.com/blog/canada-bill-c2-s…)
Let's do it again! We say #NoToBackdoors 💪
Because there's no such thing as "lawful access" for the good guys only.
We've signed an open letter against Bill C-22, please join the fight!
👉 theccf.ca/stop-government-spyi…
👉 Open Letter: fixc22.ca
23 tech companies and organizations tell Canada's ministers that a backdoor for law enforcement is a backdoor for everyone. Amend Bill C-22 before it becomes law.Patrick Hills (Chamber of Progress)
9月18日，网信办发布《国务院关于保障未成年人健康安全使用网络的规定（征求意见稿）》（以下简称《规定》）。
《规定》要求，网络服务提供者不得向未成年人提供陌生人社交服务、虚拟亲密关系服务；向16周岁以下未成年人提供网络社交服务、可能影响未成年人认知的人工智能服务等网络服务时，应当以未成年人模式提供。
《规定》还要求，网络服务提供者应当具备年龄验证能力，可通过身份证件、网号网证、人脸识别及行为特征识别等技术进行年龄验证。
意见反馈截止日期为2026年10月17日。
cac.gov.cn/2026-09/18/c_179148…
#互联网抗癌记 #年龄验证 #社交媒体 #隐私 #AgeVerification #SocialMedia #Privacy
Bab el-Mandeb: il nuovo chokepoint digitale che minaccia il commercio
📌 Link all'articolo : redhotcyber.com/post/bab-el-ma…
Massimo Dionisi
#redhotcyber #cybersecurity #cybercrime #hacking #cti #ai #privacy #news #technology
Scopri come Bab el-Mandeb sta diventando un chokepoint digitale, minacciando la sicurezza marittima, le telecomunicazioni e le rotte commerciali. Leggi ora.Massimo Dionisi (Red Hot Cyber)
🇪🇺🚨 Ursula von der Leyen wants to ban social media for under 13s across the European Union
What the EU claims as "child protection" means mass surveillance because of ID checks and face scans 🚩
We must fight against #AgeVerification and for our right of #privacy✊
#互联网抗癌记 央视新闻消息，当地时间8月14日，法国宪法委员会宣布，否决一项禁止15岁以下未成年人使用社交媒体的法案，认为相关规定对表达和通信自由构成“不成比例的侵犯”。
thepaper.cn/newsDetail_forward…
#未成年人 #社交媒体 #社交媒体禁令 #互联网 #年龄验证 #隐私 #法国 #政治 #新闻 #Minor #SocialMedia #SocialMediaBan #Internet #AgeVerification #Privacy #France #Politics #News
当地时间8月14日，法国宪法委员会宣布，否决一项禁止15岁以下未成年人使用社交媒体的法案，认为相关规定对表达和通信自由构成“不成比例的侵犯”。 法国宪法委员会指www.thepaper.cn
A really interesting and practical project from the #Guardian Project called #ButterBox is worth knowing about.
ButterBox is a portable, fully offline device (usually running on a Raspberry Pi). When you turn it on, it creates its own local Wi-Fi network. Anyone nearby can connect and access a set of tools without any internet connection:
• An offline app store (based on F-Droid)
• File, video, book and educational content sharing
• And most importantly — secure encrypted chat
What makes this project especially powerful is its deep integration with #deltachat The ButterBox team uses the MadMail server to run a local Chatmail Relay inside the box.
Users can create an offline account with just a single QR scan or one tap and immediately start using fully end-to-end encrypted messaging. Even when there’s no internet at all, messages, groups and files can be exchanged securely between people.
This is where DeltaChat really shines: decentralized, no central servers, real encryption, and designed for difficult conditions.
Combined with ButterBox, it becomes a genuine tool for secure communication during internet shutdowns, in remote areas, or in crisis situations.
It’s a pity that this project still isn’t widely known or deployed in Iran. The good news is that it’s completely open source and can be set up with a regular Raspberry Pi and an SD card. Pre-built images are also available, which makes the process even easier.
For anyone interested in privacy, offline communication, and tools that keep working when the internet goes down, ButterBox is one of the most valuable projects around right now.
Official site:
likebutter.app
#ButterBox #DeltaChat #MadMail #OfflineMessaging #Privacy
Life without internet made smoother. Get access to tools that help.likebutter.app
Age verification processes are dangerous to Canadians ⚠️🧵
Unfortunately, there is no magical solution: A ban of social media for children necessarily means a requirement to identify every adult using social media. This means that intrusive age-verification processes would have to be put in place by social media platforms, therefore collecting an immense quantity of very sensitive information from every Canadian adult using social media.
This is dangerous in many ways.
First, it means many (if not most) platforms will delegate this task to private for-profit third-party vendors with little to no incentive to protect this information properly. We have already seen data breaches of sensitive information in this process. This would increase the risk of Canadians becoming victims of identity theft and fraud, and would diminish the value of Canadian identification documents over time.
Secondly, this can create a permanent record of legal identities tied to social media accounts. This would endanger users who rely on pseudonymity online for safety, such as victims of domestic violence, trans and gender diverse people (for whom the legal identification might not match the name used on social media), performers using stage names online, and other people that are part of marginalized groups regularly targeted online (women, people of colour, 2SLGBTQ+ people, etc.).
All these vulnerable groups would only be one data breach away from incredible harm with the implementation of mandatory identity checks to access social media.
Furthermore, risking to link every social media account to a legal identity can have a silencing effect for activists, journalists, and whistleblowers. This can lead to self-censorship of topics important to discuss publicly in a free democracy.
(2/9)
#StopIDSurveillance #Privacy #HumanRights #AgeVerification #CanPoli #Canada
A thread to Stop ID Surveillance from coming to Canada ⛔️🧵
Yesterday, I sent a long letter to the Canadian Prime Minister Mark Carney, the Culture Minister Marc Miller, and the leaders of all other major federal parties in Canada.
I sent this letter to voice my concerns about the upcoming bill that is planned to be introduced today at 5 p.m. ET, to propose a ban of social media for children, therefore requiring all social media platforms to identify every adults accessing it.
This is a long thread of what I wrote (mute me for one hour if you don't want to see it).
Feel free to copy any parts you want to share in your own letter of opposition sent to your representatives this week.
Here's how to find their contact information: ourcommons.ca/members/en/searc…
(1/9)
#StopIDSurveillance #Privacy #HumanRights #AgeVerification #CanPoli #Canada
Do not provide your ID or facial scan to access social media.
I repeat, do NOT provide your ID or facial scan to access social media when requested.
This is not a drill.
If everyone refuse to comply, and let their accounts dormant instead, I promise you the platforms themselves, with their immense budget and network of lobbyists, are going to fight these absurd laws to recover their users.
They need you more than you need them.
Make them fight for your rights.
Do not comply.
Spread the word and boycott ID checks ✊
#StopIDSurveillance #AgeVerification #Privacy #HumanRights #Democracy #Safety #MassSurveillance #Authoritarianism
@Ayzacoder: Attention if you have a Gmail account:
Google's AI now scans your emails and attachments, bank statements, tax files, medical letters, all of it. It turned on by default, and there's a class-action lawsuit over how.
Here are 5 moves to shut it off, the switch is hidden in two places:
Age Verification isn't a technical problem to solve. If you think that, you're missing the point.
It's a social problem used by authoritarian governments as an excuse for population control and censorship.
It's a fundamental attack on free speech and democracy.
It must not be accommodated.
It must be stopped.
#MassSurveillance #AgeVerification #Privacy #Democracy #HumanRights
#互联网抗癌记
据央视新闻报道，当地时间7月21日，法国国民议会和参议院正式通过一项禁止15岁以下未成年人使用社交媒体的法案。这项法案被视为法国总统马克龙本届任期的重要改革之一。
根据法案，禁令将分两个阶段执行：自9月1日起，15岁以下未成年人将不得注册新的社交媒体账号；自2027年1月起，现有属于15岁以下未成年人的社交媒体账号也将被暂停或关闭。法案并未规定对违反禁令的未成年人、家长与社交媒体公司施加惩罚。
另据美国《纽约时报》报道，根据该法律条款，社交媒体平台需自行使用年龄验证系统过滤未成年用户。但这一禁令也有例外，即允许年轻人访问具有教育目的的在线百科全书或其他数字服务。
thepaper.cn/newsDetail_forward…
#年龄验证 #未成年人 #社交媒体 #社交媒体禁令 #隐私 #欧盟 #新闻 #AgeVerification #Minor #SocialMedia #SocialMediaBan #Privacy #EU #News
#互联网抗癌记 Paul Moore 再一次通过 Chrome 扩展破解了欧盟的匿名年龄验证系统。他表示，“尽管经过 3 个月的安全强化和全面的真正改进，基本问题仍无法解决。”
#年龄验证 #未成年人 #社交媒体 #社交媒体禁令 #隐私 #欧盟 #新闻 #AgeVerification #Minor #SocialMedia #SocialMediaBan #Privacy #EU #News
Politico 消息，欧盟推出了一款年龄验证 APP，但是黑客只花了两分钟就破解了它。Politico 的报道：politico.eu/article/eu-brussel…
Paul Moore 对破解过程的解释：x.com/paul_reviews/status/2044…
Paul Moore - Security Consultant (@Paul_Reviews) on X
Hacking the #EU #AgeVerification app in under 2 minutes. During setup, the app asks you to create a PIN. After entry, the app *encrypts* it and saves it in the shared_prefs directory. 1.Paul Moore - Security Consultant (X (formerly Twitter))
blog.gslin.org/archives/2026/0…
連三角函數的值都可以拿來 fingerprint 了...
#browser #chrome #chromium #engine #fingerprint #javascript #js #math #privacy #tanh #v8
看到「Your Browser Does Math Differently on Every OS, and Anti-Bot Systems Read the Bits (via)」這篇，重點很容易懂： Math.tanh(0.8) // 0.6640367702678491 genuine Linux Chrome (glibc) // 0.664036770267849 genuine macOS Chrome (libsystem_m) // 0.Gea-Suan Lin (Gea-Suan Lin's BLOG)
reCAPTCHA 的新验证方式要求用户使用摄像头录制其手部移动的视频。
- Google 称此验证方式通过识别 21 个手部关节位点进行人类验证。
- Google Cloud 的文档宣称视频只用于验证目的，识别完成后即被删除。
- 科技评论及 Twitter/Reddit 网友则对依赖摄像头的验证码表示担忧。
1. cybernews.com/~2. docs.cloud.google.com/~
#reCAPTCHA #Privacy
Telegram 原文
reCAPTCHA 的新验证方式要求用户使用摄像头录制其手部移动的视频。 - Google 称此验证方式通过识别 21 个手部关节位点进行人类验证。 - Google Cloud 的文档宣称视频只用于验证目的，识别完成后即被删除。 - 科技评论及 Twitter/Reddit 网友则对依赖摄像头的验证码表示担忧。 1. cybernews.com/~ 2. docs.cloud.google.com/~ #reCAPTCHA #PrivacyTelegram
Next Monday, the EU decides on Chat Control 2.0. Will they let the Trojan Horse through the gate and let Google, Microsoft, LinkedIn etc continue to scan all your messages?
We at Tuta say NO.
❌ No scanning
❌ No mass surveillance
❌ No age verification
Instead we fight for:
✅ Encryption
✅ Privacy
✅ Open Source
And so should the EU. Call your local representatives! 🥊
Privacy is not negotiable. Speak up now. ✊ #Privacy
Age verification ...
#privacy #privacymatters #ageverification #socialmedia #surveillance #dataskydd #dataprotection #gdpr #deepstate
《卫报》消息，英国首相基尔·斯塔默周一表示，苹果和谷歌在 9 月之前必须安装可在儿童所使用的手机上拦截露骨图片的软件，否则将面临立法措施以强制推行这一要求。
基尔·斯塔默表示，科技公司必须在智能手机和平板电脑上激活裸体检测算法或其他技术解决方案，以防止用户拍摄或分享生殖器图片，除非他们被验证为成年人。
如果企业未能在三个月内遵守规定，英国将出台立法，要求在所有销售的手机和平板电脑上添加保护措施。 未能做到这一点的科技公司可能面临罚款，其高级管理人员可能承担刑事责任。
民权组织对科技公司即将推出的变革表示担忧，这些变革可能威胁匿名性和隐私。Big Brother Watch 主任西尔基·卡洛表示，这些计划可能“宣告匿名性和互联网隐私的死亡”。
#互联网抗癌记 #年龄验证 #隐私 #英国 #新闻 #AgeVerification #Privacy #UK #News
You can now use your #Gmail account in #Proton Mail
proton.me/blog/proton-mail-con…
#Google #email #privacy #cybersecurity
Switch from Gmail to Proton Mail and send and receive emails in one place. No more toggling between inboxes.Anant Vijay Singh (Proton)
blog.gslin.org/archives/2026/0…
拔掉 Toyota 2024 RAV4 Hybrid 車上的連網能力 (以及 GPS)
#car #carplay #communication #concern #data #dcm #gps #modem #module #privacy #security #toyota
上個禮拜看到很歡樂的文章，作者把他 2024 RAV4 Hybrid 車上的 modem 與 GPS 接收天線都拔掉了：「Removing the Modem and GPS from my 2024 RAV4 Hybrid (via)」。 主要是現在的車子會收太多數據資料傳回去了，作者有列出很多之前上過新聞的 privacy...Gea-Suan Lin (Gea-Suan Lin's BLOG)
blog.gslin.org/archives/2026/0…
iPhone 上的 notification bug 被 FBI 拿來用，然後 Apple 修復了這個 bug
#apple #bug #chat #fbi #im #ios #iphone #notification #privacy #signal #storage
放的夠久就陸陸續續有新消息了，一開始是 FBI 利用了 iPhone 上 iOS 對 notification 的資料會存起來的特性，取得被刪除的 Signal 訊息：「FBI used iPhone notification data to retrieve deleted Signal messages (via)」，裡面有引用「March 10: Federal Trial Da...Gea-Suan Lin (Gea-Suan Lin's BLOG)
