License Plate Readers Are Framing Innocent People

Flock is targeting innocent people and WhatsApp is trying to sue NSO group. Apple is announcing new features that allow you to automatically change your compromised passwords and more. All this coming up this week on This Week in Privacy, so stay tuned.

Welcome back to This Week in Privacy, everyone. This is our weekly series where we talk about what's happening in the Privacy Guides community and this week's top stories that we've seen in the data privacy and cybersecurity space. I'm Jonah and with me today is Jordan. How are you doing, Jordan? I'm doing good. Really excited to jump into some of these stories this week. We've definitely got a great lineup of stories to cover.

I totally agree. Let's get right into the first one here. This was reported by Times of San Diego. They say a flock license plate reader linked a San Diego man to a violent crime. He was five miles away. Basically, the story starts out, well, I'll read the beginning. It kind of explains it. When Hugo Parra was arrested last year on felony charges, his pleas of innocence fell on deaf ears.

San Diego police had a description of the Alfa Romeo car he was riding in and a witness who identified him during a curbside lineup as the man who brandished a handgun in Golden Hill. They had also checked the city's automatic license plate camera system run by the private company Flock and got a hit, substantiating the claim.

The problem, says attorney Alex Kuhlman, was that Para was five miles away from Golden Hill at the time of the crime, and the so-called hit from license plate reader was captured before any police pursuit began. The flock hit was obviously the wrong car as it could not have been in both places simultaneously, said Kuhlman, who represents Para and the driver, twenty three year old Ariel Beltran.

So basically the story coming from San Diego, is talking about this man who was accused of a crime while the Flock license plate reader system proved that he was nowhere near the scene of the crime at the time. The article says that Paris spent nearly one month behind bars missing Thanksgiving and other family events before the assault charges were dropped. We've talked a lot about lock and license plate readers on the show.

So I think people who watch this regularly kind of know about all of the issues with flock.

But I think we wanted to include this story because it kind of demonstrates how none of these tools are ever going to be used in your favor, even when they clearly prove that uh you've been nowhere near the scene of the crime or anything going on that you might have been accused of any of those results are going to be disregarded by police but if any shred of evidence can be gleaned from them that might place you at the scene of the crime they will be used to

basically accuse you and ruin your life, or at least that part of it. So yeah, that was the only thing I really wanted to highlight.

It's just the demonstration, I think, that all of this mass surveillance is not worth the cost because it's so unreliable in so many ways, whether it depends on AI or whether it's just a system that isn't reliable like this one and can't be trusted, we are placing a lot of faith in these automatic systems like license plate readers and other forms of mass surveillance in our society that don't have a very clear benefit and get things wrong a lot of the time.

Yeah, that's basically what I wanted to cover. I think we've kind of done flock stuff to death maybe at this point, but just an update for you. Jordan, was there anything in this article that you saw that you wanted to highlight? I feel like the most surprising thing in this article for me was like, if you read like further down in the article, there's like stuff about how like the officers literally didn't even check any of this first. They were just like, oh, it's a hit on flock.

And then they went and arrested this guy. And apparently they literally took him to like jail and everything. Like they literally jailed him based only on this information. Like it's... it is kind of ridiculous that maybe I feel like maybe police are relying a bit too much on this technology when, you know, like you said, it's not really that reliable in terms of like actually detecting things and correlating information. But yeah. Yeah. It's a great question.

Like what they consider to be a hit, because if they're just basing it on like, is this car in the flock system? That's not exactly proof of anything, is it? Not really. Yeah. And especially because like, I don't know, the, if that's all they're going on to like actually arrest someone and put someone in jail, like just to, that's the only thing that they need. I feel like that's maybe a bit ridiculous that they're like relying so heavily on it.

They even said like in the article, it even says like, Oh, we checked this guy's car. We like looked through all of his stuff. He had no weapons. Like there was, there was not really a whole lot of evidence that this person was like even immediately obvious evidence that this person was connected to this crime. So that's why it's kind of surprisingly ridiculous.

And I think the San Diego Police Department is going to get sued pretty bad for this because I don't think they really had any evidence to arrest these two people. And apparently they're seeking at one point five million in damages. So I don't know. I mean, yeah, this has life-altering implications for sure when you're convicted of a crime and you're jailed for that long. I think that's one of the most ridiculous things to me.

I think being wrongfully accused of a crime... in general is a terrible thing to happen to anyone. But in the heat of the moment, some of these things can happen with police. But to spend an entire month in jail because of a crime you didn't commit is ridiculous. Spending more than one night while they sort anything out is ridiculous because You really should be innocent until proven guilty, and that is just not what we see in a lot of cases, and especially in this one.

That is quite a significant punishment, I think, spending an entire month or more in jail um that the police just kind of did arbitrarily this wasn't you know the result of any sort of conviction or anything it's it's too long of a waiting period for sure especially again at the hands of these very unreliable tech systems that that we just cannot push all of our judgment and accountability on because again they get things wrong so much of the time so Yeah, I hope his lawsuit goes through and he

makes some money because usually hitting them where the money is might make them change their minds. But at the same time, Even that's a bit challenging with the police because they're taxpayer funded. So what do they care, right? But hopefully there's some accountability and some changes that are made here.

And hopefully other places learn a lesson from this as well, because I think that we're going to be seeing more stories like this throughout the country and around the world as these license plate readers and other systems of mass surveillance like this get implemented more widely. So yeah, it's just super unfortunate stuff.

And it's exactly the kind of thing that people who have been against flock or people who have been against mass surveillance in general for an even longer period of time have been warning against from the very beginning. It's a very predictable outcome, I think, of these systems. And, yeah, now we're seeing the results of that, which is crazy.

Maybe for people that, like, aren't super familiar with what, like, who and what Flock actually is, like, how exactly is this, like, is it like a camera system that has, like, some AI detection, like, algorithm or something, or how exactly does that work? Yeah, so they sell these to... like cities and police departments as a camera system that you can put up pretty much all around your city to track cars basically wherever they go based on their license plates.

So it kind of maps out people's specific locations where they traveled, et cetera, and gives that information to law enforcement or other people to basically trace people anywhere in the city based on where their car is going. The way that flock systems work in general is somewhat different depending on the jurisdiction.

Law enforcement agencies or towns would have the option to, for example, share all of this data with a national database, so like with the FBI, for example, so that they can all be linked together and potentially trace people even outside of that one specific flock system. You can opt out of that, but All of these flock systems still kind of interconnect to the flock company's servers, and that potentially gives a lot of access to third parties to all of this information.

Yeah, it's just a very popular thing. It's not the only solution. There are other automatic license plate readers systems that are being implemented. But Flock is kind of a big one, and it's the one that has been in the news the most recently. We've seen a lot of stories about either these systems being implemented in different cities or pushback from citizens of those cities getting those flock systems removed.

We've seen a lot of examples where a lot of money has been spent on implementing these flock systems only for the public outrage to be so great that they have to go and undo all of those changes, which is of course not great for the taxpayers, but is important to keep in mind, I think, for any city council who is considering implementing such a system.

The pushback against this sort of thing from the general population when people are aware of what's going on here is pretty significant and universal, that it's just not a great idea for this system to be implemented and we kind of need to avoid implementing such things in the future. And I think city councils need to take a lesson there.

It's funny, I think a couple episodes ago we talked about a flock situation like that where One of the city council members had a very emotional reaction to their system being removed from the town. And they were like, well, we might as well just let crime be rampant in the area. And that he took it so personally, probably, I mean, to me, only kind of speculating is an indicator that he was probably getting some sort of kickbacks from Flock or something to get this stuff implemented.

So I wouldn't be surprised if there's a lot of lobbying going on from Flock and these other ALPR. companies to get these systems implemented in a lot of different cities, unfortunately. But we have seen time and time again that local city councils are very responsive to people who actually show up and care.

So if this is something that there's even a whisper about in your communities, I think it's super important to make your voice heard and voice your distrust of luck and your dissatisfaction with any sort of ALPR system because it's a massive invasion of your privacy being basically tracked wherever you drive, wherever you go in a city, potentially revealing a lot of personal information about yourself. So yeah, the flock system is not great, not great at all.

I guess one thing that kind of crossed my mind talking about this, like more at like the government level is how does this even interact with like, you know, the fourth amendment and like all these laws to like you know have actual privacy does does privacy just not exist in public if if they're just allowed to record every place that they see your car like how does that work exactly yeah i mean i think this stuff specifically points to a larger problem that we have with the laws

in at least in the us currently some countries have solved this but it's not super widespread but i think basically when you're in sort of a public space which would probably include any roads because that's government property they will say you have no expectation of privacy and they can basically track you or take your picture or do whatever sort of privacy invasive things they they want to do um And that's all perfectly legal because, again, you have no expectation of privacy,

according to them, which is, I think, just a super unfortunate situation that we have with the current privacy laws. It's sort of related to this other problem that we have with the Fourth Amendment with the government. relying on third party companies like data brokers, but to gain this information without having to go through official channels like getting a warrant.

But in this case, since the systems are kind of operated by these governments and law enforcement agencies themselves, that sort of like third party loophole isn't being used as far as I know. But I do think that accessing these databases should absolutely require a warrant. I mean, I think that even collecting this information in the first place should require a warrant, but that's kind of tricky with the privacy laws that I stated.

There just aren't a lot of safeguards in place right now to protect people from being surveilled in a mass way like this. And I think that that's a big problem with all of these systems and mass surveillance systems in general. are kind of giving up a lot of privacy for dubious gains.

And it's really just getting rid of like any sort of responsibility on law enforcement's end to perform their own investigations, they can kind of offload this to these computer systems who can trace anyone and kind of get give results based on whatever algorithms are in place, which is not a very targeted approach at all, which I think is really bad.

Yeah, and I think also talking about this like massive database that's, you know, available nationally as well, like we can kind of move into this little, I don't kind of wanted to use this as backup to show that this is like a really bad idea, but cops are, they keep getting arrested for using this technology without people's consent for people that aren't, for people that aren't actually criminals, right?

So this story here from four or four media cops keep getting arrested for using flock to stalk people. Who would have thought that that information could be used for that as well? Yeah. So basically there was a couple of police officers who were using this flock tool to basically track their ex-girlfriend's license plate through the flock automated license plate reader system database. And apparently this officer used it sixty nine times. So, you know, I think.

This is data that is ripe for abuse as well, because all it takes is this data to get leaked or like, you know, for that to be like an API issue where someone's able to access this and they can basically find out where anyone lives, right? Because their cars are going to be driving around. I don't know. I just think it's too much data and it's centralized too much into like these massive databases.

And yeah, it's almost too much power to give people And I feel like it's almost, it's obviously not the same level as facial recognition, right? But it's like still like a similar thing, right? It's like just tracking you based on your number plate instead of your face. So, I mean, it's definitely less invasive than that, but it's like, I feel like it could kind of segue into that eventually if they're like, you know, lobby hard enough or anything.

Yeah, I think that that article is a good example of the dangers of there being no checks or accountability on these systems.

I mean, you take a look at this sort of reporting and you read about what this cop was doing and his... behavior was so egregious uh this the four or four media article says it was so commonplace that uh his colleagues noticed him researching his ex-girlfriend's whereabouts while the officers were sitting in their police cruisers so he was being pretty open about it and i think that a lot of those cases which lead to arrests um are going to be completely ridiculous like that but a lot of cases

I think almost certainly there are a lot more cases where this behavior is happening, but because they're not doing it in such a stupid way, like this guy, they're not being caught. And this kind of thing is just going to happen because there's really nothing in place to stop them besides...

David Price- Maybe being reported by by a colleague or being caught up in some sort of manual audit at some point, but in the moment, all of these systems are just sitting there waiting to be used by anyone who has access to them so. Yeah, exactly. Like you said, I think just having this power in the first place represents a danger. I think that people in general just can't resist using this sort of thing if they if they have access to it.

At least at least some people, which is just another way that people are put in danger by by these systems. Yeah, exactly. I guess we've kind of covered like that quite thoroughly now.

I guess we can kind of dive into this next story here from this one here is about WhatsApp. So if you didn't know already, like it's kind of been an ongoing thing that for the last three years, I believe, WhatsApp has been suing NSO group because they keep using their technology to hack people's devices through WhatsApp. So basically this new story is basically an update to that. WhatsApp says it caught new spyware attacks linked to the NSO group in violation of court order.

So basically there was a court order that specifically said that NSO group could not target people on WhatsApp.

And basically it was found, WhatsApp found that there was evidence that they were still doing that um so here i'll just read straight from this article last year as part of a years-long lawsuit launched by whatsapp against nso a court ordered the spyware maker to stop targeting whatsapp and its users whatsapp claimed that the new phishing campaign revealed on monday violated this permanent injunction and as such filed a contempt order against nso um Yeah, so this injunction, I guess,

stems from a twenty nineteen mass hacking campaign by NSO that targeted more than fourteen hundred WhatsApp users following the discovery. WhatsApp notified the victims and sued the spyware maker. And a jury ordered NSO to pay a hundred and sixty seven million in damages, which was later lowered to four million. Oh, my goodness. That is tragic. But, yeah, I think this this story, if you're not familiar with NSO, one of their basically the biggest victims.

I wouldn't say the biggest, but like maybe the most prolific Pegasus spyware. That's like one of their biggest products, I guess. And you know, this is a company that is actually put on a block, like a block list in, in, in the U S and they've even had sanctions and stuff. So, you know, this is like a company that is not particularly good, I would say. So this is kind of not that surprising that there would be still trying to hack WhatsApp users. But I don't know.

Do you have any thoughts on this one, Jonah? Yeah, so all of this kind of stems from... Some rulings that Meta got in their favor. It was back in just May of last year. They were awarded that, what was it, a hundred sixty seven million dollars in damages in the injunction against NSO Group being able to hack WhatsApp, basically.

And then in October, the payment was reduced to four million, like you said, but that injunction against NSO Group basically blocking them from targeting any WhatsApp users was granted insulin effect. So the fact that they are continuing to do so anyways, is just a blatant violation of that court order, which is crazy. So I guess we'll just see. I guess we'll see what comes of this. they are basically seeking to hold NSO Group in contempt of court because they are violating that ruling.

So will it make a difference? I guess I don't know. I kind of doubt it since it seems like NSO Group is going to be flagrantly violating all of this stuff anyways. And I don't know how much exposure to the U.S. jurisdiction that NSO Group even has because they... are putting a lot of pressure on them. This article, did you mention, they are going to continue with their plans to enter the American market.

The US government hasn't removed NSO Group from that block list yet, but apparently they are lobbying to get that done.

Hopefully this represents a gigantic hurdle for NSO Group to enter their operations here because I think, depending on who they're selling this to, I wouldn't be surprised if their end goal is to get these tools in the hands of law enforcement agencies or local law enforcement in a similar way to these flock cameras we were just talking about which would represent a huge danger in in the name of like supposed help with investigations and stuff like that so yeah i mean

it's kind of all i have to say it's a it's a quick story but at least meta is not letting this go which is which is something Definitely a rare, rare meta W, very rare. Um, but like, I think this is also like, they did mention in this article as well that like, uh, this spyware maker NSO group, which is like an Israeli company, um, did get acquired by us investors.

So like, that does raise kind of some questions if possibly, you know, that does mean maybe this technology might end up being implemented in the United States. But I mean, I think it's also too early to tell at this point, especially considering that they're still on the block list and they're still being sanctioned.

So I think it's, yeah, it would definitely be really terrible if this did start rolling out, like this technology, because I feel like NSO Group has been, I mean, I think you could argue maybe that this technology is good when it's used against bad people, but I also think it does end up being used for bad things as well, right? Like when you have this much power to hack people, it is going to be used for something bad.

I'm not really super familiar with who and what they use this technology, NSO Group's technology on, but I don't think that should be used on anyone if possible. I mean, I feel like it also could be targeting like journalists and all that sort of stuff as well. I'm not really sure though. Yeah, I think that's the main thing that we've seen. Journalists, activists, politicians especially. There's been, I mean, we've seen examples of this happening to politicians in Europe and other countries.

We've also seen i believe we mentioned this in a recent episode but ron wyden has been warning uh senators and other congress people here in the us that they are being targeted by spyware on their phones and they need to switch to more secure systems so this stuff is pretty prevalent and a lot of people are impacted even at even at these higher levels uh by intelligence agencies and other people who are using this spyware so it is it is a danger and these spyware companies

are basically developing all of this in the open and selling it, which shouldn't, shouldn't really be, shouldn't be allowed at all, honestly. Yeah, it is, it shouldn't really be happening, but unfortunately it is. I guess also kind of like a follow-up a little bit to the, to the story where we talked about like the Phlox, Phlox license plate readers, there's this new story here from massachusetts if you want to grab that one

yeah so some good news in this case this was reported by tech crunch massachusetts votes to pass a new privacy rights bill that bans sale of precise location data massachusetts lawmakers have voted to pass privacy protections that grant the state's residents new rights over accessing and deleting their data held by big tech giants the bill also bans companies from selling their users precise location data Later on in the article, they say the move makes Massachusetts the latest U.S.

state to push for stronger consumer privacy rights after years of documented abuses by the wider technology advertising and social media industries. While the United States does not have a nationwide privacy law, unlike many of the world's major democracies, U.S. states have filled the void of legislation by bringing their own patchwork of privacy rules that apply to their states. So I think at this point in time in Massachusetts, the lawmakers have passed this bill.

The article says that their Senate has also advanced their own bill doing the same thing, and now those bills are basically going to be combined in the Senate, and then it'll be sent to the governor's office. So there is that whole process where the governor eventually has to approve this, but the article says that it's expected that they will sign it into law.

It's just not clear when that will happen so there is a bit longer but the article says that the bill if it is passing the law is going to apply to companies that handle or process the personal data of more than one hundred thousand consumers which will mainly affect medium-sized startups as well as silicon valley technology titans i think in addition to the big tech companies that will be impacted by this Another major impact this is going to have is on cell carriers because they have been

found to sell sort of this location data to data brokers and other parties as well. And hopefully this puts an end to that, at least in Massachusetts. I think that this is a really important issue because The data broker thing, as I alluded to in that flock story, is kind of a loophole around the Fourth Amendment. Basically, all of these private companies are selling data to data brokers, and then those data brokers in turn are selling all of that data to the government.

And the government can say, basically, since they're getting this information, like a third-party company is voluntarily giving it to them they don't have to you know have a warrant in order them to give the handover that information they're saying that a warrant isn't required to obtain all of the sensitive information about people when normally if they wanted to obtain that information from the companies that process this information directly they would have to

get a warrant in a court order to tell like google for example to hand over the data so the data broker thing is a gigantic loophole in Privacy laws, at least in the US right now, that definitely needs to be patched because there's really no oversight whatsoever when it comes to the government using all of this data that data brokers are collecting.

This data broker data is also used by a lot of different companies for stuff like targeted advertising, which will lead to problems like surveillance pricing, which we've talked about in previous episodes where companies will eventually adjust prices for things based on all the stuff that they know about you. And geolocation data, like where you're traveling, reveals, again, a lot about where you're going.

This is not just from where you're driving in your car, like with Flock, but this would be data from your phone and other technology sources that can reveal even more information about you than, than Flockwood. And all of that data is, is very revealing and very powerful. I mean, we, we know how revealing it is because we've seen the privacy policies of like car companies these days, like spelling out all of this data that they can get basically by, by tracking the computers in your car.

And it's a ridiculous amount of, of information that they are able to have and Yeah, it's really just not something that should be in the hands of all of these companies kind of sharing it all around. So stopping that from happening is a huge win for people in Massachusetts. And hopefully more privacy laws are implemented or national privacy laws implemented that stops all of this even further.

Yeah, I think this is like one of those things where we're seeing like, it feels like almost every year we're seeing like more and more states like adopting these privacy laws. And like, you know, maybe that does mean that there'll be a push towards something national because I feel like that is kind of like the, that would be ideal, right? It would be better if it was a national thing instead of just like state by state, right? Or is it better to have things like this or... Yeah, absolutely.

It would be better to have a national law that's more uniform. That sort of thing is obviously harder to pass, I think. And in the meantime, more states adopting this is is super important. So hopefully this sort of legislation in other states gets passed forward.

But yeah, having a minimum baseline across the entire country would be it would it would be a huge improvement because There's probably companies who aren't going to comply with state laws, especially if they have not a huge exposure to that state. So making it uniformly applied to all states in the United States would be a huge improvement as well. Definitely.

I think one thing that was kind of surprising to me, though, in this specific law that the TechCrunch article talks about is the law would block the sharing or sale of sensitive information without a user's explicit consent. So you're saying, like, I don't know if I'm reading between the lines enough here, but, like, does that mean that if you consent to this, then they can technically go ahead and just sell the sensitive information? Is that kind of what I'm reading right now?

Yeah, I'd be concerned about this a bit because... There aren't a lot of protections, I think, in place about people accepting terms of service. And like, could this be snuck in there into these things that people just kind of agree with or agree to without reading them? I think that's a concern.

That hasn't, in a lot of court cases, really held up, that you can just hold people to these super lengthy terms of services that the companies know most people probably aren't reading in full, but it's certainly going to make any cases against these companies harder, so I wouldn't be surprised if that's a technique that they try to use here.

I think there's also an issue with... A lot of the times when people consent to their data being collected in this manner or being sold in this manner, it's because they don't have maybe the context or the education about data privacy, for example, to understand all of the different ways that this data can be used.

Because typically, if companies are going to ask you to opt into giving a permission on your phone or opt into participating in a program like this, they're going to highlight, like, the benefits and not highlight all of the downsides that are taking place. So then it becomes a question of like, can people provide informed consent in the first place when it comes to stuff like this? And I think in a lot of cases, that isn't really the case.

These tech companies know far more about how to exploit the data that you're giving them than you know about what data you're giving them. So it is a huge imbalance in that whole dynamic that I think is dangerous. So yeah, I guess to answer your question, these laws do leave open a lot of questions. And again, it's sort of a situation where we kind of have to see how it all plays out, basically.

Yeah, it did seem like this law in particular had people like Evan Greer from Fight for the Future and the ACLU also saying that this was a really good move. Even if there might be things that aren't super great about it, there's still a little bit of a loophole there. it's definitely still like cracking down a little bit, right? Like, I think we should try and get the wins where we can.

Like if, if there's a, if there's something that goes through, that's like still offering some protection to people, that's better than something that's, you know, just wholesale allowing it. So that is still better. Right. Um, and I think this also, like, it kind of touches a little bit. If you look on this article, it also touches a little bit on, The author of this article mentions that data brokers have basically relied on app developers selling their users location data.

People will just kind of allow access at all times to their location to apps and stuff like that. And that's also being used to aggregate into these data brokers as well. So I don't know. It would be interesting to see how that also plays. Because if someone... if all this means is that then those app developers just have to say like, oh, do you explicitly consent to us selling your location data? I'm sure most people might actually say no to that, but I don't know.

It definitely does raise questions about that, but at least seems like, this might have some impact at least on larger companies. Is this something as well, like I see a lot of these laws apply only to like larger like organizations, like medium organizations where it's like a hundred thousand plus consumers. Is this like a concern as well? If it's like a bunch of small players that are just doing this as well, like is that kind of also a bypass for this or? Yeah, that's a great question.

I don't really understand why, I guess I'm not really super familiar with the data broker or data exchange landscape when it comes to much smaller providers. I don't know how common that is or what kind of use cases they would be doing if you have less than a hundred thousand consumers worth of data. What are you realistically doing with that and who are you selling it to? I don't really know.

I think a hundred thousand consumers is maybe a little like that bar is a bit higher than i would like it to be i think it should be a bit less but I think there is some danger, especially with small businesses, that they would want to balance this against because it's also very easy for small businesses to be kind of accused of violating all of these laws that they didn't necessarily even know about and then having to defend against that sort of thing.

Even if they're not even doing this in the first place, I think that would be... that could be killer to a lot of small businesses just being involved in unnecessary lawsuits. So I think that that is the reason why we commonly see a lot of these laws have some sort of bar where it's only going to apply to larger organizations, even the GDPR and the EU.

A lot of the provisions only are going to apply if you have, I think, more than like a certain amount of employees, if I remember, which is another way that this is commonly done.

So Yeah, I'm not sure if I totally agree, but if you are not past that, a hundred thousand consumer threshold, you might not be doing mass surveillance in the first place, because when we're talking about mass surveillance, typically it's like this is going to impact everyone in the community or this is going to impact, you know, people nationwide, like millions of people are going to be impacted. So this does limit the impact of smaller situations. But I don't know How dangerous that is.

I do think that the most prevalent cases of this are going to be these big tech companies, like the article says, and putting a stop to that. Regardless of what anyone else is doing with this data, that's still going to have a huge impact on people's privacy. So it's a good first step. I guess what you were saying about it being a good stepping stone, I think that that's totally true.

We talked about that a bit when we talked about the Surveillance Accountability Act that Naomi Brockwell drafted. And I even asked Naomi Brockwell about this, like, do you think it's likely to get passed? And she said, no, probably not at all. And the reason is that this stuff is still super important because it gets the conversation going or it gives us... a base to build off of with more comprehensive privacy laws in the future.

I think governments are just slow, whether that's because of bureaucracy or whether that's because it's by design or whatever. They are just slow to take action and prevent this sort of thing. But establishing some precedent helps with speeding things up in the future. And just making people more aware of this with laws I think helps with speeding things up in the future.

A big reason that the Surveillance Accountability Act was so important was because it just gets things out in the news that like, oh, the government is doing this. There's some efforts to stop it. Even if those efforts aren't passed, it's a conversation that we need to have and that lawmakers need to have. And that sort of, just from an educational perspective, is super important to have.

yeah, any sort of privacy law being passed is a huge improvement, but there's certainly still a longer, there's certainly still better paths that this could go and this could be improved pretty greatly, but hopefully this leads to that happening. Yeah, definitely.

I think it's also important, like we've kind of been pushing for this for people to, you know, contact your local representatives, make sure you're doing like that grassroots action and trying to get people to actually take this stuff seriously. Um, because yeah, it is definitely does seem like it is a bit of an uphill battle, I guess. Um, because there is so much, like we've talked about it previously, like with flock and all this like mass surveillance stuff that's being rolled out.

Um, so yeah, definitely is important to do that. Um, do you have anything more you want to add here or do you want to dive straight into some site updates? I think that's kind of it.

Yeah, why don't you give us some updates on what you've been working on on the video side of things so far? Yeah, so I guess I'll also give an update on what Nate's been working on too, because we've kind of been also working together on it. But yeah, Nate put together a Jellyfin tutorial, because I don't know if everyone's seen, but Plex is now upgrading the cost of their lifetime Plex pass, which basically gives you unlimited access to all the features of the Plex Media Server.

They're upgrading the cost to seven hundred and fifty dollars US dollars, by the way. And that is kind of expensive. It was like I think it's now two fifty. And before that, it was even less. It was like I swear it would drop down to like fifty before. So it is kind of wild that they've increased it so much. In fact, a little bit greedy.

So we kind of wanted to, you know, cash in a little bit on that and put something out for people that are like very frustrated with plex doing all these silly things i think plex has also kind of done some strange stuff that's kind of diverged a little bit from the people that use their product like like including a bunch of streaming stuff um not really focusing as much on the media service stuff i think people are kind of looking for alternatives.

So that's what we're trying to do is provide like a way for people to switch away to something that doesn't even cost any money. You should donate, but it doesn't cost any money. Jellyfin is like an open source project. There's no strings attached. It's definitely less expensive. of a good experience, but if that is okay for you, like if you can put up with that, then I think it's definitely a good alternative to Plex.

Um, so yeah, Nate has recorded that this week and he shot that over to me the other day. So I've already started like doing some basic edits on it. Um, that should be an interesting video to look out for. And we've also been working on a video about passwords. So that is currently out to members on YouTube. And I think we're just waiting on, we've had like a lot of stuff going on behind the scenes this week.

So we haven't had time to put that on peer tube yet, but that will be also up on peer tube at some point. Um, that that's a video kind of going through, I feel like there's a lot of misconceptions about passwords and, what is a secure password. So that video was written up by Nate with some help from Jonah as well. And we kind of went through a lot of the, I guess, misconceptions that people have and, you know, tried to give people good actionable advice on how to create good passwords.

So that's definitely going to be an interesting video that will go public. I believe that will be going public on Saturday at ten a.m. Central Time. So definitely look out for that going public. But right now it's available to members. Yeah, that's sort of everything that I've been working on. What about you, Jonah? Yeah, I just want to say about the Plex stuff quick. I hope that that does convince a lot of people to switch to Jellyfin.

I think that all the Plex stuff, especially the weird stuff that you mentioned about them adding streaming stuff and stuff like that is really indicative of the VC funding issues that we've seen. Obviously, Plex has taken on a lot of money and now investors are hoping to cash in on that.

And Plex doesn't really have a clear path to doing so probably because you know, what is it it just serves files on your local server in theory, but now they've spent all this time and money on building features that nobody was really asking for. So I honestly think if Jellyfin is a bit too rough around the edges for people, it's probably also worth looking into MB, which an older version of that, which used to be open source, is what Jellyfin forked from.

I've been using both Jellyfin and MB recently.

just because i don't agree with the direction plex is going in at all and i will say that the experience right now on mb is significantly better they they charge some amount of money for either a subscription or a lifetime pass obviously significantly way less than plex but i think that it's a project that plex users who are willing to use these i guess proprietary alternatives because plex they're already using plex which is proprietary it's worth looking into because i think mb is doing what

plex should be doing which is just being focused on serving your own media and not also adding in all of these other things or taking on a bunch of vc funding to add pointless features that nobody asked for so In the meantime, if Jellyfin isn't going to work for you, I do think it's worth looking into. But in the long term, I hope an open source solution like Jellyfin really takes off and gets a lot of attention.

And hopefully these changes will make it so that more people are contributing to Jellyfin because now you kind of need to if you don't want to spend that absolutely insane sum of money that Flex is now demanding. Anyways, yeah, I'll share some other things that we've been working on.

A lot of the time I've spent this week has been redoing our server setup, which is not super exciting, but I'm converting it all into scripts and code that we will publish on our GitHub so there's more visibility into what we're running and more people can make changes to all of that stuff if there's any sort of emergency because right now we just kind of have a lot of systems that we need to get unified so i don't know how many people are interested in that sort of thing but if you are for

some reason probably hopefully by next week we'll have a repo on github that will be public that kind of has all of that stuff in it. So at least on my end, for me personally, that'll be cool because it simplifies a lot of the stuff that I have to do. The other thing I've been working on is more stuff for verified apps database. And the app that we have on Android, I've been improving that, working on getting it submitted to app stores, and also just going through submissions.

So there's a few more apps in there. We have a lot of submissions open right now. People have been really contributing. I would definitely say if you would like to help improve our services, it would be really appreciated to submit the apps that you have on your phone as well so we can kind of expand this database.

We are expanding it right now with apps that we can basically verify from different app stores, but eventually we'll move on to verifying stuff like APK files that you download from websites directly or from GitHub or what have you.

Yeah, I'm just excited about that project because I think it's a pretty useful feature for people on Android, especially if you're downloading apps from the internet or maybe untrusted sources because, for example, you don't have access to Google Play yourself, either because it's not available in your country or because you just don't want to use Google Play services in a Google account. And you have to get your apps elsewhere.

This is a good way to check whether those apps are legitimate, in my opinion, and hopefully other people agree and find it useful. So yeah, basically working on building that.

In other site news, mostly Fria, but also the team in general have been publishing more news stories to privacyguides.org slash news so a lot of the stuff that we've seen that we don't have time to talk about here on this show typically gets published at privacyguides.org slash news so that is a good place to really keep up with a lot more news stories in this space that we're aware of in addition to what we post on the forum and stuff of course from the

community so yeah definitely check out the articles there if That is something that's interesting to you. I would definitely recommend it. All of the stuff that we work on at Privacy Guides, it's made possible by our supporters. So if you like all the stuff that we're doing and want to support the project, you can sign up for a membership or you can donate at privacyguides.org slash donate. You can also pick up some swag at shop.privacyguides.org if you want something there.

Privacy Guides, of course, is a nonprofit project, we research and share privacy related information. And we facilitate that community on our forum and matrix where people can ask questions, get advice, learn about staying private online and preserving your digital rights. So yeah, I think with all those updates out of the way, let's talk about our next story about a new Apple feature, which is automatically going to change your compromised passwords.

if I could pull it up here. This was reported by Bleeping Computer. The headline is, just as I said, there's a new Apple feature here. They say, at WWDC, Apple announced an Apple intelligence-powered feature that can automatically fix weak and compromised passwords. Right now, Safari and the built-in Apple Passwords app can automatically flag weak duplicate or compromised passwords. Now, this is an AI-powered feature.

Apple says that the built-in password app and Safari can now use AI to agentically take action based on your behavior and secure your passwords automatically. This feature will launch with iOS for the passwords app in Safari, which can automatically update eligible accounts to strong passwords. I think that this is a cool development. There's a lot of concerns about AI and how this will be used.

For example, I would certainly hope that this feature in particular is going to be done entirely locally. Apple says in a blog post that the latest models that they have run on device and on servers using private cloud compute. But I would imagine something like this is going to work on device. It doesn't specify very concretely in this article from what I've seen how, how this feature is going to work. But so yeah, that's something to look into. But hopefully it works well, and is reliable.

Because I do think this is a big problem that people have when they when they switch to password managers, it's, they import all of their passwords, and they're usually like all the same passwords, and then they have to go through and update them all. And that is difficult. So a one button way to fix all of your passwords or to fix passwords that are compromised in a data breach would be actually helpful for a lot of people and hopefully would improve their security.

I guess the main thing is I hope this doesn't stop websites from adopting even more secure alternatives like passkeys. I think that that's the ultimate fix probably is to get much more passkey support implemented across websites. We've seen a lot of passkey adoption so far, which has been super great because it kind of guarantees all of the security by design.

So I'm glad to see a lot more sites adopting that than had adopted like security keys, for example, even mainstream consumer sites are adding passkeys now because it's just an easier and more secure way to secure your accounts. So yeah, overall, I don't think this is a terrible idea. I think for people who are using the Apple Passwords app, it's pretty cool, which I would imagine it's a lot of people because it's by default. It's not a password manager that we would probably recommend at all.

We have password manager recommendations on our website, mainly open source ones like Bitwarden and KeePass are the big ones. And I don't know how likely it is that they'll be able to add a feature like this anytime soon. But for a lot of people who are just using the built in password manager, I think that this will improve kind of the baseline security for all of those people. Jordan, did you have anything to say about that change?

Yeah, I think this is kind of indicative of Apple's, like, control over this, like, whole ecosystem, right? Like, it feels like not many other companies would really be able to do this. And, like, maybe if there's... I don't know. It's just that they have such, like, ultimate control.

I think one thing I have seen is a lot of people will have, like, a bunch of passwords in Apple Passwords because it literally will ask you to save your passwords in there automatically and people just do that, right? And... I imagine a lot of times, at least the people that I've seen in my life, they'll have the passwords app and it will just be a list of compromised, compromised, compromised.

So I think if this just updates those passwords automatically in the background, it's not super clear how this works yet. And I think a lot of things when it comes to AI and Apple, I think we need to definitely hold our breath a little bit because They don't seem to be super good at rolling out this sort of stuff. They'll promise something and then it won't really happen. I don't know.

I don't think this, it was kind of frustrating looking at WWDC last week or this week, I guess, because there was such a focus on like AI stuff and, And we didn't really see that many security improvements or anything like that. So this was one of the few things that was able to be positive, I guess. I'm not really sure. I feel like as soon as you start assigning tasks to an AI agent, it starts to become a little bit sus. They were saying on here that it was... an agentic password manager.

Like, I don't really like that idea. I don't like, I don't like the sound of that. Like, I feel like that could possibly end up being, Oh, we changed your password to something that's really bad. Or we submitted your information somewhere. I don't know. I'm not really super convinced by this, but if it does just do what they're saying and it's kind of, they just, you know, plugged on a bunch of AI buzzwords, maybe it's a good thing for those people that are using Apple passwords.

But yeah, Yeah, Apple's definitely been making quite a big fuss about like... oh, Apple intelligence is going to be very private and secure and not sending your data anywhere. So that still remains to be seen. I think most people on our team are definitely more against this technology than for it. But if this technology has to get implemented on people's devices, because of the trends in the industry, I'd rather it gets implemented in a way that isn't sharing it with massive AI corporations.

So yeah, I don't know. Yeah, definitely a lot of questions that need to be answered here, I think. Yeah, definitely.

I think that's kind of all I have to say, though, if you want to take our next story here. Yeah, sounds good. So this is a story... from Canada. So signal DuckDuckGo among firms weighing Canada exit over lawful access bill.

So I don't know if people have been following, but basically there's been a bill called Bill C-二, which basically would force companies inside Canada to retain metadata for up to a year and allow basically for police to access that information and obviously when we talk about stuff like Signal and DuckDuckGo that technology is not particularly compatible with this right it's uh these are technologies that are that work on the least metadata collection possible right and as soon as you start

like forcing these companies to retain this metadata and to do this sort of stuff it's it sort of breaks the entire like privacy, like aspect of these tools. So quoting from the article, in its current form, Bill C-Twenty-Two would convert the everyday tools Canadians rely on into sprawling, insecure surveillance apparatuses.

signals vice president of strategy and global affairs told the house of commons public safety committee on tuesday if we are ever forced to choose between betraying the people who rely on us and leaving a market we will leave which i think is really good that these like companies are actually making a stand on this um i think we've seen this before especially like in the uk we've seen people saying they're going to leave um Similar things in other countries that are

trying to pass these like metadata retention stuff, which is good. And basically the argument for this is adding these metadata retention things and adding backdoors for the good guys can always be exploited by cyber criminals and expose a bunch of this metadata to people that shouldn't have access to this. And the solution here is don't. No metadata. Don't collect it. It doesn't need to be collected, right?

That's why it's so frustrating when there's these politicians that are trying to get this stuff pushed through. So yeah, another quote here, effectively, the government through this legislation seeks to insert itself into the networks and devices of various providers. So yeah, it's kind of a bit of a problematic bill. I've seen this definitely popping up a lot as being basically a Pretty much, it's basically a mass surveillance bill.

As far as mass surveillance goes, this is basically a mass surveillance bill. Even companies like NordVPN said they would basically remove service from the country this past. This is going to affect the VPN services too. Windscribe, which is a Canadian-based company, that would be interesting to see how that would affect them because they are based in Canada as well. So like, would they have to move countries? Like, would they have to change jurisdiction if this passed?

That is not entirely clear. Well, I did see, I like this quote. It's later on in the article, but Windscript did have a quote here. Apparently they wrote on X, we pay an ungodly amount of taxes to this corrupt government and in return, they want to destroy the entire essence of our service to basically spy on its own citizens. Not happening. We'll move HQ and take our taxes elsewhere. So it seems like they are definitely on board.

They get out of Canada train if such an invasive bill like C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C-C I think that is one of, that's always been one of those sticking points for people in our community is like, oh, you're based in Canada. Like Canada doesn't have the best track record when it comes to this sort of stuff.

And now I guess we're kind of seeing this hasn't passed yet, but you know, there's definitely a possibility that it will. And it's good to see that companies, especially even ones that are based in Canada are like literally saying, we're going to just get up and leave. That should be the response to this, this sort of law passing. Um, yeah, there was some more people just saying like, there was also the, uh, there's also tail scale, which is also based in Canada.

Um, they were also saying that they would have to think about, you know, maybe moving jurisdictions as well. Um, I think when, when you start having all these companies coming out saying that they would literally have to, they would rather move jurisdictions than stay in your country, that, that is kind of a clear sign that what you're trying to propose is very much not a good thing.

yeah i mean all of these backdoor proposals are just fundamentally flawed there's because there's no way to implement these securely and i think you quoted this earlier but um exactly like it says in the article these companies have like not only do they should they like not do this for security reasons but they have an obligation to all of their consumers that They're going to protect this data from a cybersecurity perspective.

All of these companies have an obligation to protect people from data breaches, and this basically prevents them from doing that. It's not very clear to me why governments don't really understand this when it comes to certain tech companies, but it seems obvious that this is going to impact companies far beyond just tech companies or VPN companies or whatever.

If there has to be a backdoor into encryption like HTTPS, for example, that's going to impact the security of your bank account transactions. Yeah. not just like from the government, but from hackers. We have said this before and I'll say it again. All of these back doors are going to be exploited because there's no way to implement them in a way that only one person like the government can access and nobody else can.

So people will eventually, maybe not immediately, but there will always be some sort of exploit or way that people can use these back doors outside the government to get access to all this data.

Even if in like a perfect fantasy world that these governments seem to believe in for some reason, if we imagine that there's a backdoor that only they can access, I think the flock story that we talked about earlier also demonstrates that the government can't be trusted with this data because we'll see government agents, law enforcement officers, et cetera, use their access to these systems to track people unlawfully and completely abuse the type of backdoor that a law like

this would implement. So it's just an incredibly dangerous situation that Bill C-二 is creating for Canadians right now. And it's something that anybody in Canada needs to really take a step to take steps to prevent from happening. You need to make your voice heard once again.

because this sort of thing again public outreach and kind of these grassroots efforts to block bills and other stuff from happening it can be effective but people really do need to get out there and make their voices heard and this is a particularly dangerous form of of these of this kind of back door that should not be be put in the law so yeah canada watch out one really important thing like you were talking about with the grassroots like organizing of people this

has already been uh knocked back i believe like there was already a previous bill that was tried they tried to pass that was like similar to this i believe it was bill c-two i believe um the strong borders act which also included a bunch of like mass surveillance stuff and that was also knocked back because of public outcry so like it does actually work in this case, it a hundred percent does work.

So this article itself is saying, you know, at the end of it, it's saying like, they're going to make a amendments to the spill to make it so that it's not going to break encryption, which I think is a little bit ridiculous. So what, what does that exactly mean? You know, they're saying that they wouldn't shorten the retaining of metadata. They would still keep it for a year.

so you know I think this is a little bit ridiculous it's it shouldn't be it shouldn't be passed definitely get get in contact with your representatives if you're in Canada and try and make sure that you let them know that this is a really bad idea and you know the government has not really it sounds like they might be talking a lot to law enforcement which you know of course they want more data to to be able to you know do police work but kind of flies in the face of you

know individual freedom for people in the country and like access to these tools so um yeah it's just a kind of an unfortunate situation but if you're in canada definitely try and get in contact with your representatives there's a good uh article from citizen lab in canada that kind of analyzes this law in more detail and explains why This stuff is fundamentally flawed. That's a quote from them, and it's true.

If you open up this Global News article from our newsletter where we have all the sources, this analysis is linked at the bottom of the article. So I would definitely check that out as well, especially if you're in Canada and you need to find more reasons to tell lawmakers about why this sort of... bill is absolutely unacceptable and can't work and will really endanger everyone in Canada, their privacy, their security, their... Yeah, I mean, their security online in general.

So give that a look if you're in Canada. And again, you got to take action because this kind of stuff is super, super dangerous if it gets passed. Anything else to add, Jordan? I think I kind of... Yeah, I think that's everything I've got to add. We can dive into the next story here, I guess.

All right. This one is reported by Bleeping Computer again. Headline is, over four hundred Arch Linux packages compromised to push a rootkit in InfoStealer. More than four hundred packages in the Arch user repository are distributing a Linux rootkit in InfoStealer malware targeting credentials and access tokens.

A report from the open source intelligence community Independent Federated Intelligence Network notes that a new maintainer is spoofing a trusted publisher on the AUR platform to push infected packages. Later on in the article, they say that the Linux binary that's being distributed through all of these package build files has InfoStealer functionality, which targets the following types of sensitive information.

GitHub credentials, SSH artifacts, HashiCorp, Vault tokens, browser, cookie databases, Slack data, Discord data, Microsoft Teams data, Telegram data. They say AUR maintainers are working to identify and remove all malicious commits, but obviously this has a pretty widespread impact on the entire Arch ecosystem. In a message to the community, in Arch Linux Package Maintainer, urge users to report any malicious package they find.

As a general rule, it's recommended to only trust projects with frequent updates and an active community around them. I think overall, in my opinion, this is kind of indicative of the danger that the Arch user repository has if you're using it. There are quite a few warnings on the site and throughout their wiki that you shouldn't just kind of blindly trust the AUR with packages and what's being installed because they are user-contributed and really anything could be in them.

And if there isn't any oversight because it's a... not a super popular package, for example, this kind of stuff can break through. But at the same time, I think the Arch community and many Arch users do kind of blindly install a lot of these packages. And there's even a lot of programs that you can install that kind of treat the AUR as just a normal package manager. And you can install things without really taking a look at them.

And I think a lot of people... think it's easy for a lot of people to kind of fall in this trap of just treating the aur as a package manager instead of um instead of really looking through the scripts that they're installing because it's just a matter of time i think it's it's the reason that a lot of people will agree to using apps without reading the terms of service or reading the privacy policy it's just overly complicated setup for a lot of people that they're just not going to do

in favor of an easy solution but in the case of arch it will will cause problems like this that i think will impact a lot of people so one of the reasons i'm not really a fan of arch is kind of what i'm trying to say a lot of other distros have Real package managers and maintainers, any Linux distro is kind of going to be susceptible to this sort of problem, but we definitely see it to a lesser extent on distros that have a more trustworthy and more locked down

system like the Debian package manager, for example, has maintainers who are who are more trusted than just like anybody being able to upload a package to the Debian, for example. So yeah, kind of I think that's kind of my thoughts on this. Was there anything you wanted to highlight, Jordan? Yeah, I think I just agree in general with like your analysis there. Like this is like the Arch user repository is literally just packages that people uploaded.

Like anyone, like literally anyone, when we say like actually anyone, it's anyone can do that, right? So like it definitely increases the chances of something like this happening. And then, you know, having all these packages that people have installed that have got like maybe thousands of downloads and, you know, some maintainer, in quotation marks, comes and takes over this package build, they can insert malware. You are putting a lot of trust in that.

And I think if you are using the Arch user repository because you need to for some reason, I would definitely check every single time you update packages through the Arch user repository, make sure you actually check to make sure that the package build file is not compromised, which is not always super easy, but I think at least having some vigilance is better.

And like Jonah said, it's better to use platforms like different distros that have more restriction on who can actually apply for package maintainers and do this sort of stuff. You don't actually need to use the Arch user repository on Arch Linux either.

So you could just not but i mean i can kind of understand those sometimes as packages that you really need um yeah i think that because it does have an official package manager but i think that just the scope of it on on arch is much smaller than on like debian or fedora for example and so a lot of people do end up relying on the user repository as well um for even like some larger applications that you would expect to just be included in an official package manager.

It's also worth noting that this is hardly the first time this has happened with the Arch user repository. We talked about this on the show back in July of last year, I believe, where malicious packages that were impersonating different web browsers on the Arch user repository were infected with a different sort of malware. Yeah, it's the I mean, these kind of, I guess you could call them supply chain attacks in general.

Or just this sort of malware distribution thing on these user contributed repositories of packages is a it's a it's a big concern. And it's probably one of the bigger issues that's facing Linux on desktop users at the moment. So definitely something to be aware of. And Yeah, hopefully that gets cleaned up and hopefully not too many people are impacted.

I didn't see an analysis of like... which packages were included I believe there's a list somewhere but I don't know like how popular the packages used were like how many people this could potentially impact so yeah if you're an Arch user I would definitely look at the list of effective packages they also um They've provided a report linked to in this article, which has some indicators of compromise. So you could use that to look at your system as well and see if you were impacted.

But definitely something to worry about if you've used the Arch user repository lately. So yeah, Arch users, I would say, should look into this for sure. Definitely. I mean, if that's everything we have to add on that story, I guess we can dive into some forum updates. In a minute, we'll start taking viewer questions.

So if you've been holding on to any questions about any of the stories we've talked about so far, you can go ahead and start leaving them on our forum thread or in the comment section on the live stream. It's been kind of quiet this week, so maybe we may not have any. But if you do have something, do leave it soon so we can see it. For now, though, let's check in on our community forum as

always. There's a lot of activity there, but there was one interesting thread I saw this week, which was basically a discussion on using Tor instead of Molvad Browser with Molvad VPN. So basically the discussion on that specific thread was like, if you're just browsing clear net sites, does Tor really add that much more protection, especially if the VPN is paid for anonymously? Do you want to kind of dive into this one a little bit, Jonah?

yeah so and i believe we cover a lot of this on like the page about mullved browser for example and also just our vpn overview and how it differs from tor i think for a lot of people you know using mullved browser with mullved vpn is probably a perfectly safe setup to use. Whenever you're using a VPN, you do have to trust that VPN provider, of course, which can be a problem or cannot be a problem depending on your specific situation and threat model.

I think a lot of people do use VPNs and trust them and using mobile browser in conjunction with that VPN is going to provide Good fingerprinting protection, if that's the sort of thing you're concerned about with the websites you visit, especially, I think, as Mulved Browser continues to become more and more popular and you're using Mulved VPN, you do have a decent crowd to fit in with where at least you have some protections in place, which is good.

Tor, on the other hand, there's pros and cons to it, but the biggest advantage is that you don't have that trust model you there because there's clear separations with the three hops you have you know your guard node at the beginning which is going to know your identity but not what you're accessing and then you have the exit node which will see what you're accessing but not who you are and the middle node which separates those two and keeps the data separate so they don't know who the other

node in the chain is. So from that perspective, it does provide a lot more protection of your anonymity, for example, than a VPN would provide. On the other hand, Tor notably is much slower than using a VPN. I think that's a big problem that Tor has.

Another problem that Tor has, which is maybe a bit less talked about, is Unlike generally VPN providers, since anybody can contribute in exit node and that exit node is kind of responsible for your connections to websites and your DNS lookups and things like that, there have been cases where Tor exit nodes uh either hijack your connections or redirect you to malicious sources this is especially the case if you're pretty much downloading anything over http instead of

https there's kind of general uh i guess malware running on these exit nodes which will hijack that just because they can be contributed by any users. So we've seen attacks, for example, against people who are downloading cryptocurrency related applications where these exit notes will serve malicious copies of those downloads for you to for you to download and get hacked as a result. That's probably less likely on a VPN, especially a trustworthy VPN, in our opinion, like Movad.

HTTPS, of course, prevents that, so that's something you should always look at when you're using Tor Browser. If you are using HTTPS everywhere and you're blocking HTTP connections, then that is much less of a concern. You don't have to really be worried about it because in that case, your connection really is end-to-end encrypted.

There is still the case where like exit notes can get some metadata about your connections, which may or may not be an issue typically that impact is very small, but it is something to keep in mind if you're accessing clear net sites so. Yeah, I think that kind of covers what I have to say. Does that make sense? Yeah, that makes sense. No, I think you covered that great. I think, yeah, there's definitely benefits, right?

But I think this brought up a really interesting discussion, which you didn't touch on yet, which is multi-party relays. Because like you were saying, there is the risk of a Tor exit node being compromised and you know, being able to maliciously redirect connections, right?

When we talk about like a multi-party relay, like I think the one that most people think of is like iCloud private relay, where there's two trusted parties, but both of those trusted parties don't like... uh share the information right like there's an ingress proxy an egress proxy and then it goes to the website um so instead you're not trusting like a random operator of a server right um which is definitely an interesting i i don't think it offers the same privacy

protection like as tor right but it's definitely like a little bit of a interesting middle ground which offers decent performance and also offers some additional privacy compared to a traditional vpn yeah i the only two that i'm aware of is icloud private relay that you mentioned and also obscura vpn and obscura staff members and their ceo are on our forum so there's some threads if people have questions about it you can ask there but that one works with mullved an obscure

vpn might be a very good option to use in conjunction with mobile browser because your exit node is going to be and so you're going to be blending in with even regular Molved users as well as obscure users on Molved browser. So it is an improvement in the trust model for sure.

It lacks the middle relay that Tor has, which kind of separates your identity from the ingress node and the exit node, which basically comes down to you deciding whether you trust the ingress node and the exit node collaborate with each other. In the case of iCloud, you have to trust that Apple and either Cloudflare or Fastly or whatever, they have multiple providers on the other side. You have to trust that they're not going to be sharing data and kind of linking your traffic together.

In Obscura's case, you have to trust that Obscura and their servers aren't going to collaborate with MOLVAD and share data with each other to kind of correlate that. I think these are reasonable assumptions to make, even if Obscura, which is a much smaller, newer company, for example, wanted to get this data, which I really don't think that they do.

But the other side of that would also have to agree to collaborate, so that would also assume that Malvad also wants to conspire to get your data, and I think that's very unlikely. I think it's definitely a good a good option. But again, compared to torts, it's still a trust based model, even if it's relatively safe to put your trust in it, whereas tours model is kind of untrustworthy by design, and you have that technical separation that makes it harder to tie all of that together.

So Yeah, I think the multi-party relay stuff is interesting. I believe Free has written an article about multi-party relays, and it's something that we are, I think, generally still looking into, but there's a lot of threads on the forum about that sort of thing that I would definitely recommend people take a look at if they are concerned about any of this stuff.

Because, yeah, I think at the end of the day, I do consider... mall-led browser and a VPN to be a very good option for a lot of people. And there are inconveniences of Tor browser that I think are resolved by mall-led browser for a lot of people, which is good. Yeah, and also I don't feel like you can use both. You don't have to use only Tor or only Molvad. You can actually use both of them.

And I think we also, you've talked about this quite a bit, Jonah, but having a VPN going while you're connecting to Tor is actually, there are some benefits of doing that as well. So that's not a concern either, as long as it's set up correctly, right? Yeah, yeah, that should be the case. OK, yeah. So I don't know. This thread was kind of interesting to me. There was a lot of discussion about the differences here between these two software projects.

But yeah, I think definitely check it out if you're kind of also a bit confused, because Nick kind of jumped in a couple of times and clarified some things there and made sure people were kind of understanding the benefits of Tor.

yeah it was uh an interesting thread there um that's kind of everything that i saw on the forum that i didn't really see any any other big threads unless there's something you want to highlight um yeah that's a good question i don't think i've seen too much on the forum this week i've been kind of checking it uh what's the word, sporadically, because I've been spending too much time trying to redo all of our server stuff this week, which is fine.

But yeah, taking a look here, I don't know if there are any that really stick out to me.

I think this is a good time to remind people we definitely can take questions if anyone has any, do kind of a Q&A. If not, then we won't do that. But if you have any questions or want to know about anything either we talked about or privacy related, this is the time to share it in the chat. Yeah, I'm not seeing any comments on our forum thread this week. It was a bit later this week just because we've had, yeah, there was some hectic stuff going on. But, yeah, hopefully that worked out okay.

And I didn't see any comments in the chat. We had a couple of people saying, like, hi. So, hi. If you're still watching. Not any questions here, really, that I'm seeing. Another story. I think this came out in the last week. You'll have to remind me. I didn't catch all of the show last week. But Brave just launched Origin Browser. I think that was only... like on Saturday, if I remember correctly.

So that's something that happened in the last week, which is something to check out because we talked about Origin Browser, Brave Origin before on the show, and it's a pretty cool development from them, I think. Yeah, it's definitely, yeah, it'll be interesting to see if maybe that's something that gets recommended on privacy guides. But I think it's definitely something we're still looking into. I know some team members have already said that they've like bought it and they're trying it out.

So if we get more like comments, I guess, from the community, maybe that's something that could get added in the future. But it is definitely an interesting thing, right? Like having a paid browser, right? in the recommendations. I don't know if that would ever... I guess there's technically no restriction on that, I guess. I guess to their credit, it is free on Linux, which we do... I mean, we would recommend people switch to Linux anyways. So there is that option for you.

I think we'll probably add it as just a note in the Brave section.

I don't really know if it has a lot of advantages over normal Brave for most people, at least from a privacy perspective, but if you like a more minimal browser or if you're the kind of person who likes ungoogled chromium for example this might be worth checking out because it's a much more minimal version of brave and unlike a lot of those chromium forks and in other browsers it's being maintained and kept up to date in a very reliable way whereas a lot of like

on google chromium builds don't don't even have like automatic updates for example which is super important to have in something with the attack surface as large as a web browser so yeah if you want a really minimal browser i think it's i think it's worth checking out definitely and it does seem like they have taken the time like they've taken the time to do the payment system in a way that's not like connecting it back to your identity or anything as well.

So like they definitely have thought it out pretty well. I think that's basically always been the concern in the community that I've noticed is like people complaining about Brave having so much bloatware attached and all these features that are like unnecessary and like it's increasing the attack surface. I think that is not particularly... That's not really a huge issue, I don't think, but maybe there's people that really, really despise it popping up every so often when they add new stuff.

So that is a solution for you, I guess. And yeah, I don't know. It's definitely going to be interesting to see if they end up adding any Brave Origin specific features, but it's probably not. Looking like that will be the case. We did get a question here from Canabida. Hello, Canabida, a regular on the stream. And a lot of people talk about Zen browser. Are you familiar with that? Any opinion from privacy perspective? I'm going to throw this to you, Jonah, because I feel like you know.

Yeah, I've said it a few times before on the stream, but I have been using Zen browser for a while and I quite like it because it provides a lot of features that other browsers aren't providing.

I will say, speaking of Brave, I've talked to some people at Brave recently and they say that they're working on bringing a lot of these Zen browser, Arc browser sort of features over to Brave, which I'm pretty excited about because I do run into issues In Zen browser, sometimes of websites being less performant or not working exactly the same as they do in chromium, which is a bit annoying. So I have ended up using both brave and Zen browser a lot of the time, but some changes are coming.

Some of them are already available in like brave nightly builds, for example, with like better sidebars and workspaces and Website containers, which I'm really excited about. That's the main feature I really like in Firefox, and bringing that over to Brave is just a good option for people to have. But yeah, overall, personally, I do like Zen Browser a lot, and I think that they... have been keeping up pretty well with updates and they have a good privacy policy.

It's something that I think not a lot of other people either on the team or in the Privacy Guides community in general have taken too much of a look at.

So it's not something that I've that I've really gone in depth on or that other people have to my knowledge so I can't really say for sure like just from a privacy security perspective where Zen browser lands so I would hesitate to like say you know everyone should switch to Zen browser or anything but yeah personally I use it and I have used it for a while and I like it and I just think it's worth supporting because I like all of these Firefox forks that are doing things correctly and

professionally and implementing regular features, but are also being developed by people other than Mozilla, which I've spoken quite a bit about in the past. I think that they are just kind of mismanaging the organization and the whole Firefox project, and I think it's really unfortunate. And so supporting these other projects, I think, is very cool. So, yeah, that's what I have to say about it.

yeah it's definitely i think zen browser is like definitely taking a lot of inspiration from arc browser which was really popular at one point and then they kind of dumped that project and said oh we're moving on to making this ai browser now um which i've been testing out like the last week and it is it doesn't really live up to the same like uh it doesn't live up to like the same standards and like it doesn't have the same features as arc does it's kind of like a stripped down version

I don't know. It's quite unclear what is going on with the browser company as well. I think they got purchased by Atlassian as well, and it's like the whole project is kind of a little bit up in the air, whether this will be something that even the new browser that they're working on will even stick around. They keep making quite large changes to that as well. But yeah, I've definitely really enjoyed Zen Browser. I used it quite a bit as well.

But I think more browsers should just have this feature built in by default. Like it should just have vertical tabs implemented in the same way that Arc does it. Because I don't know, it's just a no brainer. It just works so much better. Like I feel like no one's implementing it quite the same. And apart from Zen, basically. Zen and Arc are basically your two only options if you need the same setup, right?

I know Firefox and Brave both have vertical tabs, but it's like a gimped version of what you can find in Zen browser and in Arc browser. But it would be interesting to see Brave if they actually do commit to this and they add those extra features that Zen browser has. I think the main thing that I miss from Arc browser is the ability to have profiles on the bottom and you could just easily switch between browser profiles and it segments your data and extensions and stuff. I don't know.

As far as I know, there's no browser that does that. So I guess, yeah, it is kind of a tricky situation if you care about those. Zembrowser almost does that, I will say. But they don't segment extensions. Yeah, it uses the container tabs, which is, I'm OK with that. That's OK. But I don't know. I do feel like having separate profiles, it did enable a bit more customization, which I don't know. It's kind of unfortunate they stopped working on that project, because I do like Zen Browser.

It is basically the replacement for Arc at the moment. I believe Brave is doing their version of containers with a multi-profile approach similar to Arch. Don't quote me on that. I haven't looked into Brave's implementation and what they're testing right now too much. But if that's true, and I hope that's the direction they go in, that will be pretty exciting.

um i didn't actually know arc was uh acquired by atlassian that's that's funny i haven't looked into arc in quite a while but yeah it's i i don't really understand the direction that that whole company is going but any arc users who really liked arc i would definitely say i mean if you were going to trust arc which is like a proprietary service by like a big company uh zen is zen is going to be better than arc from a privacy and security perspective even if there is some reason

that zen isn't as great as like the browsers we recommend um it's still you know worth checking out for arc users at the very least because it'll be I think it'll generally be an improvement outside of a couple a couple features like the ones that you mentioned yeah definitely I definitely would recommend at least giving it a shot Another news story on the forum that I remembered seeing this week, I just saw Proton release their ProtonDrive command line interface for Linux.

So finally, some support for ProtonDrive on Linux, officially. Still, the command line version doesn't do as much as their typical desktop clients, but it's a huge step forward. I hope some people on Linux find it helpful. I hope that this also is able to be used by Rclone, for example, or other Linux projects that have sort of implemented a ProtonDrive interface. interface already, but built around unstable APIs that Proton hasn't really published.

They're just kind of doing it on their own, but Proton could maybe break it at any time. Maybe this will provide a more stable approach to connecting to Proton Drive from a Linux machine that other projects can make use of as well. Linux support is always, I think, laking behind with anything Proton does, unfortunately, but at least they finally got around to doing something for ProtonDrive.

I think it'll make ProtonDrive a bit more usable for people who otherwise have a lot of Proton storage they can't really make use of right now. Yeah, it definitely sucks for people that are on Linux that have been like kind of, I feel like it's definitely been somewhat neglected. I think it's definitely gotten better. Like if you've tried the ProtonVPN Linux client, it's actually really good now. It used to be like a web wrapper thing, but they made it better. So I don't know.

It's good to see them actually at least pull through on some of their promises. I know they've been kind of saying this was the first step towards getting a ProtonDrive client on Linux. But I think what's going to happen is the open source community is just going to be like, fine, I'll do it myself. And then they'll just like, you know, make, make these projects, make like a, an open source implementation of like ProtonDrive or something like that before Proton actually releases something.

So yeah, I would like, you know, have it work with rsync or rclone, sorry. And yeah, I don't know. It's definitely, it's definitely positive. Hopefully that's, a thing that we get to see, you know, in the next year, I hope a Linux client for proton drive. It's good to see that at least trying to support it. Cause it did feel like for a long time, they were kind of radio silent on it. And then, you know, people were like, oh, you're working on it. Right.

And then proton was like, oh, we're not, we haven't started. So that was definitely a bit of a shock for some people.

um another thing i want to highlight kind of from kind of inside updates but uh posted on a forum one of our team members uh just wrote a guide for people in the netherlands to set up uh something called address secrecy which is a privacy protection you can you can get there i'm not personally super well versed in things in the Netherlands, so I'm not the right person to ask details about this.

But if you are in the Netherlands and you want to check out this post on our forum in the community Wiki section that comes from one of our team members, I would definitely say check it out. Again, if you're in the Netherlands and if you have questions about it, you can ask them about it and they will know far more than either of us will.

But I just want to highlight that that was posted because it is a pretty comprehensive guide to all of that stuff in the Netherlands with links to how you can set that up and who it's for. So just another cool thing that got posted. Excellent. Yeah, I did see that you did post the... It does look like the Passwords video is on PeerTube now. So, sorry. Yeah, for members. For members, yeah. So, that is out now. If you go on the forum, you can find the link to watch that.

Yeah. So, definitely check that out. It'll be going live publicly at ten a.m. Central Time in the U.S. So... Yeah, should be a good one. Got another question from Turnip Fanatic. Does Zen Browser have the same fingerprint in Firefox? No, it's definitely different from Firefox. So that is something to keep in mind.

I don't know personally how... good the or if they do any sort of fingerprinting protection like to distinguish you from other zen browser users or if you will look kind of similar to other zen browser users but generally in firefox without like hardening protections you're not going to get much fingerprinting protections in the first place you can block some tracker scripts with just an ad blocker of course but no kind of technical means um unless you're going to be switching to something

like mullved browser so yeah i definitely wouldn't use zen browser if you need fingerprinting protections but i also wouldn't use really any browser besides mullved browser or firefox if fingerprinting is of large concern to you because even even like regular firefox for example is not going to provide very strong protections brave provides some protections but they're done in a different way that i would consider a bit less robust than what Mulvad and Tor are doing,

but some people disagree with that, so it's kind of up to you what you think. But yeah, Firefox browser, Zen browser, I wouldn't trust either of those with super strong fingerprinting protection, so that's something to keep in mind. I do think Firefox did at some point, they did actually, they do have, I think it looks like November last year, they did add.

So if you use a strict mode, it actually does have like an enhanced tracking protection thing, which does have some anti-fingerprinting protection. So, I mean, if you're going to use Zen Browser, I'd just say crank all the settings, like put everything on maximum possible thing.

Because because yeah, Zen browser is going to inherit all of those settings that Firefox has, of course, so you can enable like enhanced tracking production and stuff like that, which will improve things to some extent for sure. Yeah, but I think you're right. It's definitely nowhere near the same level of protection as like Moldad browser or Tor, right? It's like less protections that are going to have less of an impact on the browsing experience, but also offer some additional privacy stuff.

And as far as I'm aware, like Jonah said, like Brave is kind of ahead on that as well. So at least, you know, if you decide to use Zen browser, you'll get some of those benefits from some of those settings in Firefox itself. So yeah. definitely enable those if you do decide to use it. That would definitely help somewhat. Yeah. I think in the absence of any other questions, we can probably start to wrap things up. I don't see anything on the forum or in chat.

We also do have a members-only Signal community. We're happy to take questions there as well.

We haven't gotten any questions there today, of course, but I need to be better about... notifying that group that these streams have started so maybe next week i'll let them know uh ahead of time that they can join the forum and ask questions there but that is an option for sending in stuff uh because we'll check like signal during the show and in that group and see if anything is coming in addition to the chats in in forum posts here so you have a lot of ways to

interact with us on the stream if you if you want to say anything um otherwise are you fine to wrap things up jordan or is there anything else you want to talk about here yeah i think we can wrap things up now um yeah we've kind of covered everything that's on the agenda this week

Sweet. Well, thanks, Jordan. Yeah, I'll end this here then. If I can find my notes. All of the updates on this week in privacy, we share them on the blog every week. We email them out on the newsletter. So you can sign up for that newsletter or you can subscribe to the blog with your favorite RSS reader. If you want to stay tuned and read all of the sources. of the stuff that we talked about in this episode.

For people who prefer the audio version of this, we also offer a podcast which is available on pretty much all podcast platforms and through RSS if we haven't submitted it to your podcast app of choice for some reason. These videos are also synced to PureTube after the fact, so if you want to catch this away from YouTube, you can always follow our channel there as well.

Again, Privacy Guides is an impartial nonprofit organization that's focused on building a strong privacy advocacy community and delivering the best digital privacy and consumer technology rights advice on the internet. If you want to support our mission, you can make a donation on our website at privacyguides.org slash donate. To make a donation, you can click the red heart icon located in the top right corner of the page.

You can contribute using standard currency via debit or credit card, or you can opt to donate anonymously using Monero or with your favorite cryptocurrency. Becoming a paid member of Privacy Guides will unlock exclusive perks like early access to video content and priority during our Q&A if we get a lot of questions. You'll also get a cool badge on your forum profile on our forum and the warm, fuzzy feeling of supporting independent media.

So with that out of the way, thank you all for watching and we will see you next week. Bye, everybody.