Privacy & Surveillance
Cybersecurity news in this category
Telegram Desktop Adds WEB Proxy to Hide MTProxy Traffic Inside HTTPS and WebSocket Connections
Gesture Dynamics CAPTCHA Emerges as Privacy-Focused Drop-in Alternative to reCAPTCHA
Cat Tunnels Service Deploys Kotator-Rotator to Counter Mass Blocking of Relay Nodes in Russia
Google Chrome Tests Visible Global Privacy Control Toggle in Canary
Google is testing a new visible toggle for Global Privacy Control in Chrome Canary that lets users send a standardized request asking websites not to sell or share their personal data and not to use it for targeted advertising. When enabled, the browser adds the Sec-GPC: 1 header to web requests and exposes the setting via navigator.globalPrivacyControl. In regions with supporting laws such as California's CCPA, the signal can serve as a formal opt-out from data sales. The feature currently appears primarily on Android, with experimental flags available on Windows, macOS, Linux, and ChromeOS, though the desktop interface remains incomplete. Two separate flags are requiredโone to show the toggle and another to actually transmit the signalโbecause enabling only the UI does not send Sec-GPC: 1. The mechanism is not a guaranteed enforcement tool; websites decide how to respond, and effectiveness depends on legal frameworks and site compliance. The feature is absent from the stable Chrome release and may still change before wider rollout.
OpenAI ChatGPT Computer History Feature on macOS Could Expose Detailed User Activity Logs to Infostealers
OpenAI has introduced the Computer History feature in its macOS ChatGPT app, which records application switches, clicks, keystrokes, and accessibility context to generate AI summaries and memories. The feature is disabled by default and requires explicit activation of Memories, with availability limited to Pro, Business, and Enterprise users outside the EEA, Switzerland, and the UK. While raw event files are deleted after 48 hours and not used for model training, the resulting Markdown memory files remain unencrypted on the local Mac. These files can be read by any process running under the same user account, creating a ready-made activity log for infostealers and other malware. OpenAI also warns about prompt injection risks where hidden instructions from websites or apps could influence ChatGPT or Codex behavior. Users retain controls to select participating apps, pause collection, or delete history, but the lack of encryption on stored memories raises significant privacy concerns.
AirTag and SmartTag: How to Detect If a Bluetooth Tracker Is Following You
Phones can now warn users when an unknown Bluetooth tracker such as an Apple AirTag or Samsung SmartTag is moving alongside them for an extended period. The alerts do not automatically confirm stalking, since the same tags can be left in taxis, rental cars or borrowed bags, yet they should never be ignored. AirTag and SmartTag rely on crowdsourced Bluetooth networks rather than built-in GPS or cellular connections, allowing them to report approximate locations only when nearby phones relay the signal. The article details differences from traditional GPS trackers, explains how to interpret notifications on iOS 17.5+ and Android 6.0+, and provides step-by-step guidance for locating hidden devices in clothing, vehicles or personal items. It also covers immediate safety actions, evidence preservation for police reports, and practical steps to reduce future tracking risks through account and permission hygiene.
VPN Encryption Alone Cannot Hide Traffic from Network Detection Systems
A Habr user known as mr_tom detailed why encrypted VPN connections remain detectable despite their encryption. Observers can identify connections through visible metadata such as server IP addresses, ports, transport protocols, handshake patterns, packet sizes, timing intervals, and overall flow behavior. Simple DPI systems block traffic by restricting known IPs or ports, while advanced filters build traffic fingerprints and use active probing to verify suspicious endpoints. The popular combination of VLESS, XHTTP, and REALITY operates across different layers rather than functioning as three equivalent VPN protocols. Even traffic on port 443 can be distinguished from standard HTTPS by analyzing handshake details and subsequent packet behavior. The core conclusion is that no universally unblockable VPN exists, as detection can rely on IP blocking, new signatures, or active verification regardless of encryption strength.
Browser Extension Anonymizes Sensitive Data Before Sending to AI Chatbots
A new browser extension automatically detects and replaces sensitive information such as names, INN numbers, bank cards, and emails with pseudonyms before any text or files reach AI chat services. The tool operates entirely locally in the browser, ensuring original data never leaves the user's device while allowing AI models to process anonymized placeholders. Responses from the AI are decrypted back to readable form only on the user's screen using an in-memory mapping that disappears when the browser closes. The solution supports over 70 file formats including DOCX, XLSX, and PDF, plus offline OCR for scanned documents to handle the most common leakage vectors used by HR, legal, and accounting teams. Multiple validation layers including checksums, Luhn algorithm, entropy checks, and normalization for Russian name declensions reduce false positives that plagued earlier regex-based attempts. The extension is available in a free version on the Chrome Web Store covering 33 data categories, with advanced file and scan features offered on request.
Browser Privacy Ranking 2026: Tor Browser Leads at 9.5 While Chrome and Yandex Rank Lowest
SecurityLab.ru has published a detailed 2026 browser privacy ranking that evaluates major browsers across six criteria including initial network behavior, site isolation, fingerprint resistance, funding model, configurability, and code auditability. Tor Browser scores highest at 9.5 for its comprehensive protections including unified fingerprinting and layered JavaScript controls, followed by Mullvad Browser at 9.0 and LibreWolf at 8.5. Brave earns 7.5 for built-in tracker blocking but faces criticism over default telemetry and cryptocurrency features. Firefox scores 6.0 out of the box yet reaches 8.5 after extensive configuration, while Google Chrome, Microsoft Edge, Opera, and Yandex Browser occupy the bottom positions due to persistent tracking mechanisms and closed-source components. The report also highlights the Local Mess localhost tracking technique used by Meta and Yandex that bypassed browser isolation entirely.
Russian Ministry Certificates Enable Potential State MITM on Foreign Domains
Russian companies facing sanctions have started adopting root certificates issued by the Ministry of Digital Development and Communications to maintain HTTPS access after commercial CAs revoked or refused to renew their certificates. Installing these Ministry certificates allows browsers to trust sites using Russian national CAs but also creates a pathway for man-in-the-middle interception by state-controlled entities. The article details a concrete threat model where a government-linked operator could use the Ministry root to generate on-the-fly certificates for any domain, including foreign services outside Russian jurisdiction. To mitigate this, the author demonstrates how to re-sign the Ministry root with OpenSSL nameConstraints limited to .ru, .su, and .ัั domains only. Tests on macOS with Homebrew show that the constrained certificate still validates Russian banking sites such as online.sberbank.ru while correctly rejecting attempts to validate foreign domains like sberbank.com. The technique requires users to maintain their own cross-signed root and never rely on pre-installed Ministry or Yandex Browser roots for full protection.
Bypassing Blocks, Privacy, and Anonymity Remain Separate Challenges for Decentralized Networks
The developers of the decentralized circumvention tool Tunnel Cat have clarified that their service addresses only traffic delivery and does not guarantee privacy or anonymity. Transport-layer TLS encryption protects data in transit between nodes but provides no end-to-end protection for conversation content. The team explicitly recommends using separate E2E-encrypted messengers such as Signal or Matrix rather than relying on Telegram. Operational telemetry is retained to comply with legal obligations in multiple jurisdictions and to monitor blocking patterns inside Russia. Because client devices relay traffic for others, the architecture inherently prevents strong anonymity guarantees comparable to Tor. The project deliberately separates the circumvention function from messaging and anonymity tools to avoid overpromising security properties.
How to Detect and Remove Stolen Photos from Fake Profiles, Listings and Ads
Photos are frequently stolen from social networks, old listings, building chats and review sites, then reused in fake profiles, advertisements and rental scams. Russian law under Article 152.1 of the Civil Code protects the right to one's image, while separate copyright rules protect the photographer. Victims are advised to gather strong evidence including full-page screenshots, PDF copies and original files before contacting platforms. Search tools such as Yandex Images, Google Lens and TinEye help locate copies across multiple services. Complaints can be filed directly with site administrators on VKontakte, Odnoklassniki, Avito and Telegram, or escalated to Roskomnadzor and police when personal data or fraud is involved. Preventive steps include lowering image resolution, adding watermarks and restricting album visibility through privacy settings.
Configuration Drift Silently Breaks Multi-Hop Chains in sing-box Reality Fleet
A post-mortem analysis of a censorship circumvention network using sing-box and Reality revealed that four out of seven nodes were unreachable due to outdated allowlists, even though all monitoring reported green status. The fleet consisted of 14 endpoints across seven machines and four providers, with traffic routed in two hops where entry nodes only knew client identities and exit nodes only knew destinations. White-list rules on entry nodes permitted only five addresses instead of all required relays, causing urltest to silently discard most chains without logging failures. Canary checks, external probes, and the relay-lockdown.sh script all passed because none compared the allowlist against the full signed configuration. Two private paid nodes lacked any route section entirely, exposing them to potential abuse. The issue stemmed from configuration drift over time, with no single person maintaining an overview of the entire system. Automated fixes were implemented with safeguards to prevent fleet-wide lockouts.
Why Distributed Mesh Architectures Resist IP Blocking Better Than Centralized Servers
The article explains the fundamental limitations of single-server or small-server setups when facing IP-based censorship and DPI systems. A centralized infrastructure relies on a finite, relatively static list of addresses that can be discovered, tracked, and blocked over time. In contrast, a client-side mesh turns user devices into active transport nodes that relay traffic peer-to-peer, creating a constantly changing set of endpoints. This architectural shift transforms address blocking from a one-time list-maintenance task into an ongoing discovery problem. The design still requires an auxiliary trust and coordination layer called the backbone network, while anti-DPI techniques such as ClientHello rotation and decoy traffic protect individual connections. The approach carries real costs in battery life, bandwidth, and operational complexity on client devices.
Chrome Adds On-Device Gemini Nano While Ask Gemini Sends Page Content to Google Cloud
Google has introduced an 'AI on device' toggle in Chrome settings that enables local execution of the Gemini Nano model directly on the user's computer. Several gigabytes of Gemini Nano weights are now stored in the browser profile directory and can run on CPU or GPU for tasks such as initial analysis of suspicious pages. Despite the local model being present, the user-facing 'Ask Gemini' feature does not use it and instead routes page content, URLs, and up to ten additional tabs to Google's cloud infrastructure. The company uses two distinct systems under the Gemini name: the cloud-based Ask Gemini / Gemini in Chrome service and the on-device Gemini Nano accessed only through internal APIs or by websites and extensions. When Enhanced Protection is enabled, results from the local Safe Browsing analysis may still be transmitted to Google Safe Browsing servers. The naming and interface choices have created confusion, as users cannot directly invoke the downloaded Gemini Nano model for tasks like summarizing open pages.
Yandex Details Alice Voice Assistant Audio Buffering and Data Handling in Android Apps
Yandex has issued a detailed technical response to an analysis of its Android applications that raised concerns over potential collection of audio, contacts, bank card data, and other sensitive information. The company acknowledged the existence of a cyclic audio buffer that retains approximately 1.5 seconds of sound before an activation phrase and 0.5 seconds after it, with some pre-command audio possibly transmitted to servers for speech recognition quality checks. Yandex clarified that the Alice assistant only listens locally for the wake word when the app is open and does not continuously record conversations. Access to contacts was explained as necessary for voice commands such as calling entries from the address book, with the full book sent on first sync and only changes thereafter, without hashing to support accurate speech processing. The firm rejected claims of reading messaging app conversations and stated that bank card details are routed directly to an isolated PCI DSS-compliant environment rather than standard application servers.
One Request, Five Observers: What Websites, Providers, DNS and VPNs Learn When Loading a Page
The article breaks down exactly what each participant in a typical web request can observe when a user visits a page over HTTPS. It examines the roles of the browser, DNS resolver, ISP, VPN service and the destination site itself, showing that each sees different pieces of metadata or content. HTTPS protects the page body and parameters from network observers, while Encrypted Client Hello and secure DNS further limit visibility of domain names. VPNs replace the user's home IP address with the VPN exit node but introduce a new trusted party that sees all traffic metadata. Browser fingerprinting, cookies and account logins often allow sites to re-identify users even after an IP change. The piece stresses that privacy tools must be chosen according to the specific threat model rather than relying on any single mechanism.
Windscribe Releases Open-Source PowerShell Script to Remove Microsoft's Persistent Global Device Identifier from Windows
Windscribe has published an open-source PowerShell script called deGDID that removes Microsoft's Global Device Identifier (GDID) from Windows systems and prevents the creation of new identifiers. The persistent tracker survives IP address changes and operates below the VPN layer, allowing Microsoft to maintain device tracking even when users employ privacy tools. The script was developed after the FBI used GDID to identify a suspected hacker, raising concerns about undisclosed device fingerprinting. deGDID modifies registry access control lists and blocks the DeviceAdd interface to stop Windows from regenerating the identifiers after reboots or server contacts. While effective at disabling the tracking mechanism, the tool can break authentication to login.live.com and disrupt certain Microsoft cloud services. It is intended only for unmanaged consumer devices and will not run on domain-joined or corporate-managed systems. The project is described as experimental and cannot delete identifiers already transmitted to Microsoft servers.
Yandex Apps Leak Pre-Trigger Audio Buffers, Payment Data, and Contacts via Reverse Engineering
Reverse engineering of Yandex Search and Yandex Browser APKs reveals extensive data collection practices on Android devices. The apps maintain a server-controlled pre-trigger audio buffer that captures up to three seconds or more of microphone input before the wake word Alice is detected. WiFi fingerprinting, full contact book synchronization via ContentObserver, and transmission of PAN and CVV details to mobpayment.yandex.net occur before tokenization. Additional findings include 94 JavaScript Bridge methods, logcat exfiltration with AES encryption, hardcoded Yandex DNS servers, and a native surveillance library named libquarkenstein_daemons.so. The analysis also covers passive geolocation, cell tower data collection, and inventory of installed applications including competitors such as Chrome, Firefox, WhatsApp, and Telegram. These mechanisms operate under remote configuration flags and bypass several Android privacy restrictions through manifest queries.
TSPU Filtering Disrupts Timeweb Cloud Servers: Diagnosis, CDN Failures, and Reverse Proxy Bypass
Russian hosting provider Timeweb Cloud experienced widespread TSPU-based DPI filtering starting in early June that selectively blocked TLS handshakes on port 443 while leaving SSH, ICMP, and TCP connectivity intact. The issue affected multiple providers including Beget and Selectel, was publicly acknowledged by Timeweb on June 5, and proved highly variable by region, operator, and time of day. Attempts to mitigate via new IP addresses or Timeweb's own CDN failed due to poisoned caches and platform outages, while Yandex Cloud CDN blocked all POST requests required for WordPress functionality. A working solution involved deploying a minimal nginx reverse proxy on another Russian cloud VPS that preserves full HTTP methods, handles certificate synchronization, and routes ACME challenges correctly. Timeweb support later closed tickets without resolution after requesting ineffective mtr traces that cannot detect DPI behavior. The case highlights systemic challenges in diagnosing state-mandated filtering and the limitations of standard network diagnostics against selective TLS interference.
UnifiedPush and Public ntfy.sh: Why Push Notifications Fail on Android Without Google Services
Developers building a messenger without Google services adopted UnifiedPush with the public ntfy.sh instance as the default distributor and push server. Production logs revealed that four out of five delivery attempts failed from day one, with error codes 507, 429, and 400 dominating. The 507 errors occurred because ntfy from Google Play relies on Firebase for instant delivery, leaving no active subscriber visible to the server when FCM is unavailable. Rate-limit 429 responses were triggered against the recipient's IP rather than the sender, collapsing under carrier-grade NAT used by mobile users. WebPush endpoints additionally rejected requests missing the mandatory TTL header. The team ultimately deployed a self-hosted ntfy instance and an embedded distributor inside the app to bypass these constraints.
Innovative Tunneling Techniques Leverage File Storage, IMAP, Meek, and NTP for Covert Connectivity
A new wave of experimental tunneling tools has emerged for establishing network connectivity through unconventional channels such as shared file storage, email accounts, legacy CDN protocols, and NTP. File-Tunnel enables TCP proxying by writing data to common storage backends including S3 and WebDAV, allowing traffic to blend with ordinary object storage access. True IMAP Tunnel (Secure) turns an IMAP mailbox into a bidirectional transport by storing encrypted frames as draft messages, supporting providers like Gmail, Outlook, and Yandex while offering optional AES-256-GCM encryption. Meek, originally from the Tor project, is being repurposed as a standalone pluggable transport that uses HTTP POST requests with session headers to traverse CDNs and shared hosting environments. ntptun implements IP-over-NTP and UDP-over-NTP by embedding payloads in NTP extension fields, with poll and push modes for downstream traffic and integration options with GOST for KCP-based proxies. These methods target dissidents and network experimenters seeking resilient bypass techniques against filtering and surveillance.
Six Bitrix24 Disk Migration Errors That Force Portal Redesign After Six Months
A detailed analysis reveals that copying a legacy file share structure directly into Bitrix24 Disk creates persistent access control, ownership and performance problems that surface only after several quarters of operation. The article examines six specific mistakes including one-to-one folder replication, overuse of personal My Disk storage, assignment of rights to individual users instead of departments, dumping unclear documents into the common drive, attaching file copies rather than links to CRM and tasks, and enabling full desktop synchronization. Each error is illustrated with real symptoms, root causes from rushed migrations, and concrete remediation steps using REST and D7 API calls. A Toyota T-Connect case from 2013-2023 demonstrates how unmonitored open permissions can remain undetected for a decade. The guidance stresses pre-migration inventory, pilot testing on one department, named owners for every top-level section, and quarterly rights audits. The piece is aimed at integrators and IT leads who handle large Bitrix24 deployments.
TGLock 2.0 Restores Telegram Connectivity with Local MTProto Proxy Over WebSocket
Russian developer babin2002 has released TGLock 2.0, a free open-source application for Windows, macOS and Linux that helps users restore Telegram when the client remains stuck on the Connecting screen due to content filtering systems. The tool launches a local MTProto proxy and routes only Telegram traffic through an encrypted WebSocket tunnel to the messengerโs own web infrastructure, leaving all other network activity untouched. Unlike the first version, TGLock 2.0 now verifies that a working WebSocket tunnel has been established before displaying the โTelegram connectedโ status and automatically tries alternative routes when a connection drops. The application avoids disabling TLS verification, changing system DNS or importing third-party Cloudflare domain lists, although users may optionally supply their own Cloudflare Worker. A LAN mode allows a smartphone on the same network to use the computer as a proxy, but voice and video calls may fail because UDP traffic is not proxied. No Android version is currently available and the macOS build is not signed with a Developer ID certificate.
Smart Speakers Always Listen: Privacy Controls for Yandex Alice, Marusya, Salyut, Siri and Google Assistant
Voice assistants from Yandex, VK, Sber, Apple and Google keep microphones active in standby mode to detect wake words such as Alice, Marusya, Salyut or Hey Siri. No audio leaves the device until the activation phrase is recognized, yet false triggers, stored interaction histories and third-party app permissions create ongoing privacy exposure. Hardware mute buttons on Yandex Stations and VK Capsules cut microphones at the circuit level and display red indicators. Users can also disable voice activation, delete activity logs and turn off model-training options inside Yandex ID, Apple Settings and Google account controls. The article details exact steps for each platform and warns against placing always-listening devices in rooms where sensitive conversations occur.
Apple Updates Find My in iOS 27 to Automatically Switch Location Source to Apple Watch
Apple is enhancing the Find My application in the upcoming iOS 27 release to intelligently switch the source of a user's location data between devices. The current system relies on a single selected device, typically the iPhone, which causes inaccurate location reporting when the user leaves the phone at home. In iOS 27, the app will detect when paired Apple Watch devices move far from the iPhone and automatically begin transmitting coordinates from the watch instead. The feature supports both standard Apple Watch models and cellular variants, with LTE-equipped watches providing more reliable updates without depending on Wi-Fi or nearby iPhones. watchOS 27 will also consolidate the separate Find People, Find Devices, and Find Items apps into a single unified Locator application featuring a full-screen map and Digital Crown navigation. Both iOS 27 and watchOS 27 are currently in beta testing, with a public release expected in September.
Russian Users Report BiP and KakaoTalk Inaccessible Without VPN, Suspecting Roskomnadzor Filtering
Russian home users have started complaining about disruptions in BiP and KakaoTalk messenger services. Messages fail to send or receive without a VPN connection, but function normally once a VPN is enabled. The issue reportedly began three days ago and affects the author, relatives, and friends according to a Pikabu post. Beeline support denied any operator-side restrictions, and Roskomnadzor has issued no official statement on blocking the services. Similar reports have emerged from other users, including those in the Volga region, with the consistent symptom that direct connections fail while VPN routes succeed. No independent technical confirmation of traffic filtering exists yet, and complaints may relate to specific operators, regions, or service infrastructure. The pattern matches previous Russian experiences with content filtering, though official confirmation of any block on BiP or KakaoTalk remains absent.
One Underscore, 18 Months in Prison: Username Typo Sends Innocent Man to Jail
Brandon Klaym, a resident of Nova Scotia, spent 18 months in prison after Canadian and U.S. authorities confused two similar Kik usernames during a child exploitation investigation. Police sought records for the account fus__ro_dah but requested data for fus_ro_dah, directing them to the wrong individual. The error originated in a 2018 Wisconsin case involving 125 messages sent to a 12-year-old girl; the real suspect used a Skyrim reference that contained two underscores. Kik supplied Klaymโs subscriber information, and his IP address led investigators to Canada. Despite finding no evidence on his devices and no proof he had ever used Kik during the relevant period, prosecutors charged him with multiple child-sex offenses. He was convicted in 2023, served his full 18-month sentence, and was only exonerated in 2024 when the correct username was examined during appeal proceedings.
Free VPNs Fail Within Days as Russian Filters Detect Tunnels Without Decrypting Traffic
Free VPN services promoted in Telegram now stop working after just a few days, with Instagram Reels freezing, YouTube stalling in endless loading, and Google Gemini returning 403 errors. Modern Russian content filtering systems have advanced beyond simple IP blocking and can identify proxy tunnels through indirect traffic characteristics such as packet sizes, inter-packet intervals, and TLS handshake structures. A common failure pattern involves connections succeeding initially before data transfer abruptly slows or drops after roughly 16 KB, a behavior linked to deep packet inspection recognizing proxy patterns. Users and developers counter these detections with techniques including packet fragmentation, reduced TCP segment sizes, and tools like zapret to desynchronize analyzers while preserving normal server-side flow. Services such as sing-box employ uTLS to better mimic legitimate browser TLS fingerprints, while ShadowTLS v3 and padding methods help mask connections as ordinary HTTPS sessions to allowed resources. Recommended working options include AmneziaVPN, Cloudflare WARP, Red Shield VPN, and self-hosted setups on Xray or sing-box, though some claims around hynet.cloud lack independent verification.
Why Simple VPNs No Longer Suffice Against Advanced DPI Blocking Telegram, Reels and Google AI Studio
Over the past year or two, users have observed that free VPNs and Telegram proxies often stop working after a few days, with Reels freezing, YouTube failing to load, Telegram stuck on Connecting, and Google AI Studio or Gemini returning errors. Modern filtering systems now analyze traffic behavior such as packet sizes, timing intervals, and TLS handshake characteristics rather than decrypting content. Techniques like TCP desynchronization via nfqws, MSS clamping with iptables, uTLS fingerprint emulation in sing-box, and ShadowTLS v3 for borrowing legitimate sessions are being deployed to evade detection. Padding is added to encrypted streams to reduce entropy and frustrate statistical shaping by TSPU systems. Commercial and self-hosted options including hynet.cloud, AmneziaWG, Red Shield VPN, GoodbyeDPI, and Cloudflare WARP each present distinct advantages and limitations when facing evolving network restrictions.
Personal Digital Resilience: Strategies to Secure Access Chains and Preserve Data Portability
The article explores how individuals can strengthen their digital infrastructure against service outages, lost access, and data loss without turning maintenance into a full-time project. It defines digital resilience through two pillars: security against unauthorized access and reduced dependence on any single provider, especially when regulators in different jurisdictions interfere. The author maps real-world processes to digital services, access methods, and stored data, then outlines recovery formulas for each failure scenario. Practical steps include auditing password-manager entries, eliminating circular dependencies, separating recovery roots by jurisdiction, and exporting data in portable formats. Special attention is given to secrets such as TOTP seeds and recovery codes, which are stored in an encrypted offline archive whose master password exists only on paper. The resulting structure features two independent trees rooted at Yandex and Google, with all critical services backed by verifiable exports and tested recovery paths.
Phantomdrive Open-Source USB Drive Conceals Encrypted Storage to Resist Coercion
Developer Ryan Walker has released Phantomdrive, a fully open-source USB device that initially appears as an 8 GB drive while hiding the remaining capacity from the operating system. The gadget uses a CH569 microcontroller with hardware AES support and an SD card for storage, switching to a hidden encrypted partition when a specific password string is written to a text file. It employs a key derivation function with 100,000 rounds of SHA-256 combined with a unique device salt derived from the USB serial number to strengthen password security. The project supports AES-CTR mode by default for performance reasons, delivering up to 20 MB/s reads, while AES-XTS is available as a slower but more robust alternative. All firmware, hardware schematics, and mechanical designs are published under open licenses, and the device is physically secured with epoxy resin to deter tampering. Walker acknowledges earlier community criticism regarding cryptographic implementation details and has addressed functional testing against OpenSSL references.
DeepSeek User Conversations Appear in Google Search Results via Publicly Shared Links
Conversations between users and the Chinese AI service DeepSeek, including Russian-language exchanges, have surfaced in Google search results. The exposed pages belong to Shared Conversations that users themselves made public through shareable links. These pages display full question-and-answer histories along with the names of any uploaded documents. No actual breach of DeepSeek occurred, and security researchers note that search engines indexed similar public chatbot dialogues more than a year ago. MWS AI confirmed that no closed chat histories or account access were exposed. Meanwhile, Yandex stated that links to conversations with its Alice AI assistant are blocked from indexing, remain active for only 14 days, and do not transmit attached files to recipients.
What Makes a Quality Anti-Detect Browser and Why Aurorium Built Its Own Solution
Aurorium explains the current state of the anti-detect browser market and why most existing tools fall short for professional use. The company highlights that true anti-detect browsers must modify browser fingerprints at the kernel level rather than relying on JavaScript injections. It details how solutions like incognito mode, virtual machines, and browser extensions fail to provide proper isolation and spoofing. Aurorium emphasizes its own approach of modifying Blink and V8 engines directly in C++ to create consistent, undetectable profiles. The article also covers legitimate use cases including QA testing, OSINT research, SEO monitoring, and secure web scraping. Advanced fingerprinting techniques such as Canvas and WebGL noise injection are explained alongside methods to detect superficial spoofing attempts.
LG Monitors Automatically Install McAfee App via Windows Update Without User Consent
Home users of Microsoft Windows have discovered that certain LG monitors automatically install companion software upon connection to a PC, followed by prompts to try a trial version of McAfee antivirus. The installation occurs through the standard Windows driver and software delivery mechanism without providing a clear, separate confirmation dialog. The LG Monitor App Installer requests broad access to system resources, raising concerns even though the application itself is not classified as malicious. YouTube channel Gamers Nexus identified the behavior across both new monitors and models released approximately three years ago, including units previously used in office environments. Manufacturers commonly supply utilities for display calibration, firmware updates, and monitor management, yet the process becomes problematic when it serves as an entry point for optional software and advertising. Users are advised to review installed applications and remove unnecessary LG utilities, while organizations should monitor automatic software deployment after connecting peripherals. Neither LG nor Microsoft has commented on the issue at the time of publication.
VPN Services Stabilize in Russia? Expert Warns Users Not to Relax as New Blocks May Be Coming
Russian users have recently noticed that personal VPN services and anonymizers are operating more stably after months of aggressive disruptions. Technical director Sergey Shcherbakov of the company Stakhanovets explains that the current improvement is likely only a temporary pause while deep packet inspection systems recalibrate. Earlier this year, DPI equipment was blocking traffic based on crude digital fingerprints of protocols such as OpenVPN and WireGuard, causing widespread collateral damage and connection drops. Operators are now believed to be collecting detailed data on ports, reconnection patterns, and obfuscation techniques to build more precise filters. Shcherbakov predicts the next wave of restrictions will arrive by late summer or early autumn, possibly shifting from outright blocks to throttling speeds during peak hours and delaying large file transfers. Meanwhile, users have adapted by maintaining multiple VPN clients, switching protocols and ports, and enabling obfuscation when needed.
Mimolet Dating App Shows Strong Data Protection Practices in Photo Handling, Moderation, and Infrastructure Review
A detailed technical review of the Russian dating service Mimolet reveals several well-implemented security and privacy measures across its photo upload pipeline, content moderation systems, and infrastructure choices. The app processes every uploaded image by validating its actual content rather than file extension, strips EXIF metadata, resizes it, and stores only the cleaned version. Public images undergo pre-publication checks using two AI models plus an additional verification pass before they appear in group chats or profiles. Complaints and blocks are available to all users without requiring a subscription, and moderator decisions are logged for accountability. The core API and database run in Russia while media files are stored in a domestic S3-compatible object storage, and the main AI features operate on dedicated GPU infrastructure managed by the team. The review highlights two areas needing improvement: clearer data retention timelines and a dedicated, trackable appeals process for blocked accounts.
Mimolet Dating App Review Highlights Privacy Protections, AI Moderation, and UX Trade-Offs in Detailed Analysis
A comprehensive review of the Mimolet dating application examines its registration process, vertical profile feed, free filters, and advanced communication tools including built-in calls and AI-assisted messaging. The analysis praises detailed profiles visible directly in the feed, free access to comprehensive search criteria, and strong privacy measures such as automatic EXIF metadata removal from photos and primary data storage within Russian server infrastructure. It also covers public interest-based groups, pre-publication image moderation using multiple AI checks, and transparent complaint handling that does not require a subscription. Concerns are raised about lengthy registration potentially reducing user completion rates, the inclusion of weight as a searchable filter, unclear data retention timelines, and the lack of a formal appeals process for blocked accounts. The app offers three paid tiers focused on visibility and extra AI features while keeping core communication and moderation tools free, with approximately 200,000 registrations and 15,000 daily active users reported alongside retention rates of 44.96% at day three and 19.11% at day thirty.
69% of Browsers Worldwide Vulnerable: How Chrome Sync Enables Stealth Surveillance Without Malware
Google Chrome's standard synchronization feature can be silently abused to turn any browser into a surveillance tool, requiring only brief physical access to a victim's device and the addition of an attacker's Google account. Security researchers at Certo highlighted the technique after multiple cases involving intimate partner surveillance, including one incident where a womanโs visits to a family lawyer and domestic abuse support sites were monitored in real time by her partner. Once sync is enabled, browsing history, bookmarks, open tabs, autofill data, and saved passwords are automatically transmitted to the attackerโs profile, which can be viewed from any device worldwide without needing the victimโs password or installing spyware. Chrome provides no prominent warnings about new profiles or active synchronization, and alerts about logins are sent only to the account owner rather than the device owner. With Chrome holding a 69.65% global market share according to StatCounter data from June 2026, the method potentially affects millions of users on Android, iOS, Windows, and macOS. Experts recommend regularly checking connected profiles in browser settings, using Incognito mode for sensitive activity, securing devices with strong passcodes and biometrics, and immediately removing unknown accounts while changing important passwords.
Russia's ะะะ Proposes Mandatory Purchase of Special Smartphones for Migrants to Enable Permanent Digital Location Tracking
Russia's Ministry of Internal Affairs is advancing plans to replace paper-based migration controls with continuous digital surveillance by requiring labor migrants to purchase a dedicated smartphone upon entry. Deputy Minister Igor Zubov announced that the device would create an electronic profile allowing police to monitor the owner's movements in real time and prevent unauthorized relocation between regions. The initiative builds on the existing "Amina" app already mandatory in Moscow and the Moscow region since September 2025, which has already led to more than 139,000 migrants being removed from registration. From July 2026, all visa-free foreigners must use the RuID app to create digital profiles, while a unified ะะะ database containing documents, employment, housing, fines, and phone numbers is already operational. The new proposal differs from current rules by making the purchase of a government-specified device a condition of entry rather than simply installing software on an existing phone. Human rights advocates, including Svetlana Gannushkina, have previously criticized similar ideas, noting that forcing migrants to buy expensive devices is unlawful given financial and technical barriers. The plan remains a future proposal and has not yet been enacted into law.
Telegram Will Not Allow Scanning of Private Chats โ Pavel Durov Strongly Criticizes EU Over Chat Control Initiative
Pavel Durov has sharply criticized the European Union following renewed discussions on the Chat Control law, which could mandate or encourage scanning of user messages, emails, and photos in online services to detect prohibited content. The Telegram founder described the tactics used to advance such surveillance legislation as reminiscent of those employed in banana republics, emphasizing that private user correspondence must remain protected from mass monitoring. Durov explicitly stated that Telegram will not implement any scanning of personal messages regardless of regulatory pressure from the EU. The European Parliament has returned the controversial bill for further consideration, with earlier versions proposing voluntary scanning by platforms to identify illegal material. Critics argue that the initiative effectively creates a mechanism for widespread surveillance of private communications under the guise of safety, while supporters claim it is necessary to combat illegal content and protect users. Telegram continues to position itself firmly on the side of privacy, refusing to turn personal chats into subject matter for automated government monitoring.
Windows Tracks Users Through Persistent GDID Identifier: How to Minimize Your Digital Footprint
A recent case involving a 19-year-old hacker identified through his Windows installation has highlighted how Microsoftโs GDID creates a permanent device fingerprint that survives VPNs and IP changes. GDID serves as a constant identifier across licensing, Microsoft Store, telemetry, and other services, making it difficult for users to stay anonymous even when changing networks. While there is no single button to disable this functionality completely, several practical steps can significantly reduce the amount of data Windows sends to Microsoft. These include switching to a local account instead of a Microsoft Account, disabling activity history, limiting optional diagnostic data, and turning off unused background services such as Phone Link and cloud synchronization. Experts note that simply reinstalling Windows does not erase the link if the same Microsoft Account is used afterward. The story underscores the ongoing trade-off between privacy and convenience in the Windows ecosystem.