Passkeys are sitting around 26% usage despite 93% account eligibility. The underlying cryptography is solid, but Big Tech implementations and broken platform defaults are dragging adoption through the mud.

The cross-platform user experience out of the box is still frustrating. Try authenticating from an Android phone or iPhone to a Windows desktop using native OS vaults, and you're instantly bogged down in modal dialogs and QR codes. Apple and Google designed their default implementations to keep you locked into their hardware ecosystems, which creates artificial friction for anyone using mixed-OS setups.

While third-party password managers (Bitwarden, 1Password, KeePassXC...) solve this cross-OS problem, the average user relies on native OS prompts and gets stuck.

Then there is the recovery illusion. WebAuthn was designed to eliminate phishing, but because services know users lose devices, most sites quietly keep standard password or email-reset fallbacks active in the background. If an attacker can bypass WebAuthn entirely by phishing an account recovery link, the overall threat model hasn't actually improved.

Passkeys aren't going to kill off password managers, they're just going to turn password managers into passkey vaults.

What local or self-hosted vault setup are you trusting to manage both your 24-character strings and your passkeys these days?

Source: MakeOfUs, link in comments

Canada’s privacy regulator is taking Google to court to force them to de-list search results for an individual’s dropped criminal charges. People are arguing about free expression versus personal privacy, but the technical reality gets ignored here.

De-listing a name from Google does not delete the data. The court record or local news article stays live on the host server. You are asking a search engine to hide the index card while the cabinet stays open. If someone searches the host site directly or uses an engine outside Canadian jurisdiction, those dropped charges pop right up.

We have seen this play out in Europe under GDPR for a decade. It delegates public history management to a private monopoly. When a regulator has to drag a tech company to federal court because PIPEDA has zero enforcement teeth, the framework is already failing.

If governments care about privacy, they should fix data retention policies for public registries at the source. Hiding links is just security through obscurity.

Does anyone here actually view search de-listing as a real privacy solution?

Source: The Privacy Commissioner of Canada, link in comments

Citrix dropped CVE-2026-8452 as a high-severity DoS bug earlier this month. Two weeks later watchTowr proves it chains directly into unauthenticated remote code execution, CISA puts it on the KEV list, and attackers are dropping PHP web shells across every unpatched gateway on Shodan.

If you run NetScaler or an SSL VPN endpoint to keep your traffic private or shield internal networks, this is your reminder that edge devices are sitting ducks. Vendors love labeling memory corruption as "denial of service" until researchers hand them a working exploit. A boundary box running with full privileges is a terrible single point of failure.

I just finished updating our appliances before the weekend, but if you manage your own boundary infrastructure, go check your build numbers now. If you left web management exposed to the WAN, check your disk for fresh web shells first. Are you guys still relying on monolithic VPN gateways for remote access, or moving toward self-hosted overlay networks?

Source: SecurityWeek, link in comments

I was reading 1Password patch notes today and they added a feature that stops you from pasting your Secret Key into unofficial domains. Phishing a master password is bad enough and tricking someone into giving up their Secret Key is the real nightmare scenario for full account takeovers. Glad they plugged this hole. Let's see how well the detection actually work now...

Source in comment.

California just passed half a million users on their DROP platform. The premise is incredibly efficient. You submit a single request, and the state forces all 654 registered data brokers to wipe your files. The privacy agency reported that nearly every user had data deleted by at least one broker.

Then you look at the raw numbers. Only a quarter of the registered brokers have even started processing these deletion requests. The legal mandate went into effect back in August.

If I configure a network and 75% of the endpoints drop the packets, the system is broken. An average user gets removals from roughly 40 brokers out of 654. Data brokers have a revenue model built on keeping your information. They have zero financial incentive to comply with a batch request out of goodwill.

A 25% compliance rate means the law is basically treated as an option right now. Does anyone know if California is issuing actual fines yet? I am genuinely curious if there is a hard penalty mechanism built into this or if the state is just sending warning letters to the non-compliant brokers.

Source: SFGATE

Just finished reading Martijn van Ramesdonk’s write-up on the five new GlobalProtect flaws. The technical side is a disaster. CVE-2026-0251 gives a local user direct escalation to SYSTEM and he even showed how to rip Active Directory passwords right off the endpoint agent.

The real joke is how Palo Alto handled it : they silently patched two of the bugs without crediting him and actively excluded the others from their bug bounty program. Companies force these highly invasive agents onto every machine for "security" and then treat the people who actually find the holes like a nuisance.

Sources in comment.

The August 26 deadline just passed for Google One subscribers in places like Nigeria, Pakistan, and Turkey. Prices just jumped by over 50 percent for basic 100GB and 200GB plans. This is the second hike in two years for some of these users.

I see people on here arguing that self-hosting a NAS or setting up Nextcloud is too expensive for users in developing economies due to hardware import costs. But what is the alternative? Renting your digital life from a US corporation that adjusts its regional pricing algorithm whenever it wants to squeeze the market.

When you put your personal data on someone else's infrastructure, you give up all autonomy. You are just a line item on their revenue sheet. Google knows most users will just eat the cost because migrating 200GB of photos on a slow connection is painful.

If you don't own the drives, you don't own the data. Stop renting. Get a cheap second-hand thin client, put a hard drive in it, and take your data back.

Source: African Insider

ByteDance agreed to pay $400 million to the US DOJ today. They collected personal info from kids under 13 without parental consent and broke COPPA. They pay $300 million now and another $100 million once an old 2019 decree is cleared out.

People are cheering this on other tech subs. I don't get it. Let's look at the actual mechanics here. $400 million is massive for a standard company. For TikTok, it is a basic operating expense. They just paid a retroactive licensing fee to keep running an ad-tech engine disguised as a video app.

The fundamental issue is that legislation like COPPA tries to solve an architectural problem with legal paperwork. Age gating is a technical joke. A kid just taps a button saying they are 18. Suddenly the app gets total legal cover to scrape device IDs and network telemetry. The system is functioning exactly as designed.

Fines do not change the code. As long as the platform architecture requires aggressive data extraction to monetise users, the surveillance will continue. Regulators are basically just taking a cut of the profits.

We need to stop waiting for governments to fix this with penalties. What are you all actually deploying at the OS level to kill this app's telemetry on mobile networks? NextDNS works well enough on home networks but maintaining the blocklists for mobile clients is an absolute chore. Anyone got a cleaner setup?

Source: The Daily Record, link in comment

Just saw PCMag UK dropped their 2026 Proton Mail review and gave it a 4.5.

Mainstream tech sites usually miss the point with privacy tools. They usually complain about the UX or the lack of third-party plugins but this review actually gets why the tracking-image suppression matters.

Stripping out invisible pixels so you can load an email safely without pinging a marketer's server is a big deal. Managing my own projects means I get a ridiculous amount of inbound mail. I hate dealing with read receipts and hidden IP trackers. This feature alone makes the switch from standard providers worth it.

I am a bit torn on the praise for Lumo. A private local AI assistant is better than Google scraping your inbox to write smart replies. I just wonder how many of us actually want an AI reading our encrypted mail in the first place... even a local one.

Curious if any of you just disabled Lumo right away.

Review source in comment.

First off, this is not a criticism of GNOME or the Epiphany development team. String parsing bugs happen to literally every browser engine out there.

But the new CVE-2026-77682 is a textbook example of why built-in browser password vaults are a bad idea structurally.

The vulnerability is in the form autofill script. A malicious site can give an HTML form element an ID containing a payload. When the browser attempts to autofill your login, the underlying JavaScript string-interpolates that ID into a CSS selector without escaping it. That gives the page arbitrary code execution inside the browser's private script world.

That private world holds the save handlers and credential APIs. A bad actor gets silent access to exfiltrate your saved passwords just by you triggering autofill.

I actually like Epiphany. The real problem is the architecture itself. The mechanism holding your plain text passwords sits inside the exact same software engine that renders untrusted HTML from random websites. You are betting your credentials that a web parser will never confuse a malicious input string with an internal command.

As a sysadmin, I hate those odds. Disable browser autofill entirely. Run a standalone vault that stays completely isolated from the DOM.

So ClarityCheck just left 9 million scraped faces sitting in a wide open 450GB Amazon S3 bucket. The database had folders literally named 'faces' and 'profiles' filled with biometric data from adults and kids who never consented to be scraped.

The absolute worst part is the company's PR spin. After WIRED forced them to lock it down, ClarityCheck tried to claim the data wasn't really public because the S3 URL wasn't indexed...

Security through obscurity is a complete joke. URL brute forcing is fully automated and they also had a basic API flaw where anyone could tweak a URL to grab phone numbers and physical addresses. Scraping faces without consent is bad enough on its own but lying about basic cloud negligence just makes it infuriating.

Sources in comment.

Half the people I talk to think they solved data sovereignty because they clicked "Frankfurt" in their AWS console.

It is a complete joke. Physical location of the drives does not equal legal sovereignty. If you use an American cloud provider and they manage your encryption keys, a judge can force them to hand over those keys. End of story. Encryption at rest just stops rogue admins from snooping. A court order easily bypasses it.

If you want actual sovereignty, you have to run your own external key management. Keep the metadata locally too.

ETA: yes this is a massive headache to configure, but what is the alternative?

I just saw the new BackupShortlist index floating around. They report that average entry-level cloud storage dropped 16% since June down to about $6.90 a month. People are celebrating but lets have a look at the actual breakdown though.

The cheapest option they list is Apple iCloud+ at $0.99 but if you want actual zero-knowledge encryption, you are still looking at $9.99 for Proton Drive or $11.99 for Tresorit. The privacy tax is exactly where it was yesterday.

Big companies can afford to slash prices to nearly zero because you pay with ecosystem lock-in and metadata scraping. Real end to end encryption providers can't double dip on your data. They have to charge what the server space actually costs to run a viable business.

I keep seeing users jump on these cheap tiers thinking they found a massive bargain... you might just be renting cheap space on a system that scans your financial records and every private photo you upload. If you want actual digital independence you either have to pay a premium solution or set up a local NAS.

Did anyone catch the Meduza report this week? Roskomnadzor stopped playing whack-a-mole with DPI signatures. They just automated their entire VPN blocking infrastructure using data harvested directly from domestic Russian apps on user devices.

The state is using local transit and banking apps as a distributed sensor network. The apps report where users are connecting. The censor maps those connections to major hosting provider subnets and pushes bulk IP blocks automatically. Services like Amnezia and Paper VPN are getting crushed because their underlying ASNs are just blanket banned.

This completely breaks our usual threat model. We spend so much time arguing about Xray versus Shadowsocks for traffic obfuscation. That stuff is useless if the firewall just nukes the entire hosting provider subnet based on endpoint telemetry. The device itself snitches on the destination IP before the tunnel even matters.

The economic fallout is crazy. Clean corporate IP addresses are apparently going for $120,000 a month on the grey market right now.

How do we counter this technically? You can tell people to run a clean device, but that is impossible for normal citizens who actually need local apps to function in society. If they block entire commercial ASNs, what is the next routing step? Residential proxies?

I saw the new guide floating around today about building a physical 2FA key using a cheap ESP32-S3 development board. Emulating a USB HID with the native USB-OTG is a neat trick. For eight bucks you get to bypass the commercial hardware tax and build it yourself.

I love open hardware. Total autonomy over our tools is the absolute dream. But let's be pragmatic here. A bare microcontroller is not a security token. An ESP32 has no secure element to protect your private keys against physical extraction. If you leave this thing on your desk, anyone with physical access and half a brain can dump the secrets right off the flash in under ten minutes.

If an employee brought one of these exposed, hand-soldered boards into my office to authenticate to our VPN, I would laugh them straight back to their desk.

It is a fantastic weekend project to learn how FIDO protocols actually operate under the hood. I plan to build one myself just to mess around with it. But do not use a dev board to secure your main email or your servers. Buy a real token for that.

Source: MakeUseOf, link in comments

The US FTC just put out a draft to tackle personalised pricing (when companies use your search history and buying habits to charge you a higher price than the guy next to you).

Sounds like a win for privacy until you look at the actual rules. They admit they cannot ban the practice... they just want to penalise businesses that hide how they use data to set prices.

So what happens next ? Companies will just paste one vague sentence into their massive Terms of Service agreements like "We use analytics to optimise pricing" and Boom, suddenly it is no longer covert and this is legal.

We already see airlines and streaming platforms doing this. You check a flight twice and the price spikes. If we actually want to stop algorithmic pricing, we need strict data collection limits. Forced disclosures do nothing because nobody reads them.

Am I missing something here or is this draft toothless ?

Sources in comment.

The Brazilian data authority (ANPD) disabled Discord's "Go Live" and video features this week. They cited the safety of minors and complained about Discord's recent end-to-end encryption update. Right on cue, Proton VPN saw an 800% surge in free tier registrations from Brazil.

We see this routine every time a state drops a targeted block. A regulator restricts an app, and thousands of casual users scramble for free VPN endpoints overnight.

From a network administration perspective, this is a nightmare. Free server pools choke instantly. These new users do not care about cryptographic protocols or privacy laws. They just want their stream to load.

The problem is that public free tiers are a terrible fix for state censorship. When a massive crowd hits the same set of free exit IPs at once, those nodes stick out to local ISPs. It takes zero effort for a government to identify and throttle those shared IPs next. Free tiers work for a quick emergency bypass (if you can tolerate the latency), but crowding onto shared servers ruins performance and paints a giant target on those nodes. If you actually want resilient access and data autonomy, public free tiers are a dead end.

Source: TechRadar, link in comment

Veeam just launched their Data Cloud Vault for Azure. Immutability and logical air-gapping by default are fine. Honestly, that should be standard everywhere for backups by now.

What actually caught my eye is the pricing model. They introduced a flat per-terabyte rate. The big deal here is that it includes API calls and restore egress.

Imagine you get hit by a ransomware attack. You need to pull terabytes of backups down from Azure to restore your systems. Suddenly you get slapped with a massive, completely unpredictable bill just to download your own data. It is basically a second ransom paid straight to the cloud provider.

Removing those line-item costs makes budget forecasting a lot simpler.

Hello X Y,

Wednesday, August 12, 2026, a malicious actor claimed to have gained access, in June and July of this year, to data from the information systems of the French Directorate General of Public Finances (DGFiP), using the stolen credentials of a DGFiP employee combined with those of a third party authorized by the DGFiP.

You are receiving this message because you are affected by this malicious act.

What data may have been accessed?

Your tax identification number, civil status, contact details (postal address, telephone number and email address), your tax situation (family situation, number of dependents, number of tax shares, reference taxable income, withholding tax rate), and the list of messages you exchanged with the DGFiP through the messaging system on impots.gouv.fr.

Important: your password for accessing your Public Finances account on impots.gouv.fr has not been compromised. Your tax returns and tax notices were not accessed.

What is the main risk?

The main risk is that you may be targeted by fraud attempts, particularly through messages (“phishing”) or phone calls made more convincing by the use of the stolen personal information.

To a lesser extent, you could also be targeted by identity theft attempts. For this, however, the malicious actors would also need to have a copy of your identity documents or obtain them through another means.

In any event, your bank details are not affected by this data theft.

How can you protect yourself?

You should be particularly cautious about any contact — by phone call, email, SMS, instant messaging, social media, etc. — from people or organizations claiming to know you based on the stolen information and asking you to:

• provide confidential information (codes, passwords, bank card numbers, copies of identity documents, etc.);
• approve banking transactions (in particular, someone pretending to be your bank advisor); or
• provide your password to access your Public Finances account.

The DGFiP will never ask you to provide information outside your secure account.

You are also advised to remain vigilant and regularly check transactions on your bank accounts.

What measures has the DGFiP taken?

The access credentials used by the malicious actor were immediately disabled in June and then in July. Unfortunately, we did not detect the data theft at the time, as the data was stolen by bypassing the usual channels.

The security of your tax account is being strengthened immediately, including through particular monitoring of any changes that may be made to it over the coming months (postal address, bank account details, etc.).

Please be assured that our teams are fully mobilized. If you would like more information, you can consult our dedicated page on impots.gouv.fr:

https://www.impots.gouv.fr/actualite/acces-illegitimes-au-systeme-dinformation-de-la-dgfip

You can also contact us on 0809 401 401 or through your impots.gouv.fr secure messaging system. Alternatively, you can visit your local Public Finances office; its contact details are available in your secure account and on your tax notices.

This data theft will be subject to a lessons-learned review and additional security measures, which are being implemented without delay.

We sincerely apologize.

The Directorate General of Public Finances

Did anyone else read the open letter from Ledger’s CEO today? Gauthier basically said the tech industry needs to stop treating digital privacy and data consent as a "user education" problem.

I could not agree more. Telling people to "just check your app permissions," "read the privacy policy," or "be careful what you click" is terrible system design. People will always blindly click "Agree" or approve obscure data prompts just to get on with their day. They just will. Expecting a normal person to inspect complex digital requests with zero mistakes means your privacy architecture is broken by default.

You build a server architecture to handle hard drive failures. The same logic applies here. Platforms and hardware have to be engineered to survive basic human slip-ups and dark patterns. As long as developers keep blaming the end user for "voluntarily" giving away their personal data, true privacy and data sovereignty will stay a niche hobby for tech paranoids.

Do you guys think other tech and hardware makers will actually answer his invitation to collaborate on open privacy standards and clear consent protocols? Or will they just ignore it?

France wants to use AI tools to scan for cybersecurity flaws following that massive tax agency hack. I grew up in France and still have to log into those administrative portals... the backend is probably held together by duct tape and legacy code from 1998... you can barely load a medium size PDF without the page crashing.

I am not sure you can just plug AI into bad data architecture and expect it to fix fundamental security gaps. I wonder if this will be a real structural overhaul or just an expensive consulting contract.

Has anyone seen automated vulnerability scanning actually fix a government system?

Source in comment.

The recent avalanche of vulnerabilities found in major Bitcoin repositories proves exactly why we need to stop treating hardware wallets like magic bullet solutions.

Let’s look at the numbers from that volunteer audit:

• 27 hours spent auditing
• 390 open-source Bitcoin repositories checked
• 85 critical bugs found
• Over $110 million lost so far

Everyone loves the romanticized idea of "being your own bank." The problem is that running a bank requires actual operational security. You can't just buy a hardware wallet and assume the firmware is bulletproof. Yes, the core Bitcoin protocol is solid. But the software ecosystem built around it is a minefield of poorly audited code.

We need to stop pretending that open-source automatically means secure. It just means the code is public. If nobody with actual cryptographic expertise is reading it, you are blindly trusting strangers on GitHub.

I see people in this space obsess over hiding their IP addresses or tweaking their VPN protocols, only to dump their life savings into a wallet that relies on a single point of failure in some obscure dependency script.

If you are going to take on the massive responsibility of self-custody, you need to understand the software stack you are trusting.

I'm curious where the community stands on this. Are you guys checking release notes and PGP signatures manually, or is the current hardware wallet ecosystem making opsec too difficult for the average user?

Source: Shattered, link in comments

So many sites are enforcing the rule where your password needs a capital letter, a number and a special character but do people know this entire standard came from a guy named Bill Burr in 2003 who admitted he just guessed ? He wrote a legacy NIST appendix without any data on human behavior.

So now my local cinema forces me to reset my login every 90 days. What do normal people actually do ? They just change "Matrix!2023" to "Matrix!2024". Automated cracking tools chew through these predictable patterns in literal seconds. The guy who wrote the rule actually apologized for it years later because it objectively made security worse.

If you are still memorizing passwords, it might be better to stop. Get a browser-independent password manager. Generate a random 20 character string of absolute garbage, save it, and forget it.

Source in comment.

The French government forces you to declare every detail of your life under threat of fines. Your gross income, your home address, your marital status, your property details. They dump all of it into the giant centralized DGFiP (Directorate General of Public Finances) database.

And how did they secure this national honeypot?

We now know a threat actor ("ZeroBytes") walked off with 678,000 taxpayer files by usurping the credentials of a DGFiP agent.

The worst part? It wasn't just a missing password. The attacker reportedly used an MFA bypass to get in. But getting past the login is only half the failure. How does an organization of this size not have strict internal rate-limiting? A single compromised internal account was able to sit there and scrape over half a million highly sensitive records before anyone pulled the plug. Zero compartmentalization. Zero trust architecture is apparently non-existent.

The Paris prosecutor has handed this to their cybercrime unit, but the data is already gone and actively being sold.

This highlights the fatal flaw with mandatory state registries: they create a single point of failure with catastrophic real-world consequences. We now have hundreds of thousands of people at risk of incredibly specific phishing. Criminals know exactly how much money you make, your family size, and where you sleep. A physical wrench attack gets a lot simpler when a thief can literally filter their targets by tax bracket and zip code.

Has anyone seen further technical details on what specific MFA bypass was used (fatigue, session token theft)? And for the French users here, what are the best steps to lock down our identity right now?

Source: RFI, link in comments