Reading up on privacy

xAI Grok Build CLI sends file contents—including .env secrets—to xAI via model turns and uploads entire repositories as git bundles to GCS bucket grok-session-traces, regardless of what the agent reads.

Apple's new SpeechAnalyzer achieves 2.12% WER on clean LibriSpeech, beating Whisper Small and legacy SFSpeechRecognizer while running about three times faster.

The user attempted to view a Reddit founder community post but received a network security block message indicating access was denied due to protective filtering.

Attempting to view the Reddit founder community link resulted in a network security block, displaying a message that access was denied.

Anthropic launches a beta reflection dashboard that lets Claude users track, visualize, and assess their AI usage patterns against personal goals.

Chrome 151 introduces the <usermedia> HTML element to handle camera and microphone access declaratively, replacing script-triggered prompts and improving permission recovery rates.

Arcjet provides runtime security for AI applications, including prompt injection detection, data loss prevention, and agent tool controls.

The Cypherpunk Library offers a curated collection of public-domain readings on cryptography and privacy, free and available for browsing.

The page reveals the browser data websites silently collect—IP, timezone, GPU, fonts, battery level—without permission, highlighting fingerprinting prevalence.

The author encoded a 208-byte HTML page into a 9x9 pixel favicon by storing RGB values and decoded it with JavaScript, demonstrating data storage in unintended places.

Cloudflare, Mozilla, Google, and Microsoft are developing PACT, a privacy-first protocol to verify web traffic legitimacy without tracking users.

Anthropic may require some Claude users to upload government ID to appeal flagged accounts, citing fraud prevention amid tensions with the Trump administration.

A tool queries multiple LLMs to see if they recognize a name, but users report that even confident responses are often hallucinated or inaccurate.

Users replacing Claude/GPT with local Qwen 3.6 models report a 5x speedup (vs 15x for cloud models) but require precise prompts and experience more loops and tool-call errors.

Local Qwen models are a different tool from frontier LLMs, offering privacy and fixed costs but suffering from looping and hallucination issues.

Apple's decision to move Hide My Email and Sign in with Apple aliases to @private.icloud.com makes it trivial for services to block them, gutting the feature's privacy benefits.

Google Chrome is fully removing Manifest V2 support in upcoming releases, finally ending the last loophole that allowed ad blockers like uBlock Origin to work.

Google Chrome removed the final feature flags that allowed uBlock Origin and other Manifest V2 extensions to function, with Edge and Opera expected to follow.

Enabling four specific iPhone privacy and security settings—Stolen Device Protection, iMessage Contact Key Verification, iCloud Advanced Data Protection, and Lockdown Mode—immediately reduces risk from device theft and targeted attacks.

Google adds a Search Console toggle allowing websites to opt out of AI Overviews and other generative AI search features, promising no impact on regular rankings.

DuckDuckGo saw a 28% increase in visits after Google promoted its AI mode, sparking polarized reactions on Hacker News.

AI-generated deepfakes and voice clones make scams harder to detect, requiring new verification habits like safe words and direct callback.

China is testing its state surveillance model abroad in a remote Pacific village, sparking backlash from locals.

Apple and Google have transformed push notifications from a simple delivery pipe into an on-device AI-edited channel that summarises, reorders and deprioritises content, mirroring the intermediation that email underwent a decade earlier.

London phone theft victims face escalating threats after their devices are stolen, as criminals exploit personal data for extortion.

Commenters argue local AI is already viable for many tasks and will become the norm, driven by open-weights models and privacy concerns, not just cloud convenience.

HN commenters argue that Google's services have degraded due to enshittification, driving users to alternatives like Kagi, Yandex, and DuckDuckGo.

European consumers are shifting to the sovereign payment system Wero, which redirects payments through banks, reducing reliance on Visa and Mastercard, but commenters debate the risks of central bank control.

Bitwarden is quietly enshittifying under new private-equity CEO Michael Sullivan, removing "Always free" and core values like inclusion and transparency.

Running local LLMs on Apple Silicon is not cheaper than using cloud APIs like OpenRouter when factoring hardware, electricity, and speed costs.

OpenAI launches personal finance tools for ChatGPT Pro users, letting them connect bank accounts via Plaid for spending analysis and planning.

A growing consumer backlash against Wi-Fi-connected, app-based 'smart' products in the name of simplicity is driving preference for non-connected 'dumb' alternatives.

Using location tracking to follow a spouse's movements creates a paradoxical sense of closeness and anxiety about their safety.

The Department of Homeland Security created a new unit to review and potentially deport thousands of green card holders by scrutinizing past immigration records more aggressively.

Bambu Lab threatened a developer with legal action over an AGPL-licensed OrcaSlicer fork, escalating its crackdown on local-only printer control.

DeepSeek V4 Pro offers coding quality near frontier models like Opus 4.7 at a fraction of the cost, though some users note slower thinking and data privacy concerns.

EU research arm warns VPNs are a loophole enabling minors to bypass age-verification laws, with some policymakers calling for age checks on VPN access.

Google's Prompt API ships as a Chrome-only web standard requiring users to accept Google's use policy and download Gemini Nano without permission, drawing opposition from Mozilla and WebKit.

SoundOff uses passive, battery-free 3D-printed metal tags that emit unique ultrasound chirps when moved, enabling private, zero-infrastructure smart home sensing.

The author expresses cautious optimism about small language models in browsers, highlighting privacy and low cost while noting concerns about calcification and standardization.

OpenAI serves ads in ChatGPT by injecting single_advertiser_ad_unit objects into the SSE response, with four Fernet-encrypted tokens and contextual targeting.

OpenAI's ChatGPT ad platform injects structured ad units into conversation streams and uses Fernet-encrypted tokens with a browser SDK to track conversions.

Meta is installing software to capture employee mouse movements, keystrokes, and screen content for training AI agents to perform work tasks autonomously.

Objective Development releases Little Snitch for Linux as a free, closed-source network monitor using eBPF, with limitations in reliability compared to its macOS counterpart.

A project uses AI to automatically generate a personal encyclopedia from photos, location data, and digital exports, preserving family history with structured cross-referencing.

ICE agents have begun checking IDs in TSA security lines at some airports, raising traveler concerns, with unclear effects on wait times.

Ghost Pepper is a free, open-source macOS app that provides 100% local, hold-to-talk speech-to-text and meeting transcription using on-device AI models.

OpenAI rolls out a ChatGPT Library feature that automatically saves uploaded files to cloud storage for later reference in conversations.

AI bots that can edit files and book trips pose serious risks of data breaches, unwanted actions, and loss of user control.

A Reddit researcher uncovered that Meta funneled $2 billion through nonprofits to lobby for age verification laws that would force Apple and Google to build OS-level age verification while exempting Meta's own platforms.

Ageless Linux is a Debian-based OS that deliberately flouts California's AB 1043 age verification law, framing its noncompliance as a civil liberties stand.

Sitegeist is a browser-based AI assistant that lets users automate web tasks, extract data, and build reusable skills while keeping data local and offering flexible AI model choices.

News websites like the NYT have grown bloated with ads and tracking, reaching 49MB, driving users to block JavaScript or seek alternatives.

Cloudflare launches a managed crawl endpoint that respects robots.txt, aiming to provide a well-behaved alternative to aggressive AI scrapers.

An innocent woman was jailed for months after AI facial recognition wrongly identified her as a bank fraud suspect, despite clear evidence she was far away.

Microsoft upgrades its AI assistant to track health records, following Amazon and OpenAI, warning users of both benefits and risks.

Microsoft launches Copilot Health, an AI-powered concierge doctor within its Copilot app that provides personalized advice based on user medical records and biometric data.

Yaak is an offline-first, local-only API client supporting HTTP, GraphQL, gRPC, WebSocket, and SSE, developed by the original creator of Insomnia as a simpler, privacy-focused alternative to Postman and Insomnia.

Grok Imagine's nudify scandal shows that AI's image-manipulation capabilities enable non-consensual sexualization, fulfilling a troubling desire to control photos of women.

Age-verification tools required by child-safety laws effectively surveil and de-anonymize all adult internet users, not just protect minors.

AI chatbots revive old internet privacy risks by collecting user conversations, potentially exposing sensitive data without users' full awareness.

OpenAI announces a contract with the Pentagon for classified AI deployments, emphasizing cloud-only deployment, retained safety guardrails, and explicit prohibitions against domestic surveillance and autonomous weapons.

Visitors is a privacy-focused Google Analytics alternative offering GDPR compliance, realtime analytics, and revenue tracking through integrations.

YC companies such as Run Anywhere scrape GitHub commit metadata to send unsolicited marketing emails to developers, violating GDPR and GitHub's terms of service.

Across the US, people are vandalizing Flock license plate cameras in protest of the company's data sharing with ICE and immigration authorities.

MuMu Player Pro for macOS silently executes 17 system reconnaissance commands every 30 minutes, capturing processes, network data, and hardware info without disclosure.

Amical is a local-first, MIT-licensed dictation app that uses Whisper and open-source LLMs for privacy-preserving, context-aware speech-to-text on Mac and Windows.

A Tech Oversight report documents multiple instances where Meta CEO Mark Zuckerberg misled Congress about safety on the company's platforms, including underage privacy protections and content moderation effectiveness.

DuckDuckGo adds free, private AI image editing to Duck.ai, using OpenAI models while stripping user metadata and storing uploads locally.

GrapheneOS enhances Android privacy and security on Pixel phones but users face banking app compatibility, account bans, and reliance on Google hardware.

UK Ministry of Justice orders deletion of CourtsDesk, the largest court reporting database, citing a data breach involving an AI company.

A maintained uBlock Origin filter list hides all YouTube Shorts, with additional filters for comments and playables, and is actively maintained by a new contributor.

A security analysis using automated scanning found 36 malicious Chrome extensions that exfiltrate browsing data, affecting over 37 million users.

Amazon Ring aired a Super Bowl ad promoting its AI-powered neighborhood surveillance to find lost dogs, reigniting backlash over privacy and mass surveillance concerns.

Discord will require facial age estimation or ID upload to access adult content starting next month, using account data for most users instead of verification.

A new Super Bowl ad for doorbell cameras raises questions about the extent of surveillance power homeowners have.

ICE subpoenaed Google for a student journalist's bank and credit card data following a pro-Palestinian protest, revealing the broad sweep of administrative subpoenas.

The relentless integration of AI into popular apps personalizes the internet but reduces user control, threatening the lifeblood of digital advertising.

Sage is an experimental, self-hosted AI assistant with persistent memory, encrypted messaging via Signal or Nostr, and confidential LLM inference inside a TEE.

DoNotNotify, an Android app for granular notification control, has been open-sourced to demonstrate its privacy-first approach and invite community contributions.

Pinterest fired two engineers who built a script to scrape internal tools and share which colleagues were laid off in a 700-person reduction.

LinkedIn scans browsers for over 2,900 Chrome extensions to detect and block scraping, automation, and data-harvesting tools used for spam.

The FBI was unable to extract data from a Washington Post reporter's iPhone because it had Lockdown Mode enabled, according to court documents.

A user's 20 GDPR deletion requests saw 12 ignored, revealing enforcement gaps and company noncompliance in EU privacy law.

According to the New York Times, ICE agents in Minneapolis use facial recognition, social media monitoring, and other tech tools to identify undocumented immigrants and track protesters.

Apple's AI strategy bets on-device inference using its 2.2 billion devices as pre-deployed infrastructure, avoiding cloud compute costs.

HSBC sends letters claiming emails are undelivered when their tracking pixels aren't loaded, despite the emails being delivered, highlighting flawed email tracking practices.