TL,DR: If you have a KARR sticker on your window, your car probably has a dongle in it that may leave it susceptible to hacking, including remotely unlocking it and disabling the engine. You can update the firmware and/or ask KARR to come and remove it.

You can learn more about the security risk by searching for "UC San Diego KARR Aaron Schulman" which will get you to the researchers at UCSD who discovered and documented the risk.

Details: When I bought my Ioniq 5 eighteen months ago, the dealer asked me if I wanted to subscribe to the KARR security system. I declined. Today I learned:

• Dealers install the KARR security device in their cars to prevent them from getting stolen off the lot -- it lets the dealers remotely disable the ignition if needed.
• The KARR device connects to the CAN bus in the car, giving it access to lots of important functions, like door locks, horns, lights and ignition
• If you tell the dealer you don't want to pay for the KARR system, they leave it installed and "dormant", but it's still susceptible to hacking.
• If you have a KARR dongle in your vehicle, the least you should do is download the KARR Security app, click on the Customer Service button at the bottom, and then click on "firmware update" to remove the vulnerability. If you're not a subscriber, this theoretically disables the device, but also prevents the app from communicating with the device, so it's not clear if the device is truly deactivated.
• If you're like me, you want to reduce the risk and also don't want an extra device sucking down your 12v battery 24 hours a day. In that case, you can call the KARR Customer Service number and schedule a tech to come remove the device, free of charge.

Whew. Who would have thought?

A New Jersey school district is using an app that geofences students' personal phones to shut down most capabilities during school hours. Parents are pushing back over privacy concerns, particularly around location tracking. The superintendent says it's optional, but critics argue families weren't consulted before implementation.

As many data breaches we’ve seen in recent years, I have no idea how we can circumvent this. Has anyone responded to this craziness. I only have Verizon & Comcast in my city.

I'm giving a speech in town hall soon for a school project, and the topic I chose was Flock cameras. I did a lot of research and wrote up this whole thing, only to find out that all of the Flock cameras in my town are on private property, and the city only owns Motorola cameras. I'll still bring up Flock, but since the city doesn't own any, I dont want that to be the bulk of my speech.

Currently, I've modified the speech to just talk about ALPRs in general, and the partnership between Motorola and Flock meaning potentially shared data and vulnerabilities. I'm not asking anyone to write me an essay, but it seems like there's not a lot of research on motorola yet, and I'd love if someone could point me towards an article or video that explains more.

Hearing this story was very unsettling.

I have been working on the assumption that if my phone was stolen, it is just a brick, since it's encrypted and locked with biometrics and a strong password.

A friend was robbed at gunpoint (while out for a run!), and they made her unlock the phone, so they could turn off the data connection and have access.

If her password manager was unlocked - or autofill was turned on - they could then go to her bank, access her accounts, and the 2FA would be right in their hands already.

If my phone was stolen, my first move would be to have T-Mobile cancel my number to protect my 2FA. Then I would want to change my important passwords. But how do you regain access to your accounts so you can change passwords, etc. if you don't have your phone number for 2FA?

Lessons I learned from hearing her story:

1. Never leave your password manager unlocked. I use 1Password, and it is always locked when the phone is locked. I can unlock it with my fingerprint or password. I do have somethings in auto-fill in Chrome, but nothing critically important.

2. Consider moving away from 2FA to something else. I use Ente as my authenticator for about 100 sites, but many, including my bank, use my phone number for 2FA. Should I be moving everything away from my phone number as 2FA? Should I move to a YubiKey or similar? And I usually leave my Ente unlocked on my phone - need to change that.

3. Don't allow text messages (2FA codes) to appear on the lock screen.

4. Anything else to consider here?

As most of you probably know, even if you turn on Advanced Data Protection on iOS, Apple doesn't E2E encrypt contacts due to legacy CardDAV support. Obviously, this isn't just an Apple issue (Android and standard Google sync have the exact same problem), but iOS is just the ecosystem I'm using right now.

Between cloud exposure and third-party apps always begging for full address book access, I'm trying to clean things up. The goal is to delete people I rarely talk to from my native iOS Contacts app and move them to a separate, encrypted, sandboxed app.

I already use Proton, but Proton Contacts is baked directly into the Proton Mail app. There's no standalone contacts app, so it ends up mixing my actual phone contacts with every random email address I've ever replied to. It gets messy fast.

Right now, my only real workaround is saving them as Identities / Secure Notes in Bitwarden or in an encrypted notes app, but I'd prefer an actual dedicated contacts manager if one exists.

Does anyone know of a solid, privacy-focused standalone contacts app on iOS that keeps its own encrypted database rather than just syncing everything back into the native Apple Contacts pool? What is everyone else doing to handle this?

Organizations often keep internal access logs for security teams while the person described by the data sees only a generic privacy notice. A user-facing record could show when access occurred, which organization or system accessed it, the category of data, the stated purpose, whether it was exported or shared, and the retention or appeal path. Full detail can create new privacy and security risks by exposing employee identities, investigation methods, or other people's records. Where should that boundary sit? Would delayed disclosure, role-level identities, tamper-evident event IDs, and exceptions that require later review provide meaningful transparency without turning the audit log into another sensitive dataset?

How can I manage using my school email account and keep my privacy away from Google if my school email is through Gmail?

Apple Maps used to be the best at exploration and discovery since they partnered with Yelp, but Apple Maps has become insufferable. Yelp too while I am at it. Waze seems to be driving only and is glorified Google Maps anyway. Organic Maps/CoMaps are focused on outdoor trails, hiking, and biking. Magic Earth has no info on points of interest.

https://www.commerce.senate.gov/press/rep/release/cruz-schatz-meta-settlement-underscores-need-to-pass-kosma/

“We are pleased the settlement agreement reached between dozens of state attorneys general and Meta will require the company to take actionable steps to remove kids under 13 from social media platforms like Instagram and Facebook. However, this settlement agreement does not apply to every Big Tech company in all 50 states. It is past time for Congress to pass the Kids Off Social Media Act and protect every child in every state on every social media platform from exploitative Big Tech practices and the harmful effects of social media.”

https://www.congress.gov/bill/119th-congress/senate-bill/278

"Specifically, the bill prohibits social media platforms from knowingly allowing children under the age of 13 to create or maintain accounts. Platforms must delete existing accounts held by children and any personal data collected from child users. Platforms are also generally prohibited from using automated systems to suggest or promote content based on personal data collected from users under the age of 17. The bill directs the Federal Trade Commission to enforce these provisions. States may also bring civil actions against platforms whose violations of these provisions have adversely affected their residents."

Hi everyone. Recently, I've been interested in looking into ways on how privacy preserving data publishing of graph data is done. I came across the concept of k-anonymity applied for structural data. I came across k-anonymity adaptations for undirected networks. There were several privacy protection models defined, such as degree and 1-hop neighborhood as the quasi-identifiers.

However, I'm not sure if they are widely used in practice or are they concept papers. I was looking for practical implementations and didn't come across solutions that readily available.

Is k-anonymity as a concept deprecated and not used anymore, or is differential privacy the norm?
Also, what is the data protection regulations for k-anonymity is like? Is there a defined k-value that data publishers should consider? Where can I learn more about this?

PS: I have a twitter directed data, which consists of hubs and other graph structural properties that I would the consumer to go through without revealing the identities of those individuals.

When I went to check my BP today, my OMRON app required an account sign-in. I don't have an account for this app though, so I looked into it and saw they are now requiring profile creation to use their devices to collect health data. When you create an account, it WIPES YOUR PREVIOUSLY STORED HEALTH DATA. There was no way to access this data beforehand to back it up, so it's just lost forever and I'll have to basically restart recording so I have a proper set of info for my doctor.

There is an option you have to select to opt-out of your consent for them selling your personal data. This is incredibly scummy for a health-app like OMRON.

You may be able to opt-out of that, but that they are doing it at all breaks my trust in the company entirely. I won't be using their devices anymore and I've already started looking into alternatives.

Really sucks as the device was decent until now.

Gauging how other internal audit teams are reviewing AI tools that touch sensitive audit evidence. Internal audit can see employee data, vendor contracts, financial records, system access evidence, control documentation, and management responses. But if an AI tool summarizes or analyzes that material, I need to know where the data goes, how long it is retained, who can access it, and if the output is explainable. For teams reviewing these types of tools, what privacy review process are you using? And do you require a data inventory, vendor questionnaire, retention review, model use restriction, legal approval, or separate AI risk assessment?

The recognition that the risks of abuse of this system outweigh the benefits is a big shift in how the city has approached law enforcement work in the past. I hope this continues as we all face a growing surveillance state. A big part of freedom, is the right to privacy. A society loses that when they are under constant surveillance.
The city appears to have so little confidence that Flock will not continue to collect data, they have gone around to “bag” all of the cameras while they wait for Flock to come collect their shit.

Hello i have some media/text files and i want an app that could lock them with a password only without compression

Thanks in advance

https://energycommerce.house.gov/events/cmt-subcommittee-markup

The RESET Act, Reducing Exploitative Social Media Exposure for Teens Act, demands that companies delete account that don't prove they are over sixteen.

"(1) IN GENERAL.—A covered platform may not allow an individual to create or maintain an account or profile on the covered platform if the covered platform knows that the individual is a minor.

(2) TERMINATION OF EXISTING ACCOUNTS.—A covered platform shall— (A) not later than 60 days after the date of the enactment of this section, identify any account or profile of a user on the covered platform that the covered platform knows is a minor; (B) not later than 180 days after the date of the enactment of this section, notify any user of an account or profile identified under sub-paragraph (A) that the covered platform will terminate the account or profile of the user; and (C) not later than 30 days after the date on which a user is notified pursuant to sub-paragraph (B), terminate the account or profile of the user."

Just saw the news that CS2 chat logs got leaked through a cheat tracker. I don’t play CS2 but I have played TF2 with a very long history (another Steam game). Over the course I have said a few things which I would not care to repeat and deeply regret. For clarification I do not have a pattern of extreme language but there have been a few cases that I can count on one hand.

With the advancement of AI, my worry is that maybe in the future if TF2 chat logs get leaked maybe it could be used against me and my employment future or housing through algorithms etc. I know it’s a rare scenario but are there any measures I can take to avoid this such as deleting my account or changing my url etc?

Thanks

Idk if this is even the right place for this. These ads are too much. Every other ad on this app is telling me to get evaluated for autism. It's getting old. I have no idea why this started, like is it that obvious and this site knows me better than I know myself or what? I've never been diagnosed but yeah I'm probably autistic. But it's getting weird.

Yesterday I went off my diet one fucking day and ate too much and suddenly I am seeing all kinds of ads about binge eating disorder. How in the fuck does reddit even know how much I ate yeaterday? Literally. How? It wasn't fast food that I ordered online or anything like that, so how? No I don't believe it's a coincidence. I have never in my life seen an ad about binge eating disorder. Never researched anything about binge eating disorder, I don't watch Ariana Grande content or anything like that. I don't look at food content online. I don't even have binge eating disorder. How does this even happen?

I’m signing up for a website and it wants a picture of my drivers license and the privacy policy basically says they’ll share it with whoever’s associated with them, so it big blanket of who they can give it to.

How much is an average persons info already out there, to where it would be pointless in trying to hold out on signing up for this?

TL;DR California’s legislature has passed Assembly Bill 1856, exempting open-source operating systems from the State’s Digital Age Assurance Act months before the law is due to take effect on January 1, 2027. The Senate amended the Bill on August 21 before passing it on the 26th in a 39-0 vote, with the Assembly then accepting these changes in a concurrence vote the following day. The amendment ends almost a year of uncertainty surrounding whether Linux distributions and SteamOS would be forced to collect user age data during account setup alongside Windows, macOS, iOS, and Android. AB 1856 has now been sent to Governor Gavin Newsom, who signed the original act into law last October.

Source: https://www.tomshardware.com/software/linux/california-lawmakers-unanimously-pass-linux-exemption-from-age-verification-law-software-distributed-under-the-gpl-mit-bsd-and-apache-licenses-are-exempt?fbclid=Iwc

UPDATE: I had to read it carefully. This appears to be the relevant excerpt:

(2) “Operating system provider” does not mean a person or entity that distributes an operating system or application under license terms that permit a recipient to copy, redistribute, and modify the software.

Source: https://legiscan.com/CA/text/AB1856/id/3456513/California-2025-AB1856-Amended.html