The Linkielist

Linking ideas with the world

The Linkielist

How Age Verification Laws Targeting Online Porn Could Be (And Should Be) Viewed As A Labor Rights Issue

Posted on by

[…]

While not a traditional “labor issue,” like union rights and equal pay, the government’s role in regulating and restricting forms of expression that can be produced, distributed, and monetized for entertainment media consumption is a dimension of the age-gating issue often overlooked and/or ignored.

Digital sex workers’ incomes and living conditions are dependent on platforms for content distribution. Sites like OnlyFans, Pornhub, xHamster, Chaturbate, and literally thousands more grant performers and content creators access to revenue generation opportunities that are remote, distributed, and confidential.

Due to these platforms forming the foundations of a trend-setting, technology-innovating, digitally native entertainment industry, age verification laws target digital sex workers’ means of distribution and, in a lot of cases, means of production. The overwhelming majority of adult content creators and adult performers are self-employed—classified as independent contractors and/or small business owners. Some performers have incorporated, with others adding trademarks and intellectual property protections on their branding.

Consider a few examples of adult content creators actively engaging in the activity of running a small business or self-employed enterprise. Platforms such as OnlyFans issue tax forms so that content creators can accurately report their income to the IRS and their state tax authorities. Or take the example of the performer-creator, going by the stage name Gigi Dior, duking it out with high-fashion house Christian Dior in front of the Trademark Trial and Appeal Board at the U.S. Patent and Trademark Office. Activities and actions like these aren’t seen by the vast majority of consumers—or, importantly, the critics of the entire online adult ecosystem.

We all hear the “think of the children” mantra from the Helen Lovejoys of the world daily. We are seeing it now with Collective Shout teaming up with Visa and Mastercard to clamp down on NSFW gaming. We are seeing it in the United Kingdom with calls from both the House of Commons and the House of Lords to ban certain types of pornography to comply with a broad interpretation of the Online Safety Act of 2023.

At least 40 percent of all United States residents live in jurisdictions with age verification laws. Millions of adult content creators are diverse and dynamic. Faced with all of these mounting regulatory pressures, adult entertainment performers and adult content creators—particularly those operating with marginalized identities—have developed a range of creative strategies to sustain their work, visibility, and autonomy in the national digital space. Inaccessibility is a legitimate issue that goes far beyond concerns of consumers.

While these laws are often framed as protecting children, the actual barrier they create is for adults — the lawful consumers who make up the legitimate market for adult entertainment. Under laws like Texas’s HB 1181, anyone wanting to access adult content must submit government-issued ID or sensitive personal data to a third-party vendor. Many adults are unwilling to do this, not because they wish to evade age restrictions, but because they don’t trust where that data will go, how it will be stored, or who might access it.

The result is that large numbers of adults — the only legal audience for these performers in the first place — stop visiting legitimate platforms altogether. That loss of audience directly translates into a loss of income for adult content creators. For an industry where the majority of workers are self-employed, often operating as small businesses, the shrinkage of the paying customer base is an existential threat.

This is why age verification mandates should also be seen as a labor rights issue. They are not simply regulating content; they are regulating the ability of consenting adults to transact with one another in a lawful marketplace.

[…]

Source: How Age Verification Laws Targeting Online Porn Could Be (And Should Be) Viewed As A Labor Rights Issue  | Techdirt

$81M ‘Trade Secrets’ Verdict Against Boeing Was Overturned – and Then Reinstated

Posted on by

14 months ago a jury ruled against Boeing, awarding $81 million in damages to failed electric airplane startup Zunum. “Zunum alleged that Boeing, while ostensibly investing seed money to get the startup off the ground, stole Zunum’s technology and actively undermined its attempts to build a business,” the Seattle Times reported at the time.

But two months later that verdict was overturned, Reuters reports, with U.S. District Judge James Robart deciding that Zunum “did not adequately identify its secrets or show that they derived their value from being kept secret.”

And then three days ago a U.S. appeals court reinstated the original $81 million award, reversing that district judge’s decision and “rejecting his finding that the information Boeing allegedly stole was not entitled to trade-secret protection.” [T]he district court erred in concluding that “Zunum failed to identify any of its alleged trade secrets with sufficient particularity”… Here, the court rejected Zunum’s repeated attempts to introduce comprehensive trade secret definitions into evidence and instead provided the jury with a court-created exhibit enumerating Zunum’s alleged trade secrets with a short description of each. Zunum’s witnesses identified the trade secrets by number, provided a basic explanation of each, and used exhibits and demonstratives to exemplify information comprising specific trade secrets.
“internal Boeing communications introduced at trial suggesting that Boeing intended to modify its own in-house designs, methods, and strategies to incorporate information from certain Zunum trade secrets…” according to the new ruling. “Under the parties’ agreement, Boeing was not permitted to use Zunum’s confidential information for any reason other than to manage its investment in Zunum.”

Reuters adds that “A spokesperson for Boeing declined to comment on the appeals court’s decision”

One final note: The appeals court also ordered the case to be assigned to a new judge after Robart revealed that his wife had acquired Boeing stock through a retirement savings account during the litigation.
Judge Robart had called that an “error”. (And judicial ethics experts interviewed by Business Insider in 2024 “characterized Robart’s trades and delayed disclosure to the parties as a minor issue,” they reported Thursday.)

But Thursday’s ruling notes that the delayed disclosure “taken together with the district court’s consistent rulings in Boeing’s favor during and after trial, could give an objective observer reason to question the district judge’s impartiality in further proceedings.”

Source: $81M ‘Trade Secrets’ Verdict Against Boeing Was Overturned – and Then Reinstated

Security flaws in a carmaker’s web portal let one hacker remotely unlock cars from anywhere

Posted on by

[…] Zveare, who has found bugs in carmakers’ customer systems and vehicle management systems before, found the flaw earlier this year as part of a weekend project, he told TechCrunch.

He said while the security flaws in the portal’s login system was a challenge to find, once he found it, the bugs let him bypass the login mechanism altogether by permitting him to create a new “national admin” account.

The flaws were problematic because the buggy code loaded in the user’s browser when opening the portal’s login page, allowing the user — in this case, Zveare — to modify the code to bypass the login security checks. Zveare told TechCrunch that the carmaker found no evidence of past exploitation, suggesting he was the first to find it and report it to the carmaker.

When logged in, the account granted access to more than 1,000 of the carmakers’ dealers across the United States, he told TechCrunch.

“No one even knows that you’re just silently looking at all of these dealers’ data, all their financials, all their private stuff, all their leads,” said Zveare, in describing the access.

Zveare said one of the things he found inside the dealership portal was a national consumer lookup tool that allowed logged-in portal users to look up the vehicle and driver data of that carmaker.

In one real-world example, Zveare took a vehicle’s unique identification number from the windshield of a car in a public parking lot and used the number to identify the car’s owner. Zveare said the tool could be used to look up someone using only a customer’s first and last name.

With access to the portal, Zveare said it was also possible to pair any vehicle with a mobile account, which allows customers to remotely control some of their cars’ functions from an app, such as unlocking their cars.

Zveare said he tried this out in a real-world example using a friend’s account and with their consent. In transferring ownership to an account controlled by Zveare, he said the portal requires only an attestation — effectively a pinky promise — that the user performing the account transfer is legitimate.

“For my purposes, I just got a friend who consented to me taking over their car, and I ran with that,” Zveare told TechCrunch. “But [the portal] could basically do that to anyone just by knowing their name — which kind of freaks me out a bit — or I could just look up a car in the parking lots.”

[…]

Zveare said this was similar to a feature found in a Toyota dealer portal discovered in 2023.

“They’re just security nightmares waiting to happen,” said Zveare, speaking of the user-impersonation feature.

Once in the portal Zveare found personally identifiable customer data, some financial information, and telematics systems that allowed the real-time location tracking of rental or courtesy cars, as well as cars being shipped across the country, and the option to cancel them — though, Zveare didn’t try.

Zveare said the bugs took about a week to fix in February 2025 soon after his disclosure to the carmaker.

[…]

Source: Security flaws in a carmaker’s web portal let one hacker remotely unlock cars from anywhere | TechCrunch

However he won’t identify the car maker – which is a real problem with bad responsible disclosure rules.

Phishing training is pretty pointless, researchers find

Posted on by

In a scientific study involving thousands of test subjects, eight months and four different kinds of phishing training, the average improvement rate of falling for phishing scams was a whopping 1.7%.

“Is all of this focus on training worth the outcome?” asked researcher Ariana Mirian, a senior security researcher at Censys and recently a Ph.D. student at U.C. San Diego, where the study was conducted. “Training barely works.”

[…]

Dameff and Mirian wanted scientifically rigorous, real-world results. (You can read their academic paper here.) They enrolled more than 19,000 employees of the UCSD Health system and randomly split them into five groups, each member of which would see something different when they failed a phishing test randomly sent once a month to their workplace email accounts.

  • Control: Its members got a 404 error if they clicked on a phishing link in the body of the email.
  • Generic static: This group saw a static webpage containing general information about avoiding phishing scams.
  • Generic interactive: This group was walked through an interactive question-and-answer exercise.
  • Contextual static: A static webpage again, but this time showing the exact phishing lure the subject had received and pointing out the warning signs that were missed.
  • Contextual interactive: An interactive Q&A session that walked the subject on what they missed in the specific lure they’d received.

Over the eight months of testing, however, there was little difference in improvement among the four groups that received different kinds of training. Those groups did improve a bit over the control group’s performance — by the aforementioned 1.7%.

Not what was expected

However, there were some lessons learned — not all expected. The first was that it helped a lot to change up the phishing lures. Most subjects saw right through a phishing email that urged the recipients to change their Outlook account passwords, resulting in failure rates between 1% and 4%.

But about 30% of users clicked on a link promising information about a change in the organization’s vacation policy. Almost as many fell for one about a change in workplace dress code.

“Whoever controls the lures controls the failure rates,” said Mirian. “It’s important to have different lures in your phishing training.”

Another lesson was that given enough time, almost everyone falls for a phishing email. Over the eight months of the experiment, just over 50% failed at least once.

“Given enough time, most people get pwned,” said Mirian. “We need to stop punishing people who fail phishing tests. You’d end up punishing half the company.”

[…]

Source: Phishing training is pretty pointless, researchers find | SC Media

And for a more guerrilla approach, you may want to look at this:

Google Issues New Update Warning To 3.5 Billion Chrome Users

Posted on by

Google has issued a security update for its Chrome browser which you should apply right now. That’s because Google has fixed six issues in its widely-used browser, half of which are rated as having a high severity.

The Chrome Stable channel has been updated to 139.0.7258.127/.128 for Windows, Mac and 139.0.7258.127 for Linux, Google said in an advisory published on the Chrome blog. The Chrome update will roll out over the coming days and weeks, according to Google.

The latest Google Chrome security fixes come just one week after the browser maker issued an update for eight flaws and two weeks following an emergency patch for a high severity vulnerability. The Chrome update also comes after Apple released iOS 18.6, fixing a hefty list of 29 security flaws.

[…]

High Severity Issues Fixed In Google Chrome

CVE-2025-8879 is a heap buffer overflow flaw in libaom, which is rated as having a high impact. Meanwhile, CVE-2025-8880 is a race issue in V8 that Google has also rated as having a high severity.

The last high severity vulnerability is CVE-2025-8901, an out of bounds write issue in ANGLE, which allows a remote attacker to perform out of bounds memory access via a crafted HTML page.

Google details two of the medium severity flaws, CVE-2025-8881, an inappropriate implementation issue in File Picker and CVE-2025-8882, a use after free vulnerability in Aura.

None of the flaws fixed in Google Chrome have been used in real-life attacks, but some of the issues are pretty serious — especially those that can be exploited by remote attackers.

[…]

Source: Google Issues New Update Warning To 3.5 Billion Chrome Users

One small walking adjustment could delay knee surgery for years

Posted on by

Researchers from the University of Utah, New York University and Stanford University are now demonstrating the potential for another option: gait retraining.

By making a small adjustment to the angle of their foot while walking, participants in a year-long randomized control trial experienced pain relief equivalent to medication. Critically, those participants also showed less knee cartilage degradation over that period as compared to a group that received a placebo treatment.

[…]

With support from the National Institutes of Health and other federal agencies, the researchers were specifically looking at patients with mild-to-moderate osteoarthritis in the medial compartment of the knee — on the inside of the leg — which tends to bear more weight than the lateral, outside, compartment. This form of osteoarthritis is the most common, but the ideal foot angle for reducing load in the medial side of the knee differs from person to person depending on their natural gait and how it changes when they adopt the new walking pattern.

[…]

In their first two visits, participants received a baseline MRI and practiced walking on a pressure-sensitive treadmill while motion-capture cameras recorded the mechanics of their gait. This allowed the researchers to determine whether turning the patient’s toe inward or outward would reduce load more, and whether a 5° or 10° adjustment would be ideal.

This personalized analysis also screened out potential participants who could not benefit from the intervention, as none of the foot angle changes could decrease loading in their knees

[…]

Participants from both groups returned to the lab for six weekly training sessions, where they received biofeedback — vibrations from a device worn on the shin — that helped them maintain the prescribed foot angle while walking on the lab’s treadmill. After the six-week training period, participants were encouraged to practice their new gait for at least 20 minutes a day, to the point where it became natural. Periodic check-in visits showed that participants were adhering to their prescribed foot angle within a degree on average.

After a year, all participants self-reported their experience of knee pain and had a second MRI to quantitatively assess the damage to their knee cartilage.

“The reported decrease in pain over the placebo group was somewhere between what you’d expect from an over-the-counter medication, like ibuprofen, and a narcotic, like oxycontin,” Uhlrich said. “With the MRIs, we also saw slower degradation of a marker of cartilage health in the intervention group, which was quite exciting.”

Beyond the quantitative measures of effectiveness, participants in the study expressed enthusiasm for both the approach and the results. One participant said: “I don’t have to take a drug or wear a device…it’s just a part of my body now that will be with me for the rest of my days, so that I’m thrilled with.”

Participants’ ability to adhere to the intervention over long periods of time is one of its potential advantages.

[…]

Before this intervention can be clinically deployed, the gait retraining process will need to be streamlined. The motion-capture technique used to make the original foot angle prescription is expensive and time-consuming; the researchers envision this intervention to eventually be prescribed in a physical therapy clinic and retraining can happen while people go for a walk around their neighborhood.

“We and others have developed technology that could be used to both personalize and deliver this intervention in a clinical setting using mobile sensors, like smartphone video and a ‘smart shoe’,” Uhlrich said. Future studies of this approach are needed before the intervention can be made widely available to the public.

Source: One small walking adjustment could delay knee surgery for years | ScienceDaily

Russian hackers seized control of Norwegian dam, spy chief says

Posted on by

Russian hackers took control of a Norwegian dam this year, opening a floodgate and allowing water to flow unnoticed for four hours, Norway’s intelligence service has said.

The admission, by the Norwegian Police Security Service (PST), marks the first time that Oslo has formally attributed the cyber-attack in April on Bremanger, western Norway, to Moscow.

The attack on the dam, which which is used for farming fish, released 500 litres (132 gallons) of water a second for four hours until the incident was detected and stopped.

The head of PST, Beate Gangås, said on Wednesday: “Over the past year, we have seen a change in activity from pro-Russian cyber actors.” The Bremanger incident was an example of such an attack, she added.

“The aim of this type of operation is to influence and to cause fear and chaos among the general population. Our Russian neighbour has become more dangerous.”

[…]

Intelligence services in Norway, which produces the majority of its electricity using hydropower dams, had previously warned of the potential risk of such attacks on energy infrastructure.

Norway and Russia share a 123-mile (198km) border, with a crossing at Storskog, Europe’s only open Schengen border with Russia.

The Russian embassy in Oslo said Gangås’s statements were “unfounded and politically motivated”.

It told Reuters news agency: “It is obvious that the PST is unsuccessfully trying to substantiate the mythical threat of Russian sabotage against Norwegian infrastructure this year, which it itself invented in its February (annual) report.”

Last year, Richard Moore, the head of Britain’s Secret Intelligence Service, MI6, accused Russia of a “staggeringly reckless campaign” of sabotage in Europe, in part to frighten countries from helping Ukraine. Moscow denies the allegation.

Source: Russian hackers seized control of Norwegian dam, spy chief says | Russia | The Guardian

German court revives case that could threaten ad blockers

Posted on by

A recent ruling by the German Federal Court of Justice (BGH) has reopened the possibility that using ad blocking software could violate copyright law in Germany.

In a decision last month, the BGH – the final court of appeals on civil and criminal matters – partially overturned an appeals court decision in an 11-year copyright dispute brought by publisher Axel Springer against Adblock Plus maker Eyeo GmbH.

The ruling says that the appeals court erred when it determined that the use of ad blocking software does not infringe on a copyright holder’s exclusive right to modify a computer program.

Springer has argued – unsuccessfully so far – that its website code falls under the control of the German Copyright Act. So modifying the web page’s Document Object Model (DOM) or Cascading Style Sheets – a common way to alter or remove web page elements – represents copyright infringement under the company’s interpretation of the law.

The appellate court that initially heard and rejected that argument will now have to revisit the matter, a process likely to add several years to a case that Eyeo believed was settled seven years ago.

Eyeo did not immediately respond to a request for comment. While it offers ad blocking software, the company generates revenue from ads through its Acceptable Ads program – advertisers pay to have ads that are “respectful, nonintrusive and relevant” exempted from filtering. Non-commercial open source projects like uBlock Origin rely on community support.

Philipp-Christian Thomale, senior legal counsel for Axel Springer, celebrated the ruling in a post to LinkedIn, calling it “a true milestone in the copyright protection of software – especially with regard to cloud-based applications (SaaS).”

Among the implications, he argues, is that “software providers will be better equipped to defend against manipulation by third-party software.”

While the outcome remains undecided, Mozilla senior IP & product counsel Daniel Nazer worries that if the German courts ultimately uphold the copyright claim, that will hinder user choice on the internet.

“We sincerely hope that Germany does not become the second jurisdiction (after China) to ban ad blockers,” he wrote in a blog post on Thursday.

“This will significantly limit users’ ability to control their online environment and potentially open the door to similar restrictions elsewhere. Such a precedent could embolden legal challenges against other extensions that protect privacy, enhance accessibility, or improve security.”

Ad blocking, or more broadly content blocking, can save battery life on mobile devices, improve page load times, reduce bandwidth consumption, and protect against malicious ads and nation-states that use ads for offensive cyber operations. The US Federal Bureau of Investigation in 2022 advised, “Use an ad blocking extension when performing internet searches,” as a defense against malicious search ads.

And as Nazer observes, there are many reasons other than ad blocking that one might wish to alter a webpage, such as improving accessibility, evaluating accessibility, or protecting privacy.

[…]

“If the German Supreme Court rules that this is a copyright violation then they would be in direct breach of TFEU [Treaty on the Functioning of the European Union] as such a judgment would not comply with EU law,” he told The Register in an email, pointing to Recital 66 of 2009/136/EC.

Hanff said he was told in writing around 2016 by the EU Commission’s Legal Services that “ad blockers and other such tools absolutely fall into the category of ‘appropriate settings of a browser or other application’ as a means of providing or refusing consent for such technologies (adtech).”

[…]

Source: German court revives case that could threaten ad blockers • The Register

Philipp-Christian Thomale, you are an evil man. Internet without an ad blocker is a horrible horrible thing you should not force on anyone.

New Brain Device Is First to Read Out Inner Speech

Posted on by

[…]

on the cutting edge of this field, neuroscientists have more recently developed brain implants that can turn neural signals directly into whole words. These brain-computer interfaces (BCIs) largely require users to physically attempt to speak, however—and that can be a slow and tiring process. But now a new development in neural prosthetics changes that, allowing users to communicate by simply thinking what they want to say.

The new system relies on much of the same technology as the more common “attempted speech” devices. Both use sensors implanted in a part of the brain called the motor cortex, which sends motion commands to the vocal tract. The brain activation detected by these sensors is then fed into a machine-learning model to interpret which brain signals correspond to which sounds for an individual user. It then uses those data to predict which word the user is attempting to say.

But the motor cortex doesn’t only light up when we attempt to speak; it’s also involved, to a lesser extent, in imagined speech. The researchers took advantage of this to develop their “inner speech” decoding device and published the results on Thursday in Cell. The team studied three people with amyotrophic lateral sclerosis (ALS) and one with a brain stem stroke, all of whom had previously had the sensors implanted. Using this new “inner speech” system, the participants needed only to think a sentence they wanted to say and it would appear on a screen in real time. While previous inner speech decoders were limited to only a handful of words, the new device allowed participants to draw from a dictionary of 125,000 words.

[…]

“Largely, [there was] a lot of excitement about potentially being able to communicate fast again,” she says—adding that one participant was particularly thrilled by his newfound potential to interrupt a conversation—something he couldn’t do with the slower pace of an attempted speech device.

To ensure private thoughts remained private, the researchers implemented a code phrase: “chitty chitty bang bang.” When internally spoken by participants, this would prompt the BCI to start or stop transcribing.

[…]

Source: New Brain Device Is First to Read Out Inner Speech | Scientific American

Hair based toothpased could fix your tooth enamel

Posted on by

Keratin-based films guide biomimetic enamel remineralization by promoting organized hydroxyapatite growth under physiological conditions. Advanced biophysical characterization confirms keratin’s structural adaptability and mineral ions-binding affinity, supporting mineral nucleation and hierarchical crystal assembly. This study establishes keratin as a promising, sustainable platform for functional enamel regeneration, offering a clinically translatable approach for repairing demineralized dental enamel lesions and restoring enamel architecture.

[…]

This study establishes a pre-clinical framework for using water-based keratin platforms to repair enamel demineralization lesions, demonstrating keratin’s potential as a cheap, abundant, and biocompatible biomaterial for functional enamel regeneration. Keratin films self-assembled into β-sheet-rich spherulitic architectures, forming organized nucleation sites that directed the growth of enamel-like mineral layers with aligned apatite nanocrystals and fluoride incorporation. The transition from β-sheets to α-helix and β-turn structures upon mineralization underscores keratin’s dynamic role in orchestrating hierarchical mineralization, mimicking natural enamel formation. These newly formed crystals exhibited significant recovery in hardness and elastic modulus, restoring both surface and subsurface mechanical integrity beyond that achievable with resin infiltration, while preserving crystalline architecture. Importantly, keratin facilitated controlled mineral phase development, transitioning ACP to organized apatite, confirming its capacity to mediate biomineralization efficiently.

Collectively, these findings establish keratin as a clinically viable, sustainable biomaterial for enamel repair, enabling functional regeneration of enamel architecture with a simple, solvent-free fabrication process. Future studies should focus on optimizing keratin’s structural tuning and functionalizing it with additional acidic domains to enhance mineral binding affinity, while conducting systematic in vitro and in vivo cellular studies to evaluate cytocompatibility, bioactivity, and integration within hard tissue environments, thereby supporting its broader application in dental tissue engineering and regenerative medicine. Beyond enamel repair, keratin-based matrices hold promise for addressing bony defects, dentine hypersensitivity, and erosive tooth wear, with broad implications for dental and biomedical fields. The simplicity, scalability, and affordability of this system position keratin as a resourceful platform for advancing sustainable, clinically feasible regenerative strategies in tissue engineering and structural biomimetics.

Source: Biomimetic Mineralization of Keratin Scaffolds for Enamel Regeneration – Gamea – Advanced Healthcare Materials – Wiley Online Library

Pluralistic: “Privacy preserving age verification” is bullshit

Posted on by

[…]

when politicians are demanding that technologists NERD HARDER! to realize their cherished impossibilities.

That’s just happened, and in relation to one of the scariest, most destructive NERD HARDER! tech policies ever to be assayed (a stiff competition). I’m talking about the UK Online Safety Act, which imposes a duty on websites to verify the age of people they communicate with before serving them anything that could be construed as child-inappropriate (a category that includes, e.g., much of Wikipedia):

https://wikimediafoundation.org/news/2025/08/11/wikimedia-foundation-challenges-uk-online-safety-act-regulations/

The Starmer government has, incredibly, developed a passion for internet regulations that are even stupider than Tony Blair’s and David Cameron’s. Requiring people to identify themselves (generally, via their credit cards) in order to look at porn will create a giant database of every kink and fetish of every person in the UK, which will inevitably leak and provide criminals and foreign spies with a kompromat system they can sort by net worth of the people contained within.

This hasn’t deterred Starmer, who insists that if we just NERD HARDER!, we can use things like “zero-knowledge proofs” to create “privacy-preserving” age verification system, whereby a service can assure itself that it is communicating with an adult without ever being able to determine who it is communicating with.

In support of this idea, Starmer and co like to cite some genuinely exciting and cool cryptographic work on privacy-preserving credential schemes. Now, one of the principal authors of the key papers on these credential schemes, Steve Bellovin, has published a paper that is pithily summed up via its title, “Privacy-Preserving Age Verification—and Its Limitations”:

https://www.cs.columbia.edu/~smb/papers/age-verify.pdf

The tldr of this paper is that Starmer’s idea will not work and cannot work. The research he relies on to defend the technological feasibility of his cherished plan does not support his conclusion.

Bellovin starts off by looking at the different approaches various players have mooted for verifying their users’ age. For example, Google says it can deploy a “behavioral” system that relies on Google surveillance dossiers to make guesses about your age. Google refuses to explain how this would work, but Bellovin sums up several of the well-understood behavioral age estimation techniques and explains why they won’t work. It’s one thing to screw up age estimation when deciding which ad to show you; it’s another thing altogether to do this when deciding whether you can access the internet.

Others say they can estimate your age by using AI to analyze a picture of your face. This is a stupid idea for many reasons, not least of which is that biometric age estimation is notoriously unreliable when it comes to distinguishing, say, 16 or 17 year olds from 18 year olds. Nevertheless, there are sitting US Congressmen who not only think this would work – they labor under the misapprehension that this is already going on:

https://pluralistic.net/2023/04/09/how-to-make-a-child-safe-tiktok/

So that just leaves the privacy-preserving credential schemes, especially the Camenisch-Lysyanskaya protocol. This involves an Identity Provider (IDP) that establishes a user’s identity and characteristics using careful document checks and other procedures. The IDP then hands the user a “primary credential” that can attest to everything the IDP knows about the user, and any number of “subcredentials” that only attest to specific facts about that user (such as their age).

These are used in zero-knowledge proofs (ZKP) – a way for two parties to validate that one of them asserts a fact without learning what that fact is in the process (this is super cool stuff). Users can send their subcredentials to a third party, who can use a ZKP to validate them without learning anything else about the user – so you could prove your age (or even just prove that you are over 18 without disclosing your age at all) without disclosing your identity.

There’s some good news for implementing CL on the web: rather than developing a transcendentally expensive and complex new system for these credential exchanges and checks, CL can piggyback on the existing Public Key Infrastructure (PKI) that powers your browser’s ability to have secure sessions when you visit a website with https:// in front of the address (instead of just http://).

However, doing so poses several difficulties, which Bellovin enumerates under a usefully frank section header: “INSURMOUNTABLE OBSTACLES.”

The most insurmountable of these obstacles is getting set up with an IDP in the first place – that is, proving who you are to some agency, but only one such agency (so you can’t create two primary credentials and share one of them with someone underage). Bellovin cites Supreme Court cases about voter ID laws and the burdens they impose on people who are poor, old, young, disabled, rural, etc.

Fundamentally, it can be insurmountably hard for a lot of people to get, say, a driver’s license, or any other singular piece of ID that they can provide to an IDP in order to get set up on the system.

The usual answer for this is for IDPs to allow multiple kinds of ID. This does ease the burden on users, but at the expense of creating fatal weaknesses in the system: if you can set up an identity with multiple kinds of ID, you can visit different IDPs and set up an ID with each (just as many Americans today have drivers licenses from more than one state).

The next obstacle is “user challenges,” like the problem of households with shared computers, or computers in libraries, hotels, community centers and other public places. The only effective way to do this is to create (expensive) online credential stores, which are likely to be out of reach of the poor and disadvantaged people who disproportionately rely on public or shared computers.

Next are the “economic issues”: this stuff is expensive to set up and maintain, and someone’s gotta pay for it. We could ask websites that offer kid-inappropriate content to pay for it, but that sets up an irreconcilable conflict of interest. These websites are going to want to minimize their costs, and everything they can do to reduce costs will make the system unacceptably worse. For example, they could choose only to set up accounts with IDPs that are local to the company that operates the server, meaning that anyone who lives somewhere else and wants to access that website is going to have to somehow get certified copies of e.g. their birth certificate and driver’s license to IDPs on the other side of the planet. The alternative to having websites foot the bill for this is asking users to pay for it – meaning that, once again, we exclude poor people from the internet.

Finally, there’s “governance”: who runs this thing? In practice, the security and privacy guarantees of the CL protocol require two different kinds of wholly independent institutions: identity providers (who verify your documents), and certificate authorities (who issue cryptographic certificates based on those documents). If these two functions take place under one roof, the privacy guarantees of the system immediately evaporate.

An IDP’s most important role is verifying documents and associating them with a specific person. But not all IDPs will be created equal, and people who wish to cheat the system will gravitate to the worst IDPs. However, lots of people who have no nefarious intent will also use these IDPs, merely because they are close by, or popular, or were selected at random. A decision to strike off an IDP and rescind its verifications will force lots of people – potentially millions of people – to start over with the whole business of identifying themselves, during which time they will be unable to access much of the web. There’s no practical way for the average person to judge whether an IDP they choose is likely to be found wanting in the future.

So we can regulate IDPs, but who will do the regulation? Age verification laws affect people outside of a government’s national territory – anyone seeking to access content on a webserver falls under age verification’s remit. Remember, IDPs handle all kinds of sensitive data: do you want Russia, say, to have a say in deciding who can be an IDP and what disclosure rules you will have to follow?

To regulate IDPs (and certificate authorities), these entities will have to keep logs, which further compromises the privacy guarantees of the CL protocol.

Looming all of this is a problem with the CL protocol as being built on regulated entities, which is that CL is envisioned as a way to do all kinds of business, from opening a bank account to proving your vaccination status or your right to work or receive welfare. Authoritarian governments who order primary credential revocations of their political opponents could thoroughly and terrifyingly “unperson” them at the stroke of a pen.

The paper’s conclusions provide a highly readable summary of these issues, which constitute a stinging rebuke to anyone contemplating age-verification schemes. These go well beyond the UK, and are in the works in Canada, Australia, the EU, Texas and Louisiana.

Age verification is an impossibility, and an impossibly terrible idea with impossibly vast consequences for privacy and the open web, as my EFF colleague Jason Kelley explained on the Malwarebytes podcast:

https://www.malwarebytes.com/blog/podcast/2025/08/the-worst-thing-for-online-rights-an-age-restricted-grey-web-lock-and-code-s06e16

Politicians – even nontechnical ones – can make good tech policy, provided they take expert feedback seriously (and distinguish it from self-interested industry lobbying).

When it comes to tech policy, wanting it badly is not enough. The fact that it would be really cool if we could get technology to do something has no bearing on whether we can actually get technology to do that thing. NERD HARDER! isn’t a policy, it’s a wish.

Wish in one hand and shit in the other and see which one will be full first:

https://www.reddit.com/r/etymology/comments/oqiic7/studying_the_origins_of_the_phrase_wish_in_one/

Source: Pluralistic: “Privacy preserving age verification” is bullshit (14 Aug 2025) – Pluralistic: Daily links from Cory Doctorow

This Is the New Pebble Smartwatch, and Yes, It’s Now Called Pebble Again

Posted on by

After more than a decade, the Pebble smartwatch is back, and it already looks enticing for those of us who can’t be bothered with today’s health data-obsessed, sensor-filled, and all-too-weighty wearables. The company behind the revitalized watch shared its final designs for what’s coming, and it may be the simple smartwatch we’ve been missing since 2016.

Last month, original Pebble designer Eric Migicovsky reported that his new company, Core Devices, was able to recover the Pebble trademark, meaning we no longer have to pretend the previous “Core 2 Duo” and “Core Time 2” weren’t an update to the older e-paper wearables. It’s a good thing the name’s back. Pebble is a brand name that fits the revitalized wearable’s identity so perfectly. It’s small and smooth, and anybody with fidgety hands can fiddle with it. On Wednesday, Migicovsky dropped pictures, renders, and specs for the upcoming smartwatches.

First on the list is the Pebble Time 2. The smartwatch has a small, 1.5-inch color e-paper touch display with a bottom heart rate monitor, step counter, and sleep tracker. The update showed off the new smartwatch face frame and buttons—now both made from stainless steel akin to the 2014 Pebble Steel. The back is screwed on in case you ever need to access the internals (though it may also require some glue to hold it together). The head of Core Devices also said the new smartwatch will have a compass and a second microphone that could allow for better noise cancellation for any kind of assistant feature.

“Nobody really uses the compass,” Migicovsky said in a video accompanying his most recent blog post. “90-something percent of people haven’t used the compass on a Pebble, so I wasn’t feeling inclined to put another chip on it. But we found a relatively inexpensive chip… no guarantees how good it’s going to be.”

Pebble Time 2 Design Reveal 2 3020a181 3a95 4c83 91d4 5b872c69e76a
The Pebble Time 2 sports a color e-paper display with an RGB backlight. © Core Devices

The Pebble Time 2 will potentially sport four colorways. Two of the color options are a silver or blackened shade of metal, but there may also be a blue and red polycarbonate option. The final colors haven’t been finalized, but Migicovsky said the company will email all customers with a preorder to finalize their selection. Similarly, anybody who wants to swap their preorder from a $150 Pebble 2 Duo to a $225 Pebble Time 2 can just wait for a survey that will let them choose the more expensive option. The cheaper, polycarbonate option is akin to a Pebble 2, with a 1.2-inch black and white non-touch e-paper display with a barometer and compass, though it also lacks a heart rate monitor.

Migicovsky has been regularly blogging his efforts in China to get the first Pebble units manufactured through his X account. The new images imply we’re getting closer to an actual launch. Core Devices still needs to finalize colors and polish, and the smartwatch shown in the video is still a “very early” rendition of the hardware. The smartwatch is running age-old PebbleOS with a few modern amenities, but there are still glitches to work out. The company still has to go through the process of engineering testing through design and production, so there’s no official word on a release date. Either way, it may be a more exciting wearable than the upcoming Apple Watch Series 11, which is likely to debut in little under a month’s time.

Source: This Is the New Pebble Smartwatch, and Yes, It’s Now Called Pebble Again

UK passport database images used in facial recognition scans

Posted on by

Privacy groups report a surge in UK police facial recognition scans of databases secretly stocked with passport photos lacking parliamentary oversight.

Big Brother Watch says the UK government has allowed images from the country’s passport and immigration databases to be made available to facial recognition systems, without informing the public or parliament.

The group claims the passport database contains around 58 million headshots of Brits, plus a further 92 million made available from sources such as the immigration database, visa applications, and more.

By way of comparison, the Police National Database contains circa 20 million photos of those who have been arrested by, or are at least of interest to, the police.

In a joint statement, Big Brother Watch, its director Silkie Carlo, Privacy International, and its senior technologist Nuno Guerreiro de Sousa, described the databases and lack of transparency as “Orwellian.” They have also written to both the Home Office and the Metropolitan Police, calling for a ban on the practice.

The comments come after Big Brother Watch submitted Freedom of Information requests, which revealed a significant uptick in police scanning the databases in question as part of the force’s increasing facial recognition use.

The number of searches by 31 police forces against the passport databases rose from two in 2020 to 417 by 2023, and scans using the immigration database photos rose from 16 in 2023 to 102 the following year.

Carlo said: “This astonishing revelation shows both our privacy and democracy are at risk from secretive AI policing, and that members of the public are now subject to the inevitable risk of misidentifications and injustice. Police officers can secretly take photos from protests, social media, or indeed anywhere and seek to identify members of the public without suspecting us of having committed any crime.

“This is a historic breach of the right to privacy in Britain that must end. We’ve taken this legal action to defend the rights of tens of millions of innocent people in Britain.”

[…]

Recent data from the Met attempted to imbue a sense of confidence in facial recognition, as the number of arrests the technology facilitated passed the 1,000 mark, the force said in July.

However, privacy campaigners were quick to point out that this accounted for just 0.15 percent of the total arrests in London since 2020. They suggested that despite the shiny 1,000 number, this did not represent a valuable return on investment in the tech.

Alas, the UK has not given up on its pursuit of greater surveillance powers. Prime Minister Keir Starmer, a former human rights lawyer, is a big fan of FR, having said last year that it was the answer to preventing future riots like the ones that broke out across the UK last year following the Southport murders. ®

Source: UK passport database images used in facial recognition scans • The Register

Epic Games has another win over Apple and Google, in Oz

Posted on by

Australia’s Federal Court has given Epic Games another win in its global fight against the way Apple and Google run their app stores.

The Court yesterday delivered its oral decision in a long-running case that, like similar cases elsewhere, considered whether the tech giants abuse market power by preventing developers from pursuing distribution channels that cost less than using their app stores or alternative payment systems.

The Australian case also represented the first major test of a revised definition of abuse of market power under local law.

As explained by law firm Gilbert + Tobin, the court found that both Apple and Google abused market power. Justice Beach found Apple’s App Store and requirement to use only its payment systems for apps sold there “had the purpose, effect or likely effect of substantially lessening competition” and therefore breached Australian competition law.

The Court found Google also misused power it wields in the market for app stores and payment services on Android.

Epic Games hailed the result as a win for developers and consumers. The games developer interpreted the judgement as meaning Apple will be forced to allow it to sell its wares in the App Store, something Cupertino has declined to do after Epic started using external payment systems.

However Epic also noted that the written decision runs to over 2,000 pages, and its expectation it may therefore contain other matters it needs to consider. At the time of writing the Court had not published the judgment and it may be some time before it emerges, because Gilbert + Tobin says the full terms outlined in the decision “are currently embargoed pending resolution of confidentiality claims.”

The matter is therefore far from over, for several reasons. One is that Apple and Google can appeal and appear likely to do so as both already expressed their concerns with some aspects of the judgement. Another is that a class action seeking compensation for overcharging flowing from Apple and Google’s abuse of market power has scarcely begun.

Gilbert + Tobin does, however, note that Australia joins South Korea, India, and Japan in having found or decided that app store operators need to allow more competition, and that the UK is investigating the same issues. Epic, Apple, and Google have also fought over the same issues in the US, where the games developer scored important wins. ®

Source: Epic Games has another win over Apple and Google, in Oz • The Register

Wikipedia:Signs of AI writing – Wikipedia

Posted on by

This is a list of writing and formatting conventions typical of AI chatbots such as ChatGPT, with real examples taken from Wikipedia articles and drafts. Its purpose is to act as a field guide in helping detect undisclosed AI-generated content. Note that not all text featuring the following indicators is AI-generated; large language models (LLMs), which power AI-chatbots, have been trained on human writing, and humans might happen to have a writing style similar to that of an AI.

Source: Wikipedia:Signs of AI writing – Wikipedia

Be Warned: Lessons From Reddit’s Chaotic UK Age Verification Rollout

Posted on by

Age verification has officially arrived in the UK thanks to the Online Safety Act (OSA), a UK law requiring online platforms to check that all UK-based users are at least eighteen years old before allowing them to access broad categories of “harmful” content that go far beyond graphic sexual content. EFF has extensively criticized the OSA for eroding privacy, chilling speech, and undermining the safety of the children it aims to protect. Now that it’s gone into effect, these countless problems have begun to reveal themselves, and the absurd, disastrous outcome illustrates why we must work to avoid this age-verified future at all costs.

Perhaps you’ve seen the memes as large platforms like Spotify and YouTube attempt to comply with the OSA, while smaller sites—like forums focused on parenting, green living, and gaming on Linux—either shut down or cease some operations rather than face massive fines for not following the law’s vague, expensive, and complicated rules and risk assessments.

But even Reddit, a site that prizes anonymity and has regularly demonstrated its commitment to digital rights, was doomed to fail in its attempt to comply with the OSA. Though Reddit is not alone in bowing to the UK mandates, it provides a perfect case study and a particularly instructive glimpse of what the age-verified future would look like if we don’t take steps to stop it.

It’s Not Just Porn—LGBTQ+, Public Health, and Politics Forums All Behind Age Gates

On July 25, users in the UK were shocked and rightfully revolted to discover that their favorite Reddit communities were now locked behind age verification walls. Under the new policies, UK Redditors were asked to submit a photo of their government ID and/or a live selfie to Persona, the for-profit vendor that Reddit contracts with to provide age verification services.

"SUBMIT PHOTO ID" or "ESTIMATE AGE FROM SELFIE."

For many, this was the first time they realized what the OSA would actually mean in practice—and the outrage was immediate. As soon as the policy took effect, reports emerged from users that subreddits dedicated to LGBTQ+ identity and support, global journalism and conflict reporting, and even public health-related forums like r/periods, r/stopsmoking, and r/sexualassault were walled off to unverified users. A few more absurd examples of the communities that were blocked off, according to users, include: r/poker, r/vexillology (the study of flags), r/worldwar2, r/earwax, r/popping (the home of grossly satisfying pimple-popping content), and r/rickroll (yup). This is, again, exactly what digital rights advocates warned about.

The OSA defines “harmful” in multiple ways that go far beyond pornography, so the obstacles the UK users are experiencing are exactly what the law intended. Like other online age restrictions, the OSA obstructs way more than kids’ access to clearly adult sites. When fines are at stake, platforms will always default to overcensoring. So every user in the country is now faced with a choice: submit their most sensitive data for privacy-invasive analysis, or stay off of Reddit entirely. Which would you choose?

[…]

Rollout Chaos: The Tech Doesn’t Even Work! 

In the days after the OSA became effective, backlash to the new age verification measures spread across the internet like wildfire as UK users made their hatred of these new policies clear. VPN usage in the UK soared, over 500,000 people signed a petition to repeal the OSA, and some shrewd users even discovered that video game face filters and meme images could fool Persona’s verification software

[…]

age verification measures still will not achieve their singular goal of protecting kids from so-called “harmful” online content. Teenagers will, uh, find a way to access the content they want. Instead of going to a vetted site like Pornhub for explicit material, curious young people (and anyone else who does not or cannot submit to age checks) will be pushed to the sketchier corners of the internet—where there is less moderation, more safety risk, and no regulation to prevent things like CSAM or non-consensual sexual content. In effect, the OSA and other age verification mandates like it will increase the risk of harm, not reduce it.

If that weren’t enough, the slew of practical issues that have accompanied Reddit’s rollout also reveals the inadequacy of age verification technology to meet our current moment. For example, users reported various bugs in the age-checking process, like being locked out or asked repeatedly for ID despite complying.

[…]

it is excessively clear that age-gating the internet is not the solution to kids’ online safety. Whether due to issues with the discriminatory and error-prone technology, or simply because they lack either a government ID or personal device of their own, millions of UK internet users will be completely locked out of important social, political, and creative communities. If we allow age verification, we welcome new levels of censorship and surveillance with it—while further lining the pockets of big tech and the slew of for-profit age verification vendors that have popped up to fill this market void.

[…]

Source: Americans, Be Warned: Lessons From Reddit’s Chaotic UK Age Verification Rollout | Electronic Frontier Foundation

FDA Approval of Vizz Eye Drops Revolutionizes Presbyopia (inablity to read with age) Treatment

Posted on by

TL;DR: These are eyedrops which cure your growing inability to read as you age and last for 8 hours.

[…] presbyopia affects nearly one in two adults over 40, yet treatment options have remained largely static for decades, confined to optical corrections or surgical procedures. The FDA’s green light for Vizz — the first drop-based, aceclidine-containing ophthalmic formulation approved specifically for near vision correction — was driven by robust phase 3 trial data demonstrating consistent, clinically meaningful improvements in reading acuity without compromising distance vision.

[…]

Vizz’s mechanism pivots on aceclidine’s miotic action, gently constricting the pupil to enhance depth of focus—akin to a dynamic pinhole effect tailored for near tasks. Unlike lens-altering approaches that hinge on accommodation or optical overlays, this ophthalmic solution targets the iris sphincter muscle, inducing a 1.5–2 mm reduction in pupil diameter that sharpens close-range vision without distorting distance clarity. Pharmacologically, aceclidine acts as a selective cholinergic agonist, offering a predictable pharmacokinetic profile with onset of action within 30 minutes and sustained efficacy for up to 8 hours. This mechanism not only underpins clinical efficacy but also directly informs patient-centric dosing strategies. Device-based pupillometry studies confirm that the targeted miotic effect avoids excessive constriction that could impair scotopic performance. Clinicians can customize dosing to patient pupil response, initiating treatment with a classroom-based trial to fine-tune visual outcomes.

[…]

over 75% of participants achieving at least one line of near visual acuity gain on ETDRS charts […] At peak effect, 62% of subjects recorded two or more lines of improvement, and gains persisted through an eight-hour window sufficient for typical daytime activities, from mobile device reading to detailed crafts. Reported adverse effects were mild and transient, primarily limited to brief brow ache or slight dimming of ambient light, without significant impact on distance vision or ocular surface health.

[…]

High patient compliance with Vizz arises from its once-daily dosing schedule, rapid visual benefit, and elimination of cumbersome lens handling

[…]

Source: FDA Approval of Vizz Eye Drops Revolutionizes Presbyopia Treatment – Be part of the knowledge – ReachMD

This seems like a better alternative to Orthrokeratology, where you wear contact lenses at night to reshape your eyes and you can see properly for about a day for nearsightedness. Of course, you can’t use these eyedrops for farsignedness and you can use orthokeratolgoy for that.

UK F-35B Still Stranded In Japan Is Awaiting Spare Parts. The one in India was there for a month.

Posted on by

The U.K. Royal Air Force F-35B stealth fighter that was forced to make an emergency diversion to Japan last week is still there, the U.K. Ministry of Defense has told TWZ.

The F-35B in question, from the Royal Navy carrier HMS Prince of Wales, landed at Kagoshima Airport, in Kirishima City, southwest Japan, at around 11:30 a.m. local time on Aug. 10, following an in-flight malfunction. No injuries to the pilot were reported, and although six flights in and out of Kagoshima were said to be delayed, the airport was soon operating normally again. In the meantime, the F-35B was moved from the runway to a taxiway. Its exact location at the airfield is not currently known.

While the U.K. Ministry of Defense offered no further detail to TWZ about the nature of the technical issues affecting the aircraft now in Japan, it did say that it was completely unrelated to the fault encountered earlier in the cruise, which required a different F-35B to divert to an airfield in India, where it was left stranded for over a month.

The U.K. Ministry of Defense also confirmed that the aircraft in Japan has been assessed by Royal Navy and Royal Air Force engineers; it is now awaiting spares, after which it will be repaired. In the past, the global supply chain of F-35 parts has been questioned, although both the U.S. Marine Corps and Japan itself have F-35Bs based locally.

The two F-35B diversions come during what is one of the highest-profile cruises for the type in British service.

[…]

The two F-35B diversions during Highmast are, in themselves, nothing extraordinary. Such incidents are part and parcel of carrier-based aircraft operations. When not executing blue-water operations, a precautionary emergency landing is often the safest option, bearing in mind the many technical, human-factor, and ship-operational issues that make recovering on the carrier a higher risk. This can include low fuel states.

However, given the turbulent history of the F-35 program and persistent questions about the future of the procurement of this aircraft in the United Kingdom, they are subject to additional scrutiny.

The United Kingdom also lost an F-35B in a well-publicized accident during a previous cruise, when an example crashed in the Mediterranean after an aborted takeoff attempt from the carrier HMS Queen Elizabeth in November 2021

[…]

Source: UK F-35B Still Stranded In Japan Is Awaiting Spare Parts

And recently the UK has announced that they will be purchasing the A variant, exposing them to much larger logistics chains difficulties. And as TR03 is still not problem free (after several years), they won’t be able to fly it operationally for the foreseeable future either. The US must have some serious boot on the neck of the UK for them to keep using these lemons.

Even Volkswagen Is Doing Horsepower Subscriptions Now

Posted on by

[…]

we’re used to hearing about subscriptions for improved performance and creature comforts on luxury cars, but VW’s trialing BMW and Mercedes-Benz’s greatest hits of consumer-hostile policies and gating an additional 27 horsepower behind a $22.30 monthly payment on the ID.3. Alternatively, owners can shell out $878 to unlock that power permanently, for the life of the vehicle.

This news comes courtesy of AutoExpress, and it’s alarming for several reasons. First, again, the ID.3 isn’t exactly a bargain, starting at the equivalent of $41,770, but it’s also no Mercedes EQE. Second, as the article points out, the car is registered at 228 hp stock, which affects insurance rates, even though owners only get 201 hp before subscribing. So, you’re paying a penalty on your insurance premium based on power that you can only access if you give Volkswagen yet more money every month.

This monthly fee also lifts torque from the standard 195 lb-ft to 228 lb-ft, and VW says that the increase in output doesn’t impact range

[…]

The best outcome we can hope for in these cases is that the outcry against it becomes so loud that VW relents. That’s worked to some degree on this side of the pond, with BMW’s heated-seat policies. But the retractions don’t last forever, and automakers are pretty much set on biding their time until software-locking everything is normalized, and they can get away with all of it.

Source: Even Volkswagen Is Doing Horsepower Subscriptions Now

So… you paid for the hardware. It is sitting in the car you own, which is parked in front of your house. And they want to ask more for what you already bought? Absolutely ridiculous and I hope the car hacking scene finds a way to circumvent this.

EU Chat Control Plan Gains Support Again, Threatens Encryption, mass surveillance, age verification

Posted on by

A controversial European Union proposal dubbed “Chat Control” is regaining momentum, with 19 out of 27 EU member states reportedly backing the measure.

The plan would mandate that messaging platforms, including WhatsApp, Signal and Telegram, must scan every message, photo and video sent by users starting in October, even if end-to-end encryption is in place, popular French tech blogger Korben wrote on Monday.

Denmark reintroduced the proposal on July 1, the first day of its EU Council presidency. France, once opposed, is now in favor, Korben said, citing Patrick Breyer, a former member of the European Parliament for Germany and the European Pirate Party.

Belgium, Hungary, Sweden, Italy and Spain are also in favor, while Germany remains undecided. However, if Berlin joins the majority, a qualified council vote could push the plan through by mid-October, Korben said.

A qualified majority in the EU Council is achieved when two conditions are met. First, at least 55 percent of member states, meaning 15 out of 27, must vote in favor. Second, those countries must represent at least 65% of the EU’s total population.

EU Chat Control bill finds support. Source: Pavol Luptak

Pre-encryption scanning on devices

Instead of weakening encryption, the plan seeks to implement client-side scanning, meaning software embedded in users’ devices that inspects content before it is encrypted. “A bit like if the Post Office came to read all your letters in your living room before you put them in the envelope,” Korben said.

He added that the real target isn’t criminals, who use encrypted or decentralized channels, but ordinary users whose private conversations would now be open to algorithmic scrutiny.

The proposal cites the prevention of child sexual abuse material (CSAM) as its justification. However, it would result in “mass surveillance by means of fully automated real-time surveillance of messaging and chats and the end of privacy of digital correspondence,” Breyer wrote.

Beyond scanning, the package includes mandatory age verification, effectively removing anonymity from messaging platforms. Digital freedom groups are asking citizens to contact their MEPs, sign petitions and push back before the law becomes irreversible.

[…]

Source: EU Chat Control Plan Gains Support, Threatens Encryption

Age verification is going horribly wrong in the UK and mass surveillance threatens freedom of thought, something we fortunately still have in the EU. This must be stopped.

New electrolyte highway enables low-temperature hydrogen fuel cells

Posted on by

[…]Researchers at Kyushu University in Japan have developed a new type of solid-oxide fuel cell (SOFC) that operates at 300℃ (500°F) , a notable reduction from typical operating temperatures. “The team expects that their new findings will lead to the development of low-cost, low-temperature SOFCs and greatly accelerate the practical application of these devices,” said the researchers in a press release

….

Such heat requires costly, specialized heat-resistant materials, making the technology expensive for many applications. A lower operating temperature is expected to reduce these manufacturing costs

….

The implications of this work extend beyond this specific fuel cell. The design principle of creating efficient ion pathways in materials provides a basis for developing other energy technologies.Professor Yamazaki suggests the same concept could be applied to improve other tools for decarbonization. “Beyond fuel cells, the same principle can be applied to other technologies, such as low-temperature electrolyzes, hydrogen pumps, and reactors that convert CO₂ into valuable chemicals, thereby multiplying the impact of decarbonization,” he highlighted.

Source: New electrolyte highway enables low-temperature hydrogen fuel cells

You Can Now Tell Google Which Websites You Prefer in Search Results

Posted on by

[…]If you frequently test features with Google Labs, you might remember trying this one out: Preferred Sources, as the name implies, lets you tell Google which websites you prefer to read news from. The goal, then, is to see pages from those sites in future Google searches about news stories, assuming those sites publish content related to your search.

Here’s how it works: When you search for something covered in the news, Google will display a “Top stories” section at the top of the search results page. While you can simply browse the stories that Google curates for you, you can also now click a new button to the right of the “Top stories” title. From here, you can search for any website, and click a checkbox next to its name to save it to your list of preferred sources.

[…]

Now, you can refresh your search results, which, with any luck, will populate with more of the sources you added to this list. Not only will they appear more frequently in the “Top stories” section going forward, Google may offer you a new “From your sources” section as well, which should only contain the websites you’ve added to your list.

[…]

Source: You Can Now Tell Google Which Websites You Prefer in Search Results

I am still using qwant.com

Israel is reportedly storing millions of Palestinian phone calls on Microsoft servers in the Netherlands and Ireland

Posted on by

Israel has allegedly been recording and storing millions of phone calls made by Palestinians in Gaza and the West Bank as part of a large surveillance effort dating back to 2022, according to reporting by The Guardian, +972 Magazine and Local Call. The report suggests that the country has been shuttling these recordings to Microsoft Azure cloud servers.

Company CEO Satya Nadella allegedly okayed the effort personally after meeting with a commander from Israel’s military surveillance agency, Unit 8200. He reportedly gave the country a customized and segregated area within the Azure platform to store millions of phone calls made each day without knowledge or consent from Palestinians.

According to sources within Unit 8200, these recordings have assisted in the preparation of deadly airstrikes and helped shape military operations throughout the region. Israel has long been intercepting calls in the occupied territories, as it basically controls the entire Palestinian telecommunications infrastructure.

This new method, however, reportedly captures the conversations of a large pool of regular civilians. The mantra when building out the project was to record “a million calls an hour.” Leaked Microsoft files suggest that the lion’s share of this data is being stored in Azure facilities in the Netherlands and Ireland.

Microsoft has been facing increased scrutiny regarding its role in Israel’s 22-month offensive in Gaza. CEO Nadella was interrupted by an employee at a keynote speech in May, with the worker pleading for the executive to “show how Israeli war crimes are powered by Azure.”

[…]

Microsoft isn’t the only company that has been accused of assisting Israel in what many are calling a genocide in Gaza. A report recently found that Google employees have repeatedly worked with the Israel Defense Forces (IDF) and Israel’s Defense Ministry (IDM) to expand the government’s access to AI tools.

Source: Israel is reportedly storing millions of Palestinian phone calls on Microsoft servers

Should Lyft and Uber Charge More if Your Battery Is Low? California May Soon Ban That

Posted on by

It’s late at night, and you badly need a ride. Your cellphone’s battery is dangerously low.

Should a ridehailing company such as Uber or Lyft be able to charge you more because its artificial intelligence programming thinks you’re desperate since it knows your phone is about to die?

Not if Hayward Democratic Sen. Aisha Wahab has her way.

Her Senate Bill 259 would prevent retailers from using artificial intelligence to jack up prices using the information stored on customers’ phones. That could include the phone’s battery life, whether it’s an older model, what apps are installed, what time of day it is, where its user is located and where they live.

“Our devices are being weaponized against us in order for large corporations to increase profits, and it has to stop,” Wahab told the Assembly Judiciary Committee last month.

[…]

Source: Should Lyft and Uber Charge More if Your Battery Is Low? California May Soon Ban That

Meta eavesdropped on period-tracker app’s users, SF jury rules

Posted on by

Meta lost a major privacy trial on Friday, with a jury in San Francisco ruling that the Menlo Park giant had eavesdropped on the users of the popular period-tracking app Flo. The plaintiff’s lawyers who sued Meta are calling this a “landmark” victory — the tech company contends that the jury got it all wrong.

The case goes back to 2021, when eight women sued Flo and a group of other tech companies, including Google and Facebook, now known as Meta. The stakes were extremely personal. Flo asked users about their sex lives, mental health and diets, and guided them through menstruation and pregnancy. Then, the women alleged, Flo shared pieces of that data with other companies. The claims were largely based on a 2019 Wall Street Journal story and a 2021 Federal Trade Commission investigation.

Google, Flo and the analytics company Flurry, which was also part of the lawsuit, reached settlements with the plaintiffs, as is common in class action lawsuits about tech privacy. But Meta stuck it out through the entire trial and lost.

[…]

Their complaint also pointed to Facebook’s terms for its business tools, which said the company used so-called “event data” to personalize ads and content.

In a 2022 filing, the tech giant admitted that Flo used Facebook’s kit during this period and that the app sent data connected to “App Events.” But Meta denied receiving intimate information about users’ health.

Nonetheless, the jury ruled against Meta. Along with the eavesdropping decision, the group determined that Flo’s users had a reasonable expectation they weren’t being overheard or recorded, as well as ruling that Meta didn’t have consent to eavesdrop or record. The unanimous verdict was that the massive company violated the California Invasion of Privacy Act.

The jury’s ruling could have far-reaching effects. Per a June filing about the case’s class action status, more than 3.7 million people in the United States registered for Flo between November 2016 and February 2019. Those potential claimants are expected to be updated via email and on a case website; it’s not yet clear what the remittance from the trial or settlements might be.

[…]

Source: Meta eavesdropped on period-tracker app’s users, SF jury rules