Privacy & Surveillance
Cybersecurity news in this category
One Underscore, 18 Months in Prison: Username Typo Sends Innocent Man to Jail
Free VPNs Fail Within Days as Russian Filters Detect Tunnels Without Decrypting Traffic
Why Simple VPNs No Longer Suffice Against Advanced DPI Blocking Telegram, Reels and Google AI Studio
Personal Digital Resilience: Strategies to Secure Access Chains and Preserve Data Portability
The article explores how individuals can strengthen their digital infrastructure against service outages, lost access, and data loss without turning maintenance into a full-time project. It defines digital resilience through two pillars: security against unauthorized access and reduced dependence on any single provider, especially when regulators in different jurisdictions interfere. The author maps real-world processes to digital services, access methods, and stored data, then outlines recovery formulas for each failure scenario. Practical steps include auditing password-manager entries, eliminating circular dependencies, separating recovery roots by jurisdiction, and exporting data in portable formats. Special attention is given to secrets such as TOTP seeds and recovery codes, which are stored in an encrypted offline archive whose master password exists only on paper. The resulting structure features two independent trees rooted at Yandex and Google, with all critical services backed by verifiable exports and tested recovery paths.
Phantomdrive Open-Source USB Drive Conceals Encrypted Storage to Resist Coercion
Developer Ryan Walker has released Phantomdrive, a fully open-source USB device that initially appears as an 8 GB drive while hiding the remaining capacity from the operating system. The gadget uses a CH569 microcontroller with hardware AES support and an SD card for storage, switching to a hidden encrypted partition when a specific password string is written to a text file. It employs a key derivation function with 100,000 rounds of SHA-256 combined with a unique device salt derived from the USB serial number to strengthen password security. The project supports AES-CTR mode by default for performance reasons, delivering up to 20 MB/s reads, while AES-XTS is available as a slower but more robust alternative. All firmware, hardware schematics, and mechanical designs are published under open licenses, and the device is physically secured with epoxy resin to deter tampering. Walker acknowledges earlier community criticism regarding cryptographic implementation details and has addressed functional testing against OpenSSL references.
DeepSeek User Conversations Appear in Google Search Results via Publicly Shared Links
Conversations between users and the Chinese AI service DeepSeek, including Russian-language exchanges, have surfaced in Google search results. The exposed pages belong to Shared Conversations that users themselves made public through shareable links. These pages display full question-and-answer histories along with the names of any uploaded documents. No actual breach of DeepSeek occurred, and security researchers note that search engines indexed similar public chatbot dialogues more than a year ago. MWS AI confirmed that no closed chat histories or account access were exposed. Meanwhile, Yandex stated that links to conversations with its Alice AI assistant are blocked from indexing, remain active for only 14 days, and do not transmit attached files to recipients.
What Makes a Quality Anti-Detect Browser and Why Aurorium Built Its Own Solution
Aurorium explains the current state of the anti-detect browser market and why most existing tools fall short for professional use. The company highlights that true anti-detect browsers must modify browser fingerprints at the kernel level rather than relying on JavaScript injections. It details how solutions like incognito mode, virtual machines, and browser extensions fail to provide proper isolation and spoofing. Aurorium emphasizes its own approach of modifying Blink and V8 engines directly in C++ to create consistent, undetectable profiles. The article also covers legitimate use cases including QA testing, OSINT research, SEO monitoring, and secure web scraping. Advanced fingerprinting techniques such as Canvas and WebGL noise injection are explained alongside methods to detect superficial spoofing attempts.
LG Monitors Automatically Install McAfee App via Windows Update Without User Consent
Home users of Microsoft Windows have discovered that certain LG monitors automatically install companion software upon connection to a PC, followed by prompts to try a trial version of McAfee antivirus. The installation occurs through the standard Windows driver and software delivery mechanism without providing a clear, separate confirmation dialog. The LG Monitor App Installer requests broad access to system resources, raising concerns even though the application itself is not classified as malicious. YouTube channel Gamers Nexus identified the behavior across both new monitors and models released approximately three years ago, including units previously used in office environments. Manufacturers commonly supply utilities for display calibration, firmware updates, and monitor management, yet the process becomes problematic when it serves as an entry point for optional software and advertising. Users are advised to review installed applications and remove unnecessary LG utilities, while organizations should monitor automatic software deployment after connecting peripherals. Neither LG nor Microsoft has commented on the issue at the time of publication.
VPN Services Stabilize in Russia? Expert Warns Users Not to Relax as New Blocks May Be Coming
Russian users have recently noticed that personal VPN services and anonymizers are operating more stably after months of aggressive disruptions. Technical director Sergey Shcherbakov of the company Stakhanovets explains that the current improvement is likely only a temporary pause while deep packet inspection systems recalibrate. Earlier this year, DPI equipment was blocking traffic based on crude digital fingerprints of protocols such as OpenVPN and WireGuard, causing widespread collateral damage and connection drops. Operators are now believed to be collecting detailed data on ports, reconnection patterns, and obfuscation techniques to build more precise filters. Shcherbakov predicts the next wave of restrictions will arrive by late summer or early autumn, possibly shifting from outright blocks to throttling speeds during peak hours and delaying large file transfers. Meanwhile, users have adapted by maintaining multiple VPN clients, switching protocols and ports, and enabling obfuscation when needed.
Mimolet Dating App Shows Strong Data Protection Practices in Photo Handling, Moderation, and Infrastructure Review
A detailed technical review of the Russian dating service Mimolet reveals several well-implemented security and privacy measures across its photo upload pipeline, content moderation systems, and infrastructure choices. The app processes every uploaded image by validating its actual content rather than file extension, strips EXIF metadata, resizes it, and stores only the cleaned version. Public images undergo pre-publication checks using two AI models plus an additional verification pass before they appear in group chats or profiles. Complaints and blocks are available to all users without requiring a subscription, and moderator decisions are logged for accountability. The core API and database run in Russia while media files are stored in a domestic S3-compatible object storage, and the main AI features operate on dedicated GPU infrastructure managed by the team. The review highlights two areas needing improvement: clearer data retention timelines and a dedicated, trackable appeals process for blocked accounts.
Mimolet Dating App Review Highlights Privacy Protections, AI Moderation, and UX Trade-Offs in Detailed Analysis
A comprehensive review of the Mimolet dating application examines its registration process, vertical profile feed, free filters, and advanced communication tools including built-in calls and AI-assisted messaging. The analysis praises detailed profiles visible directly in the feed, free access to comprehensive search criteria, and strong privacy measures such as automatic EXIF metadata removal from photos and primary data storage within Russian server infrastructure. It also covers public interest-based groups, pre-publication image moderation using multiple AI checks, and transparent complaint handling that does not require a subscription. Concerns are raised about lengthy registration potentially reducing user completion rates, the inclusion of weight as a searchable filter, unclear data retention timelines, and the lack of a formal appeals process for blocked accounts. The app offers three paid tiers focused on visibility and extra AI features while keeping core communication and moderation tools free, with approximately 200,000 registrations and 15,000 daily active users reported alongside retention rates of 44.96% at day three and 19.11% at day thirty.
69% of Browsers Worldwide Vulnerable: How Chrome Sync Enables Stealth Surveillance Without Malware
Google Chrome's standard synchronization feature can be silently abused to turn any browser into a surveillance tool, requiring only brief physical access to a victim's device and the addition of an attacker's Google account. Security researchers at Certo highlighted the technique after multiple cases involving intimate partner surveillance, including one incident where a woman’s visits to a family lawyer and domestic abuse support sites were monitored in real time by her partner. Once sync is enabled, browsing history, bookmarks, open tabs, autofill data, and saved passwords are automatically transmitted to the attacker’s profile, which can be viewed from any device worldwide without needing the victim’s password or installing spyware. Chrome provides no prominent warnings about new profiles or active synchronization, and alerts about logins are sent only to the account owner rather than the device owner. With Chrome holding a 69.65% global market share according to StatCounter data from June 2026, the method potentially affects millions of users on Android, iOS, Windows, and macOS. Experts recommend regularly checking connected profiles in browser settings, using Incognito mode for sensitive activity, securing devices with strong passcodes and biometrics, and immediately removing unknown accounts while changing important passwords.
Russia's МВД Proposes Mandatory Purchase of Special Smartphones for Migrants to Enable Permanent Digital Location Tracking
Russia's Ministry of Internal Affairs is advancing plans to replace paper-based migration controls with continuous digital surveillance by requiring labor migrants to purchase a dedicated smartphone upon entry. Deputy Minister Igor Zubov announced that the device would create an electronic profile allowing police to monitor the owner's movements in real time and prevent unauthorized relocation between regions. The initiative builds on the existing "Amina" app already mandatory in Moscow and the Moscow region since September 2025, which has already led to more than 139,000 migrants being removed from registration. From July 2026, all visa-free foreigners must use the RuID app to create digital profiles, while a unified МВД database containing documents, employment, housing, fines, and phone numbers is already operational. The new proposal differs from current rules by making the purchase of a government-specified device a condition of entry rather than simply installing software on an existing phone. Human rights advocates, including Svetlana Gannushkina, have previously criticized similar ideas, noting that forcing migrants to buy expensive devices is unlawful given financial and technical barriers. The plan remains a future proposal and has not yet been enacted into law.
Telegram Will Not Allow Scanning of Private Chats — Pavel Durov Strongly Criticizes EU Over Chat Control Initiative
Pavel Durov has sharply criticized the European Union following renewed discussions on the Chat Control law, which could mandate or encourage scanning of user messages, emails, and photos in online services to detect prohibited content. The Telegram founder described the tactics used to advance such surveillance legislation as reminiscent of those employed in banana republics, emphasizing that private user correspondence must remain protected from mass monitoring. Durov explicitly stated that Telegram will not implement any scanning of personal messages regardless of regulatory pressure from the EU. The European Parliament has returned the controversial bill for further consideration, with earlier versions proposing voluntary scanning by platforms to identify illegal material. Critics argue that the initiative effectively creates a mechanism for widespread surveillance of private communications under the guise of safety, while supporters claim it is necessary to combat illegal content and protect users. Telegram continues to position itself firmly on the side of privacy, refusing to turn personal chats into subject matter for automated government monitoring.
Windows Tracks Users Through Persistent GDID Identifier: How to Minimize Your Digital Footprint
A recent case involving a 19-year-old hacker identified through his Windows installation has highlighted how Microsoft’s GDID creates a permanent device fingerprint that survives VPNs and IP changes. GDID serves as a constant identifier across licensing, Microsoft Store, telemetry, and other services, making it difficult for users to stay anonymous even when changing networks. While there is no single button to disable this functionality completely, several practical steps can significantly reduce the amount of data Windows sends to Microsoft. These include switching to a local account instead of a Microsoft Account, disabling activity history, limiting optional diagnostic data, and turning off unused background services such as Phone Link and cloud synchronization. Experts note that simply reinstalling Windows does not erase the link if the same Microsoft Account is used afterward. The story underscores the ongoing trade-off between privacy and convenience in the Windows ecosystem.