Security Alert: Even trusted browser extensions can become a security risk.

Researchers discovered that the popular ModHeader Chrome and Edge extension installed by approximately 1.6 million users contained dormant data exfiltration capabilities capable of collecting and encrypting browsing-domain data before sending it to a remote server. While Google and Microsoft have removed the extension from their stores, existing installations must still be manually removed.

This is another reminder that browser extensions deserve the same scrutiny as any other software. Regularly audit installed extensions, remove those you no longer use, and limit permissions to only what’s necessary.

Trust but verify. Your browser is one of the most targeted attack surfaces in your environment.

https://cybersecuritynews.com/chrome-extension-used-million-users-data-exfiltration/amp/

#CyberSecurity #InfoSec #ThreatIntelligence #DataSecurity #Chrome #BrowserSecurity #Privacy #BlueTeam #SecurityAwareness #RiskManagement #ModHeader

Most privacy news is too technical or too vague to act on. Ours isn't.

#privacy #dataprivacy #indigoprivacy

Most privacy news is too technical or too vague to act on. Ours isn't.

#privacy #dataprivacy #indigoprivacy

From the CyberIntel archive: Hacker Leak Reveals Madison Square Garden's Internal Surveillance Database of VIP Celebrities

https://cyberintelnews.com/

#DataBreach #Privacy #RiskManagement #Cybersecurity

Can RustDesk’s telemetry be disabled? Collecting user device information, session duration, and other telemetry data seems unnecessary for a remote desktop application. Users should have the option to disable all telemetry and they should be disabled by default.

f-droid.org/packages/com.carriez.flutter_hbb/

#California Steps Back From Dangerous Expansion of its Age-Gating Law

https://www.eff.org/deeplinks/2026/07/california-steps-back-dangerous-expansion-its-age-gating-law

#privacy #AgeVerification #cybersecurity #politics

"The social media giant Meta partnered with controversial TV personality and cosmetics mogul Kylie Jenner for the design and marketing of an “entry-level” line of its widely criticized camera glasses late last month. The collaborative campaign quickly provoked a wave of public backlash over unresolved concerns about privacy, consent, and personal safety as surveillance technology rapidly evolves.

Based in the United Kingdom, the class-based activism group Everyone Hates Elon (EHE) visualized those concerns in a lenticular spoof ad that, based on where a viewer is standing, flips between a branded marketing photo of Jenner wearing a pair of Meta glasses and a black-and-white image showing a skeletal, X-ray version of her with the tagline “We’re always watching.”

The transformation element and the poster design appear to reference the politically charged sci-fi film They Live (1988), in which the main character encounters a pair of sunglasses that not only expose the extractive messaging of advertisements but reveal that humanity is being controlled, subdued, and exploited by a secret population of aliens masquerading as people. In the film, it’s later revealed that some humans have accepted monetary bribes to collaborate with the aliens."

https://hyperallergic.com/guerrilla-london-bus-ads-mock-kylie-jenners-meta-glasses-campaign/

#Meta #Rayban #SmartGlasses #Surveillance #Artivism #Privacy

"Health data is increasingly an important part of law enforcement or government investigations. Wearable data has been critical in a number of cases, where information about heart rate and steps was used to determine the whereabouts of individuals. And the surveillance company Penlink calls fitness trackers and wearables an “overlooked source” for law enforcement since they tend to show movement patterns and changes in heart rates. Law enforcement can try to get access to this data through subpoenas or warrants.

There are many potential privacy issues with these sorts of devices, including whether the companies who make them share or sell information to third-parties. But here we are choosing to focus on two facets we’re concerned with around health data itself: 1) whether the company shares information with law enforcement and governments and 2) if they offer end-to-end encryption, which means the company itself can’t access that health data to begin with."

https://www.eff.org/deeplinks/2026/07/most-smart-watches-rings-and-bands-lack-basic-transparency-reports-and-key-privacy

#SmartObjects #SmartWatches #SmartRings #IoT #Surveillance #Privacy #CyberSecurity #Encryption

"This technical analysis provides the most detailed view yet into the inner workings of the Pegasus spyware system. This includes confirmation of key technical capabilities such as the infection vectors and methodologies used to infect devices, supported by analysis of internal NSO Group documents, that until now had only been identified via forensic investigations. It also presents new material further validating the accuracy and significance of the dataset underpinning the original Pegasus Project investigation. Finally, this research provides an updated analysis, drawing on previously published Pegasus forensic evidence and newly released materials, to validate the technical methodology used to forensically link Pegasus spyware attacks targeting different victims as originating from the same Pegasus customer.

A key aim of this publication is to document and demystify the functionality and operations of technological systems like Pegasus. We hope that it will inform the wider spyware accountability community on how complex surveillance systems such as Pegasus are used by government customers, and also illustrate the key and ongoing role of spyware vendors in keeping such systems operational. We believe this public understanding is of critical value to technologists, researchers, and policy makers and others with an interest in understanding the targeted surveillance ecosystem and threats posed to human rights by surveillance technologies.

The contents of this technical research draw heavily on a large pool of confidential NSO Group training material, presentations and internal technical documentation which were disclosed as part of a long-running civil case taken by WhatsApp and Meta against NSO Group in U.S. court. This new material provides an unprecedented insight into the evolution of NSO Group’s spyware."

https://securitylab.amnesty.org/latest/2026/07/inside-pegasus-the-evolution-of-the-worlds-most-notorious-spyware/

#CyberSecurity #Spyware #NSOGroup #Pegasus #Surveillance #Privacy

"Police departments around the country have used Flock cameras at least hundreds of times to search for specific people, not cars, using searches such as “heavy-set male with a black and white hat,” “person on skateboard,” and “person wearing orange vest and construction hat,” according to data reviewed by 404 Media. Sometimes searches reference a target’s race or signs of their political affiliation.

The searches highlight that while most people associate Flock cameras with scanning license plates and tracking vehicles, some of the cameras are also capable of following the movements of particular people or groups of people. Flock’s nationwide network of cameras lets police officers in one state search for a vehicle across many other states at once; the people searches do a similar thing, typically on a smaller scale, sometimes querying many hundreds of cameras at once. These are called “FreeForm” searches, and allow cops to use Flock’s system as though they would use a search engine, with Flock’s AI and image recognition interpreting what footage and which people are relevant to a police officer’s search."

https://www.404media.co/how-cops-use-flock-to-track-people-not-cars/

#USA #Surveillance #Flock #Privacy

Most Smart Watches, Rings, and Bands Lack Basic Transparency Reports and Key #Privacy Features

https://www.eff.org/deeplinks/2026/07/most-smart-watches-rings-and-bands-lack-basic-transparency-reports-and-key-privacy

#IoT #wearable

Engadget: A hacker accessed Suno source code that reportedly details how the company scraped millions of songs . “Suno — an app that vomits out soulless audio in the form of AI-generated ‘music’ — has been hacked. According to 404 Media, the hacker accessed data related to Suno’s training practices, as well as details on its customers.”

Here’s the Truth About Whether #Meta’s #NameTag Face Recognition Tech ‘Exists’

https://www.wired.com/story/heres-the-truth-about-whether-metas-nametag-face-recognition-exists/

#FRT #privacy #FacialRecognition

The privacy problems hidden in your period tracker

https://www.bbc.com/future/article/20260715-how-period-trackers-share-womens-private-details

Comments: https://news.ycombinator.com/item?id=48939641

#HackerNews #privacy #periodtrackers #datasecurity #womenrights #healthtech

📕 A very timely UN report for countries, states and governments to pause becoming a surveillance state by being captured to 'surveillance capitalism'.
🧠 Privacy is the pre-condition to social growth.
----------------------
Read the full report here: https://www.ohchr.org/en/press-releases/2026/06/digital-surveillance-related-chilling-effects-must-be-addressed-long-term
--------------------
#privacy #privacymatters #mentalprivacy #physicalprivacy #intellectualprivacy

Alt...

The text gives website address for a UN report on the chilling effects of surveillance.

Understanding and configuring your browser's privacy settings is crucial. Our latest guide dives deep into Microsoft Edge's privacy options, explaining how to limit data collection and block unwanted trackers. Empower yourself with knowledge to protect your online activity. #Privacy #Tech #MicrosoftEdge #FOSS https://geekrewind.com/microsoft-edge-privacy-settings-explained-protecting-your-data/

Cops have used Flock's FreeForm search feature to look for people with tattoos and wearing specific sport shirts, and searches sometimes include the target's race, according to data reviewed by 404 Media. The licence plate reader company has expanded beyond car tracking to person-based surveillance. https://www.404media.co/how-cops-use-flock-to-track-people-not-cars/ #Media #SocialMedia #Privacy

Think VPNs are a privacy shield? 🤔 Let's dive into what they *really* do (and don't do) for your online security. It's about more than just a tool – it's a mindset. New video reveals the truth! 💻 #VPN #Privacy #OnlineSecurity

https://www.youtube.com/watch?v=rhrVxFBlZBI

Alt...

🔴 LIVE

GrapheneOS version 2026071500 released:

https://grapheneos.org/releases#2026071500

See the linked release notes for a summary of the improvements over the previous release.

Forum discussion thread:

https://discuss.grapheneos.org/d/40416-grapheneos-version-2026071500-released

#GrapheneOS #privacy #security

📰 Informiert zu sein, schützt uns vor Gefahren und finanziellen Risiken. Ich suche täglich nach wissenswerten #Nachrichten aus #Forschung, #Medizin, #Verbraucherschutz und vielem mehr, um wichtige Erkenntnisse zu verbreiten.

Deine #Steady-Fördermitgliedschaft auf https://steady.page/klimacrew 👥
oder eine #Einzelspende helfen, die #Technikkosten zu decken: https://ko-fi.com/tinoeberl 💶

#Klimaschutz #Produktrückrufe #Onlinebetrug #Privacy #Cybersicherheit #Gesundheitsrisiken

Source : github.com/immich-app/immich/r…

Divers correctifs de bugs :
. nous publions désormais l'application sur notre propre dépôt F-Droid (app.futo.org/fdroid/repo). Si vous utilisez F-Droid, veuillez désormais récupérer l'application depuis cette source.
. correction d'un problème empêchant l'affichage des Live Photos téléchargées en arrière-plan.

Remarque :

Dans certaines circonstances particulières, les Live Photos récemment téléchargées pouvaient présenter des vignettes corrompues. Si vous rencontrez ce cas de figure, veuillez lancer la tâche de traitement des vignettes manquantes ou attendre que la tâche nocturne correspondante corrige le problème.

Ce qui a changé
🚀 Fonctionnalités :

. feat : publication des versions de l'application sur le dépôt FUTO F-Droid par bo0tzz dans 29804

🐛 Corrections de bugs :

. fix(web) : la fermeture du sélecteur de méthode de plugin sélectionnait la méthode « unknown » (inconnue) par benbeckford dans 29784
. fix : mise à jour non autorisée du propriétaire de l'album par danieldietzler dans 29883
. fix : élément de Live Photo restant masqué lors du téléversement en arrière-plan par shenlong-tanwen dans 29884
. fix : couleur incorrecte de l'icône de la barre d'application système dans la visionneuse de médias par alextran1502 dans 29885
. fix : visibilité verrouillée dans le point de terminaison de recherche aléatoire par danieldietzler dans 29887
. fix(mobile) : envoi d'une date et heure complètes depuis le widget « Souvenirs » Android par santoshakil dans 29689
. fix : validation de la date pour la recherche de souvenirs par danieldietzler dans 29907
. fix(serveur) : définition de la balise hvc1 lors de l'utilisation de l'accélération matérielle (HWA) par mertalev dans 29908
. fix(mobile) : réinitialisation de l'état du zoom lors du changement de média par agg23 dans 29909
. fix : saccades de l'effet Ken Burns sur la barre d'application (sliver app bar) sous Android par alextran1502 dans 29890

L'appli Android sans passer par le playstore github.com/immich-app/immich/r…

Et maintenant vous pouvez utiliser F-droid en ajoutant le repo app.futo.org/fdroid/repo

Et comme toujours, mon instance gallery.mesnumeriques.fr reste ouverte 😉

#immich #selfhosting #autohebergement #mesnumeriquesfr #privacy #souverainetenumerique

Mise à jour Immich vers la v3.0.3

Source : https://github.com/immich-app/immich/releases/tag/v3.0.3

Divers correctifs de bugs :
. nous publions désormais l'application sur notre propre dépôt F-Droid (https://app.futo.org/fdroid/repo). Si vous utilisez F-Droid, veuillez désormais récupérer l'application depuis cette source.
. correction d'un problème empêchant l'affichage des Live Photos téléchargées en arrière-plan.

Remarque :

Dans certaines circonstances particulières, les Live Photos récemment téléchargées pouvaient présenter des vignettes corrompues. Si vous rencontrez ce cas de figure, veuillez lancer la tâche de traitement des vignettes manquantes ou attendre que la tâche nocturne correspondante corrige le problème.

Ce qui a changé
🚀 Fonctionnalités :

. feat : publication des versions de l'application sur le dépôt FUTO F-Droid par bo0tzz dans 29804

🐛 Corrections de bugs :

. fix(web) : la fermeture du sélecteur de méthode de plugin sélectionnait la méthode « unknown » (inconnue) par benbeckford dans 29784
. fix : mise à jour non autorisée du propriétaire de l'album par danieldietzler dans 29883
. fix : élément de Live Photo restant masqué lors du téléversement en arrière-plan par shenlong-tanwen dans 29884
. fix : couleur incorrecte de l'icône de la barre d'application système dans la visionneuse de médias par alextran1502 dans 29885
. fix : visibilité verrouillée dans le point de terminaison de recherche aléatoire par danieldietzler dans 29887
. fix(mobile) : envoi d'une date et heure complètes depuis le widget « Souvenirs » Android par santoshakil dans 29689
. fix : validation de la date pour la recherche de souvenirs par danieldietzler dans 29907
. fix(serveur) : définition de la balise hvc1 lors de l'utilisation de l'accélération matérielle (HWA) par mertalev dans 29908
. fix(mobile) : réinitialisation de l'état du zoom lors du changement de média par agg23 dans 29909
. fix : saccades de l'effet Ken Burns sur la barre d'application (sliver app bar) sous Android par alextran1502 dans 29890

L'appli Android sans passer par le playstore https://github.com/immich-app/immich/releases/download/v3.0.3/app-release.apk

Et maintenant vous pouvez utiliser F-droid en ajoutant le repo https://app.futo.org/fdroid/repo

Et comme toujours, mon instance https://gallery.mesnumeriques.fr reste ouverte 😉

#immich #selfhosting #autohebergement #mesnumeriquesfr #privacy #souverainetenumerique

"We don't log who sent what" is a policy. "The field doesn't exist on the wire" is a protocol property — the one that matters, because policies require trust and protocol properties don't.

As of our latest default, the relay has no `from` field across chat, calls, or group messages — sender identity lives only inside payloads sealed to the recipient's key. The relay routes opaque blobs; it cannot reconstruct who's talking to whom.

#infosec #privacy

In-Car Cameras Are Now Required in Europe. US Isn’t Far Behind

EU is now mandating that every vehicle come equipped with an interior-facing camera as part of an “advanced driver distraction warning (ADDW) system” that can monitor when drivers are distracted, drowsy, or otherwise inattentive, and alert them to stay focused.

#Europe #EU #surveillance #privacy #automotive #auto #cars #transportation

https://www.thedrive.com/news/in-car-cameras-are-now-required-in-europe-us-isnt-far-behind

Smart pill bottles that track medication adherence share compliance data with insurers and pharmacy benefit managers without always disclosing this to patients.

#privacy #healthcare #indigoprivacy

Smart pill bottles that track medication adherence share compliance data with insurers and pharmacy benefit managers without always disclosing this to patients.

#privacy #healthcare #indigoprivacy

How #Cops Use #Flock to #Track People, Not Cars

#Police departments around the country have used Flock #cameras at least hundreds of times to search for specific people, not cars, using searches such as “heavy-set male with a black and white hat,” “person on skateboard,” and “person wearing orange vest and construction hat,” according to data reviewed by 404 Media. Sometimes searches reference a target’s race or signs of their #political affiliation.

The searches highlight that while most people associate Flock cameras with scanning license plates and #tracking vehicles, some of the cameras are also capable of following the movements of particular people or groups of people.
#privacy #security #alpr

https://www.404media.co/how-cops-use-flock-to-track-people-not-cars/

Account terminated — nobody appeals

Termination emails arrive overnight, decided by classifiers, reviewed by no one. Data on your own server can't be terminated — that's the entire pitch, in four notifications.

https://selfhost.directory

#Opensource #Homeserver #Privacy #Degoogle #Docker #Linux