Proton releases Lumo GPT 1.1:  faster, more advanced, European and actually private

Today we’re releasing a powerful update to Lumo that gives you a more capable privacy-first AI assistant offering faster, more thorough answers with improved awareness of recent events.

Guided by feedback from our community, we’ve been busy upgrading our models and adding GPUs, which we’ll continue to do thanks to the support of our Lumo Plus subscribers. Lumo 1.1 performs significantly better across the board than the first version of Lumo, so you can now use it more effectively for a variety of use cases:

  • Get help planning projects that require multiple steps — it will break down larger goals into smaller tasks
  • Ask complex questions and get more nuanced answers
  • Generate better code — Lumo is better at understanding your requests
  • Research current events or niche topics with better accuracy and fewer hallucinations thanks to improved web search

New cat, new tricks, same privacy

The latest upgrade brings more accurate responses with significantly less need for corrections or follow-up questions. Lumo now handles complex requests much more reliably and delivers the precise results you’re looking for.

In testing, Lumo’s performance has increased across several metrics:

  • Context: 170% improvement in context understanding so it can accurately answer questions based on your documents and data
  • Coding: 40% better ability to understand requests and generate correct code
  • Reasoning: Over 200% improvement in planning tasks, choosing the right tools such as web search, and working through complex multi-step problems

Most importantly, Lumo does all of this while respecting the confidentiality of your chats. Unlike every major AI platform, Lumo is open source and built to be private by design. It doesn’t keep any record of your chats, and your conversation history is secured with zero-access encryption so nobody else can see it and your data is never used to train the models. Lumo is the only AI where your conversations are actually private.

Learn about Lumo privacy

Lumo mobile apps are now open source

Unlike Big Tech AIs that spy on you, Lumo is an open source application that exclusively runs open source models. Open source is especially important in AI because it confirms that the applications and models are not being used nefariously to manipulate responses to fit a political narrative or secretly leak data. While the Lumo web client is already open source(new window), today we are also releasing the code for the mobile apps(new window). In line with Lumo being the most transparent and private AI, we have also published the Lumo security model so you can see how Lumo’s zero access encryption works and why nobody, not even Proton can access your conversation history.

Source: Introducing Lumo 1.1 for faster, advanced reasoning | Proton

Physicist simulates turning nuclear waste into fusion fuel

[…] The American Chemical Society on Monday shared preliminary findings from Los Alamos physicist Terence Tarnowsky, who has uncovered evidence – albeit from simulations – that the waste from traditional nuclear reactors could be further refined into tritium, turning more than 90,000 metric tons of useless and deadly garbage into a valuable resource.

And by valuable, we mean valuable.

“Right now, the value of commercial tritium is about $15 million per pound [$33 million per kilogram], and the US doesn’t have any domestic capability to create it,” Tarnowsky told the ACS for the announcement of his research, which has yet to be published. According to an abstract of his paper shared with the press release, a 1 GW(th) deuterium–tritium fusion plant would require more than 55 kg of tritium per year.

[…]

According to Tarnowsky’s simulations, all one would need is a particle accelerator to “jump-start atom-splitting reactions” in the waste that would “ultimately produce tritium after a series of other nuclear reactions.”

The idea isn’t new, Tarnowsky admitted, but modern tech finally makes it practical.

According to his research – all simulated thus far, mind you – an accelerator-driven system running at about a gigawatt of thermal power could produce around 2 kilograms of tritium per year, roughly matching the annual commercial output of Canada’s CANDU reactors.

That’s all well and good, but ACS fails to mention some things in the preliminary bit of information it shared ahead of Tarnowsky’s presentation at its Fall expo this week. It’s not clear what the ratio of nuclear waste input to tritium output is, for example. ACS also didn’t mention if there are other byproducts of the process that could be harmful. The org noted in its release that efficiency calculations are the next step Tarnowsky has planned for his ongoing project, and the group didn’t respond to questions before publication.

[…]

Source: Physicist simulates turning nuclear waste into fusion fuel • The Register

US spy chief Gabbard says UK agreed to drop ‘backdoor’ mandate for Apple

U.S. Director of National Intelligence Tulsi Gabbard said on Monday the UK had agreed to drop its mandate for iPhone maker Apple to provide a “backdoor” that would have enabled access to the protected encrypted data of American citizens.

Gabbard issued the statement on X

saying she had worked for months with Britain, along with President Donald Trump and Vice President JD Vance to arrive at a deal.

[…]

U.S. lawmakers said in May that the UK’s order to Apple to create a backdoor to its encrypted user data could be exploited by cybercriminals and authoritarian governments.
Apple, which has said it would never build such access into its encrypted services or devices, had challenged the order at the UK’s Investigatory Powers Tribunal (IPT).
The iPhone maker withdrew its Advanced Data Protection feature for UK users in February following the UK order. Users of Apple’s iPhones, Macs and other devices can enable the feature to ensure that only they — and not even Apple — can unlock data stored on its cloud.
U.S. officials said earlier this year they were examining whether the UK broke a bilateral agreement by demanding that Apple build a backdoor allowing the British government to access backups of data in the company’s encrypted cloud storage systems.
In a letter dated February 25 to U.S. lawmakers, Gabbard said the U.S. was examining whether the UK government had violated the CLOUD Act, which bars it from issuing demands for the data of U.S. citizens and vice versa.
Cybersecurity experts told Reuters that if Apple chose to build a backdoor for a government, that backdoor would eventually be found and exploited by hackers.
[…]

Source: US spy chief Gabbard says UK agreed to drop ‘backdoor’ mandate for Apple | Reuters

Forget LASIK: Safer, cheaper vision correction could be coming soon

[…] In the body, the shapes of many collagen-containing tissues, including corneas, are held in place by attractions of oppositely charged components. These tissues contain a lot of water, so applying an electric potential to them lowers the tissue’s pH, making it more acidic. By altering the pH, the rigid attractions within the tissue are loosened and make the shape malleable. When the original pH is restored, the tissue is locked into the new shape.

Previously, the researchers used EMR to reshape cartilage-rich rabbit ears, as well as alter scars and skin in pigs. But one collagen-rich tissue that they were eager to explore was the cornea.

In this work, the team constructed specialized, platinum “contact lenses” that provided a template for the corrected shape of the cornea, then placed each over a rabbit eyeball in a saline solution meant to mimic natural tears. The platinum lens acted as an electrode to generate a precise pH change when the researchers applied a small electric potential to the lens. After about a minute, the cornea’s curvature conformed to the shape of the lens — about the same amount of time LASIK takes, but with fewer steps, less expensive equipment and no incisions.

They repeated this setup on 12 separate rabbit eyeballs, 10 of which were treated as if they had myopia, or nearsightedness. In all the “myopic” eyeballs, the treatment dialed in the targeted focusing power of the eye, which would correspond to improved vision. The cells in the eyeball survived the treatment, because the researchers carefully controlled the pH gradient. Additionally, in other experiments, the team demonstrated that their technique might be able to reverse some chemical-caused cloudiness to the cornea — a condition that is currently only treatable through a complete corneal transplant.

Though this initial work is promising, the researchers emphasize that it is in its very early stages. Next up is what Wong describes as, “the long march through animal studies that are detailed and precise,” including tests on a living rabbit rather than just its eyeball. They also plan to determine the types of vision correction possible with EMR, such as near- and far-sightedness and astigmatism. Though the next steps are planned, uncertainties in the team’s scientific funding have put them on hold.

[…]

Source: Forget LASIK: Safer, cheaper vision correction could be coming soon | ScienceDaily

A new mRNA cancer vaccine just wiped out tumors in mice

An experimental mRNA vaccine boosted the tumor-fighting effects of immunotherapy in a mouse-model study, bringing researchers one step closer to their goal of developing a universal vaccine to “wake up” the immune system against cancer.

Published recently in Nature Biomedical Engineering, the University of Florida study showed that like a one-two punch, pairing the test vaccine with common anticancer drugs called immune checkpoint inhibitors triggered a strong antitumor response.

A surprising element, researchers said, was that they achieved the promising results not by attacking a specific target protein expressed in the tumor, but by simply revving up the immune system — spurring it to respond as if fighting a virus. They did this by stimulating the expression of a protein called PD-L1 inside of tumors, making them more receptive to treatment. The research was supported by multiple federal agencies and foundations, including the National Institutes of Health.

[…]

“This paper describes a very unexpected and exciting observation: that even a vaccine not specific to any particular tumor or virus — so long as it is an mRNA vaccine — could lead to tumor-specific effects,” said Sayour, principal investigator at the RNA Engineering Laboratory within UF’s Preston A. Wells Jr. Center for Brain Tumor Therapy.

“This finding is a proof of concept that these vaccines potentially could be commercialized as universal cancer vaccines to sensitize the immune system against a patient’s individual tumor,” said Sayour, a McKnight Brain Institute investigator and co-leader of a program in immuno-oncology and microbiome research.

Until now, there have been two main ideas in cancer-vaccine development: To find a specific target expressed in many people with cancer, or to tailor a vaccine that is specific to targets expressed within a patient’s own cancer.

“This study suggests a third emerging paradigm,” said Duane Mitchell, M.D., Ph.D., a co-author of the paper. “What we found is by using a vaccine designed not to target cancer specifically but rather to stimulate a strong immunologic response, we could elicit a very strong anticancer reaction. And so this has significant potential to be broadly used across cancer patients — even possibly leading us to an off-the-shelf cancer vaccine.”

[…]

Source: A new cancer vaccine just wiped out tumors in mice | ScienceDaily

Boffins release 5G traffic sniffing tool

“Sni5Gect [is] a framework that sniffs messages from pre-authentication 5G communication in real-time,” the researchers from the Singapore University of Technology and Design explained of their work, presented this week at the 34th USENIX security bash, “and injects targeted attack payload in downlink communication towards the UE [User Equipment, i.e. a phone].”

Designed to take advantage of the period just after a device connects to a 5G network and is still in the process of handshaking and authentication – which, the team points out, can occur when entering or leaving a lift, disembarking a plane and turning aeroplane mode off, or even passing through a tunnel or parking garage – Sni5Gect takes advantage of unencrypted messaging between the base station and a target handset.

“Since messages exchanged between the gNB [Next-Generation Node B, the base station] and the UE are not encrypted before the security context is established (pre-authentication state),” the researchers wrote, “an attacker does not require knowledge of the UE’s credentials to sniff uplink/downlink [traffic] nor to inject messages without integrity protection throughout the UE connection procedure.”

That’s a flaw, and one the framework is designed to exploit. The team’s testing showed it capable of sniffing both uplink and downlink traffic with more than 80 percent accuracy, at ranges of up to 20 meters between an off-the-shelf software-defined radio and the target mobile. For packet injection, the success rate varied between 70-90 percent – and delivered, among other things, proof of a novel downgrade attack by which a ne’er-do-well equipped with Sni5Gect could downgrade a connection from 5G to 4G to reduce its security and carry out further surveillance and attacks.

As Sni5Gect works in real-time, its creators have claimed, and can inject attack payloads, including multi-stage attacks, based on protocol state, it’s suited to fingerprinting, denial-of-service attacks, and downgrading.

“To the best of our knowledge,” they wrote in their paper’s introduction [PDF], “Sni5Gect is the first framework that empowers researchers with both over-the-air sniffing and stateful injection capabilities, without requiring a rogue gNB [base station].”

[…]

Not all of the capabilities claimed in the team’s paper have been fully disclosed, however. The team has kept private “other serious exploits leveraging the framework,” in order to “avoid abusing SNI5Gect to launch attacks against people’s smartphones[s].” These exploits, it is claimed, will be made available only to “trusted institutions like universities and research institutions” upon application and verification of their legitimate interest.

[…]

More information, including a link to the open-access paper, is available on the project website.

Source: Boffins release 5G traffic sniffing tool • The Register

Find the git repository here

Gamblers Now Bet on AI Models Like Racehorses

Now that AI developers are getting paid like pro athletes, it’s fitting that fans are placing big bets on how well they’re doing their jobs.

On Kalshi, Polymarket and other sites where people wager “predictions” on real-world events, gamblers lay down millions each month on their picks for AI’s top model.

The AI arms race is playing out in plain sight on social media, ranking sites and obscure corners of the internet where enthusiasts hunt for clues. The constant buzz makes the topic appealing for wagers, though not every scrap of information is meaningful.

[…]

Trading volume across AI prediction markets has surged to around $20 million this month. Kalshi, the only platform currently available in the U.S., is seeing 10 times the volume on AI trades compared with the start of the year, a spokesman says.

Each bet, or “contract,” is priced in cents to reflect the odds: McCoy bought thousands of Gemini contracts at around 40 cents, meaning it had a 40% chance of winning. If the bet had settled and Gemini won, McCoy’s 40 cents would become a dollar. If Gemini lost, McCoy would lose it all.

But much of the action happens before the final outcome. As more people piled into the Gemini bet, the contract price rose. McCoy sold when it had reached 87 cents. It’s like betting on a sports match, only with the option to cash out when the odds rise in favor of your bet.

[…]

Strategies vary. Some bet on the big industry players, others buy low on less-known or soon-to-be-updated models. Some compare odds on Kalshi and Polymarket to find arbitrage opportunities in the odds.

As volume for these AI trades continues to grow, the incentive for good information will only increase, and the squeeze on casual bettors will get tighter, says Robin Hanson, a professor of economics at George Mason University.

“When you have better information in these kinds of markets, you can make better decisions,” Hanson says. “If you know a little more, you make more money.”

[…]

Source: Gamblers Now Bet on AI Models Like Racehorses

The EU could be scanning your chats by October 2025 with Chat Control

Denmark kicked off its EU Presidency on July 1, 2025, and, among its first actions, lawmakers swiftly reintroduced the controversial child sexual abuse (CSAM) scanning bill to the top of the agenda.

Having been deemed by critics as Chat Control, the bill aims to introduce new obligations for all messaging services operating in Europe to scan users’ chats, even if they’re encrypted.

The proposal, however, has been failing to attract the needed majority since May 2022, with Poland’s Presidency being the last to give up on such a plan.

Denmark is a strong supporter of Chat Control. Now, the new rules could be adopted as early as October 14, 2025, if the Danish Presidency manages to find a middle ground among the countries’ members.

Crucially, according to the latest data leaked by the former MEP for the German Pirate Party, Patrick Breyer, many countries that said no to Chat Control in 2024 are now undecided, “even though the 2025 plan is even more extreme,” he added.

[…]

As per its first version, all messaging software providers would be required to perform indiscriminate scanning of private messages to look for CSAM – so-called ‘client-side scanning‘. The proposal was met with a strong backlash, and the European Court of Human Rights ended up banning all legal efforts to weaken encryption of secure communications in Europe.

In June 2024, Belgium then proposed a new text to target only shared photos, videos, and URLs, upon users’ permission. This version didn’t satisfy either the industry or voting EU members due to its coercive nature. As per the Belgian text, users must give consent to the shared material being scanned before being encrypted to keep using the functionality.

Source: The EU could be scanning your chats by October 2025 – here’s everything we know | TechRadar

Trojan horse bacteria sneak cancer-killing viruses into tumors

Researchers at Columbia Engineering have built a cancer therapy that makes bacteria and viruses work as a team. In a study published recently in Nature Biomedical Engineering, the Synthetic Biological Systems Lab shows how their system hides a virus inside a tumor-seeking bacterium, smuggles it past the immune system, and unleashes it inside cancerous tumors.

The new platform combines the bacteria’s tendency to find and attack tumors with the virus’s natural preference for infecting and killing cancerous cells. Tal Danino, an associate professor of biomedical engineering at Columbia Engineering, led the team’s effort to create the system, which is called CAPPSID (short for Coordinated Activity of Prokaryote and Picornavirus for Safe Intracellular Delivery). Charles M. Rice, an expert in virology at The Rockefeller University, collaborated with the Columbia team.

“We aimed to enhance bacterial cancer therapy by enabling the bacteria to deliver and activate a therapeutic virus directly inside tumor cells, while engineering safeguards to limit viral spread outside the tumor,” says co-lead author Jonathan Pabón, an MD/PhD candidate at Columbia.

The researchers believe that this technology — validated in mice — represents the first example of directly engineered cooperation between bacteria and cancer-targeting viruses.

The approach combines the bacteria’s instinct for homing in on tumors with a virus’s knack for infecting and killing cancer cells. “By bridging bacterial engineering with synthetic virology, our goal is to open a path toward multi-organism therapies that can accomplish far more than any single microbe could achieve alone,” says Zakary S. Singer, a co-lead author and former postdoctoral researcher in Tal Danino’s lab.

“This is probably our most technically advanced and novel platform to date,” says Danino, who is also affiliated with the Herbert Irving Comprehensive Cancer Center at Columbia University Irving Medical Center and Columbia’s Data Science Institute.

Sneaking past the immune system

One of the biggest hurdles in oncolytic virus therapy is the body’s own defense system. If a patient has antibodies against the virus — from a prior infection or vaccination — those antibodies can neutralize it before it reaches a tumor. The Columbia team sidestepped that problem by tucking the virus inside tumor-seeking bacteria.

“The bacteria act as an invisibility cloak, hiding the virus from circulating antibodies, and ferrying the virus to where it is needed,” Singer says.

Pabón says this strategy is especially important for viruses that people are already exposed to in daily life.

“Our system demonstrates that bacteria can potentially be used to launch an oncolytic virus to treat solid tumors in patients who have developed immunity to these viruses,” he says.

Targeting the tumor

The system’s bacterial half is Salmonella typhimurium, a species that naturally migrates to the low-oxygen, nutrient-rich environment inside tumors. Once there, the bacteria invade cancer cells and release the virus directly into the tumor’s interior.

“We programmed the bacteria to act as a Trojan horse by shuttling the viral RNA into tumors and then lyse themselves directly inside of cancer cells to release the viral genome, which could then spread between cancer cells,” Singer says.

By exploiting the bacteria’s tumor-homing instincts and the virus’s ability to replicate inside cancer cells, the researchers created a delivery system that can penetrate the tumor and spread throughout it — a challenge that has limited both bacteria- and virus-only approaches.

Safeguarding against runaway infections

A key concern with any live virus therapy is controlling its spread beyond the tumor. The team’s system solved that problem with a molecular trick: making sure the virus couldn’t spread without a molecule it can only get from the bacteria. Since the bacteria stay put in the tumor, this vital component (called a protease) isn’t available anywhere else in the body.

“Spreadable viral particles could only form in the vicinity of bacteria, which are needed to provide special machinery essential for viral maturation in the engineered virus, providing a synthetic dependence between microbes,” Singer says. That safeguard adds a second layer of control: even if the virus escapes the tumor, it won’t spread in healthy tissue.

“It is systems like these — specifically oriented towards enhancing the safety of these living therapies — that will be essential for translating these advances into the clinic,” Singer says.

Further research and clinical applications

This publication marks a significant step toward making this type of bacteria-virus system available for future clinical applications.

“As a physician-scientist, my goal is to bring living medicines into the clinic,” Pabón says. “Efforts toward clinical translation are currently underway to translate our technology out of the lab.”

Danino, Rice, Singer, and Pabón have filed a patent application (WO2024254419A2) with the U.S. Patent and Trademark Office related to this work.

Looking ahead, the team is testing the approach in a wider range of cancers, using different tumor types, mouse models, viruses, and payloads, with an eye to developing a “toolkit” of viral therapies that can sense and respond to specific conditions inside a cell. They are also evaluating how this system can be combined with strains of bacteria that have already demonstrated safety in clinical trials.


Story Source:

Materials provided by Columbia University School of Engineering and Applied Science. Note: Content may be edited for style and length.


Journal Reference:

  1. Zakary S. Singer, Jonathan Pabón, Hsinyen Huang, William Sun, Hongsheng Luo, Kailyn Rhyah Grant, Ijeoma Obi, Courtney Coker, Charles M. Rice, Tal Danino. Engineered bacteria launch and control an oncolytic virus. Nature Biomedical Engineering, 2025; DOI: 10.1038/s41551-025-01476-8

Source: Trojan horse bacteria sneak cancer-killing viruses into tumors | ScienceDaily

How Age Verification Laws Targeting Online Porn Could Be (And Should Be) Viewed As A Labor Rights Issue

[…]

While not a traditional “labor issue,” like union rights and equal pay, the government’s role in regulating and restricting forms of expression that can be produced, distributed, and monetized for entertainment media consumption is a dimension of the age-gating issue often overlooked and/or ignored.

Digital sex workers’ incomes and living conditions are dependent on platforms for content distribution. Sites like OnlyFans, Pornhub, xHamster, Chaturbate, and literally thousands more grant performers and content creators access to revenue generation opportunities that are remote, distributed, and confidential.

Due to these platforms forming the foundations of a trend-setting, technology-innovating, digitally native entertainment industry, age verification laws target digital sex workers’ means of distribution and, in a lot of cases, means of production. The overwhelming majority of adult content creators and adult performers are self-employed—classified as independent contractors and/or small business owners. Some performers have incorporated, with others adding trademarks and intellectual property protections on their branding.

Consider a few examples of adult content creators actively engaging in the activity of running a small business or self-employed enterprise. Platforms such as OnlyFans issue tax forms so that content creators can accurately report their income to the IRS and their state tax authorities. Or take the example of the performer-creator, going by the stage name Gigi Dior, duking it out with high-fashion house Christian Dior in front of the Trademark Trial and Appeal Board at the U.S. Patent and Trademark Office. Activities and actions like these aren’t seen by the vast majority of consumers—or, importantly, the critics of the entire online adult ecosystem.

We all hear the “think of the children” mantra from the Helen Lovejoys of the world daily. We are seeing it now with Collective Shout teaming up with Visa and Mastercard to clamp down on NSFW gaming. We are seeing it in the United Kingdom with calls from both the House of Commons and the House of Lords to ban certain types of pornography to comply with a broad interpretation of the Online Safety Act of 2023.

At least 40 percent of all United States residents live in jurisdictions with age verification laws. Millions of adult content creators are diverse and dynamic. Faced with all of these mounting regulatory pressures, adult entertainment performers and adult content creators—particularly those operating with marginalized identities—have developed a range of creative strategies to sustain their work, visibility, and autonomy in the national digital space. Inaccessibility is a legitimate issue that goes far beyond concerns of consumers.

While these laws are often framed as protecting children, the actual barrier they create is for adults — the lawful consumers who make up the legitimate market for adult entertainment. Under laws like Texas’s HB 1181, anyone wanting to access adult content must submit government-issued ID or sensitive personal data to a third-party vendor. Many adults are unwilling to do this, not because they wish to evade age restrictions, but because they don’t trust where that data will go, how it will be stored, or who might access it.

The result is that large numbers of adults — the only legal audience for these performers in the first place — stop visiting legitimate platforms altogether. That loss of audience directly translates into a loss of income for adult content creators. For an industry where the majority of workers are self-employed, often operating as small businesses, the shrinkage of the paying customer base is an existential threat.

This is why age verification mandates should also be seen as a labor rights issue. They are not simply regulating content; they are regulating the ability of consenting adults to transact with one another in a lawful marketplace.

[…]

Source: How Age Verification Laws Targeting Online Porn Could Be (And Should Be) Viewed As A Labor Rights Issue  | Techdirt

$81M ‘Trade Secrets’ Verdict Against Boeing Was Overturned – and Then Reinstated

14 months ago a jury ruled against Boeing, awarding $81 million in damages to failed electric airplane startup Zunum. “Zunum alleged that Boeing, while ostensibly investing seed money to get the startup off the ground, stole Zunum’s technology and actively undermined its attempts to build a business,” the Seattle Times reported at the time.

But two months later that verdict was overturned, Reuters reports, with U.S. District Judge James Robart deciding that Zunum “did not adequately identify its secrets or show that they derived their value from being kept secret.”

And then three days ago a U.S. appeals court reinstated the original $81 million award, reversing that district judge’s decision and “rejecting his finding that the information Boeing allegedly stole was not entitled to trade-secret protection.” [T]he district court erred in concluding that “Zunum failed to identify any of its alleged trade secrets with sufficient particularity”… Here, the court rejected Zunum’s repeated attempts to introduce comprehensive trade secret definitions into evidence and instead provided the jury with a court-created exhibit enumerating Zunum’s alleged trade secrets with a short description of each. Zunum’s witnesses identified the trade secrets by number, provided a basic explanation of each, and used exhibits and demonstratives to exemplify information comprising specific trade secrets.
“internal Boeing communications introduced at trial suggesting that Boeing intended to modify its own in-house designs, methods, and strategies to incorporate information from certain Zunum trade secrets…” according to the new ruling. “Under the parties’ agreement, Boeing was not permitted to use Zunum’s confidential information for any reason other than to manage its investment in Zunum.”

Reuters adds that “A spokesperson for Boeing declined to comment on the appeals court’s decision”

One final note: The appeals court also ordered the case to be assigned to a new judge after Robart revealed that his wife had acquired Boeing stock through a retirement savings account during the litigation.
Judge Robart had called that an “error”. (And judicial ethics experts interviewed by Business Insider in 2024 “characterized Robart’s trades and delayed disclosure to the parties as a minor issue,” they reported Thursday.)

But Thursday’s ruling notes that the delayed disclosure “taken together with the district court’s consistent rulings in Boeing’s favor during and after trial, could give an objective observer reason to question the district judge’s impartiality in further proceedings.”

Source: $81M ‘Trade Secrets’ Verdict Against Boeing Was Overturned – and Then Reinstated

Security flaws in a carmaker’s web portal let one hacker remotely unlock cars from anywhere

[…] Zveare, who has found bugs in carmakers’ customer systems and vehicle management systems before, found the flaw earlier this year as part of a weekend project, he told TechCrunch.

He said while the security flaws in the portal’s login system was a challenge to find, once he found it, the bugs let him bypass the login mechanism altogether by permitting him to create a new “national admin” account.

The flaws were problematic because the buggy code loaded in the user’s browser when opening the portal’s login page, allowing the user — in this case, Zveare — to modify the code to bypass the login security checks. Zveare told TechCrunch that the carmaker found no evidence of past exploitation, suggesting he was the first to find it and report it to the carmaker.

When logged in, the account granted access to more than 1,000 of the carmakers’ dealers across the United States, he told TechCrunch.

“No one even knows that you’re just silently looking at all of these dealers’ data, all their financials, all their private stuff, all their leads,” said Zveare, in describing the access.

Zveare said one of the things he found inside the dealership portal was a national consumer lookup tool that allowed logged-in portal users to look up the vehicle and driver data of that carmaker.

In one real-world example, Zveare took a vehicle’s unique identification number from the windshield of a car in a public parking lot and used the number to identify the car’s owner. Zveare said the tool could be used to look up someone using only a customer’s first and last name.

With access to the portal, Zveare said it was also possible to pair any vehicle with a mobile account, which allows customers to remotely control some of their cars’ functions from an app, such as unlocking their cars.

Zveare said he tried this out in a real-world example using a friend’s account and with their consent. In transferring ownership to an account controlled by Zveare, he said the portal requires only an attestation — effectively a pinky promise — that the user performing the account transfer is legitimate.

“For my purposes, I just got a friend who consented to me taking over their car, and I ran with that,” Zveare told TechCrunch. “But [the portal] could basically do that to anyone just by knowing their name — which kind of freaks me out a bit — or I could just look up a car in the parking lots.”

[…]

Zveare said this was similar to a feature found in a Toyota dealer portal discovered in 2023.

“They’re just security nightmares waiting to happen,” said Zveare, speaking of the user-impersonation feature.

Once in the portal Zveare found personally identifiable customer data, some financial information, and telematics systems that allowed the real-time location tracking of rental or courtesy cars, as well as cars being shipped across the country, and the option to cancel them — though, Zveare didn’t try.

Zveare said the bugs took about a week to fix in February 2025 soon after his disclosure to the carmaker.

[…]

Source: Security flaws in a carmaker’s web portal let one hacker remotely unlock cars from anywhere | TechCrunch

However he won’t identify the car maker – which is a real problem with bad responsible disclosure rules.

Phishing training is pretty pointless, researchers find

In a scientific study involving thousands of test subjects, eight months and four different kinds of phishing training, the average improvement rate of falling for phishing scams was a whopping 1.7%.

“Is all of this focus on training worth the outcome?” asked researcher Ariana Mirian, a senior security researcher at Censys and recently a Ph.D. student at U.C. San Diego, where the study was conducted. “Training barely works.”

[…]

Dameff and Mirian wanted scientifically rigorous, real-world results. (You can read their academic paper here.) They enrolled more than 19,000 employees of the UCSD Health system and randomly split them into five groups, each member of which would see something different when they failed a phishing test randomly sent once a month to their workplace email accounts.

  • Control: Its members got a 404 error if they clicked on a phishing link in the body of the email.
  • Generic static: This group saw a static webpage containing general information about avoiding phishing scams.
  • Generic interactive: This group was walked through an interactive question-and-answer exercise.
  • Contextual static: A static webpage again, but this time showing the exact phishing lure the subject had received and pointing out the warning signs that were missed.
  • Contextual interactive: An interactive Q&A session that walked the subject on what they missed in the specific lure they’d received.

Over the eight months of testing, however, there was little difference in improvement among the four groups that received different kinds of training. Those groups did improve a bit over the control group’s performance — by the aforementioned 1.7%.

Not what was expected

However, there were some lessons learned — not all expected. The first was that it helped a lot to change up the phishing lures. Most subjects saw right through a phishing email that urged the recipients to change their Outlook account passwords, resulting in failure rates between 1% and 4%.

But about 30% of users clicked on a link promising information about a change in the organization’s vacation policy. Almost as many fell for one about a change in workplace dress code.

“Whoever controls the lures controls the failure rates,” said Mirian. “It’s important to have different lures in your phishing training.”

Another lesson was that given enough time, almost everyone falls for a phishing email. Over the eight months of the experiment, just over 50% failed at least once.

“Given enough time, most people get pwned,” said Mirian. “We need to stop punishing people who fail phishing tests. You’d end up punishing half the company.”

[…]

Source: Phishing training is pretty pointless, researchers find | SC Media

And for a more guerrilla approach, you may want to look at this:

Google Issues New Update Warning To 3.5 Billion Chrome Users

Google has issued a security update for its Chrome browser which you should apply right now. That’s because Google has fixed six issues in its widely-used browser, half of which are rated as having a high severity.

The Chrome Stable channel has been updated to 139.0.7258.127/.128 for Windows, Mac and 139.0.7258.127 for Linux, Google said in an advisory published on the Chrome blog. The Chrome update will roll out over the coming days and weeks, according to Google.

The latest Google Chrome security fixes come just one week after the browser maker issued an update for eight flaws and two weeks following an emergency patch for a high severity vulnerability. The Chrome update also comes after Apple released iOS 18.6, fixing a hefty list of 29 security flaws.

[…]

High Severity Issues Fixed In Google Chrome

CVE-2025-8879 is a heap buffer overflow flaw in libaom, which is rated as having a high impact. Meanwhile, CVE-2025-8880 is a race issue in V8 that Google has also rated as having a high severity.

The last high severity vulnerability is CVE-2025-8901, an out of bounds write issue in ANGLE, which allows a remote attacker to perform out of bounds memory access via a crafted HTML page.

Google details two of the medium severity flaws, CVE-2025-8881, an inappropriate implementation issue in File Picker and CVE-2025-8882, a use after free vulnerability in Aura.

None of the flaws fixed in Google Chrome have been used in real-life attacks, but some of the issues are pretty serious — especially those that can be exploited by remote attackers.

[…]

Source: Google Issues New Update Warning To 3.5 Billion Chrome Users

One small walking adjustment could delay knee surgery for years

Researchers from the University of Utah, New York University and Stanford University are now demonstrating the potential for another option: gait retraining.

By making a small adjustment to the angle of their foot while walking, participants in a year-long randomized control trial experienced pain relief equivalent to medication. Critically, those participants also showed less knee cartilage degradation over that period as compared to a group that received a placebo treatment.

[…]

With support from the National Institutes of Health and other federal agencies, the researchers were specifically looking at patients with mild-to-moderate osteoarthritis in the medial compartment of the knee — on the inside of the leg — which tends to bear more weight than the lateral, outside, compartment. This form of osteoarthritis is the most common, but the ideal foot angle for reducing load in the medial side of the knee differs from person to person depending on their natural gait and how it changes when they adopt the new walking pattern.

[…]

In their first two visits, participants received a baseline MRI and practiced walking on a pressure-sensitive treadmill while motion-capture cameras recorded the mechanics of their gait. This allowed the researchers to determine whether turning the patient’s toe inward or outward would reduce load more, and whether a 5° or 10° adjustment would be ideal.

This personalized analysis also screened out potential participants who could not benefit from the intervention, as none of the foot angle changes could decrease loading in their knees

[…]

Participants from both groups returned to the lab for six weekly training sessions, where they received biofeedback — vibrations from a device worn on the shin — that helped them maintain the prescribed foot angle while walking on the lab’s treadmill. After the six-week training period, participants were encouraged to practice their new gait for at least 20 minutes a day, to the point where it became natural. Periodic check-in visits showed that participants were adhering to their prescribed foot angle within a degree on average.

After a year, all participants self-reported their experience of knee pain and had a second MRI to quantitatively assess the damage to their knee cartilage.

“The reported decrease in pain over the placebo group was somewhere between what you’d expect from an over-the-counter medication, like ibuprofen, and a narcotic, like oxycontin,” Uhlrich said. “With the MRIs, we also saw slower degradation of a marker of cartilage health in the intervention group, which was quite exciting.”

Beyond the quantitative measures of effectiveness, participants in the study expressed enthusiasm for both the approach and the results. One participant said: “I don’t have to take a drug or wear a device…it’s just a part of my body now that will be with me for the rest of my days, so that I’m thrilled with.”

Participants’ ability to adhere to the intervention over long periods of time is one of its potential advantages.

[…]

Before this intervention can be clinically deployed, the gait retraining process will need to be streamlined. The motion-capture technique used to make the original foot angle prescription is expensive and time-consuming; the researchers envision this intervention to eventually be prescribed in a physical therapy clinic and retraining can happen while people go for a walk around their neighborhood.

“We and others have developed technology that could be used to both personalize and deliver this intervention in a clinical setting using mobile sensors, like smartphone video and a ‘smart shoe’,” Uhlrich said. Future studies of this approach are needed before the intervention can be made widely available to the public.

Source: One small walking adjustment could delay knee surgery for years | ScienceDaily

Russian hackers seized control of Norwegian dam, spy chief says

Russian hackers took control of a Norwegian dam this year, opening a floodgate and allowing water to flow unnoticed for four hours, Norway’s intelligence service has said.

The admission, by the Norwegian Police Security Service (PST), marks the first time that Oslo has formally attributed the cyber-attack in April on Bremanger, western Norway, to Moscow.

The attack on the dam, which which is used for farming fish, released 500 litres (132 gallons) of water a second for four hours until the incident was detected and stopped.

The head of PST, Beate Gangås, said on Wednesday: “Over the past year, we have seen a change in activity from pro-Russian cyber actors.” The Bremanger incident was an example of such an attack, she added.

“The aim of this type of operation is to influence and to cause fear and chaos among the general population. Our Russian neighbour has become more dangerous.”

[…]

Intelligence services in Norway, which produces the majority of its electricity using hydropower dams, had previously warned of the potential risk of such attacks on energy infrastructure.

Norway and Russia share a 123-mile (198km) border, with a crossing at Storskog, Europe’s only open Schengen border with Russia.

The Russian embassy in Oslo said Gangås’s statements were “unfounded and politically motivated”.

It told Reuters news agency: “It is obvious that the PST is unsuccessfully trying to substantiate the mythical threat of Russian sabotage against Norwegian infrastructure this year, which it itself invented in its February (annual) report.”

Last year, Richard Moore, the head of Britain’s Secret Intelligence Service, MI6, accused Russia of a “staggeringly reckless campaign” of sabotage in Europe, in part to frighten countries from helping Ukraine. Moscow denies the allegation.

Source: Russian hackers seized control of Norwegian dam, spy chief says | Russia | The Guardian

German court revives case that could threaten ad blockers

A recent ruling by the German Federal Court of Justice (BGH) has reopened the possibility that using ad blocking software could violate copyright law in Germany.

In a decision last month, the BGH – the final court of appeals on civil and criminal matters – partially overturned an appeals court decision in an 11-year copyright dispute brought by publisher Axel Springer against Adblock Plus maker Eyeo GmbH.

The ruling says that the appeals court erred when it determined that the use of ad blocking software does not infringe on a copyright holder’s exclusive right to modify a computer program.

Springer has argued – unsuccessfully so far – that its website code falls under the control of the German Copyright Act. So modifying the web page’s Document Object Model (DOM) or Cascading Style Sheets – a common way to alter or remove web page elements – represents copyright infringement under the company’s interpretation of the law.

The appellate court that initially heard and rejected that argument will now have to revisit the matter, a process likely to add several years to a case that Eyeo believed was settled seven years ago.

Eyeo did not immediately respond to a request for comment. While it offers ad blocking software, the company generates revenue from ads through its Acceptable Ads program – advertisers pay to have ads that are “respectful, nonintrusive and relevant” exempted from filtering. Non-commercial open source projects like uBlock Origin rely on community support.

Philipp-Christian Thomale, senior legal counsel for Axel Springer, celebrated the ruling in a post to LinkedIn, calling it “a true milestone in the copyright protection of software – especially with regard to cloud-based applications (SaaS).”

Among the implications, he argues, is that “software providers will be better equipped to defend against manipulation by third-party software.”

While the outcome remains undecided, Mozilla senior IP & product counsel Daniel Nazer worries that if the German courts ultimately uphold the copyright claim, that will hinder user choice on the internet.

“We sincerely hope that Germany does not become the second jurisdiction (after China) to ban ad blockers,” he wrote in a blog post on Thursday.

“This will significantly limit users’ ability to control their online environment and potentially open the door to similar restrictions elsewhere. Such a precedent could embolden legal challenges against other extensions that protect privacy, enhance accessibility, or improve security.”

Ad blocking, or more broadly content blocking, can save battery life on mobile devices, improve page load times, reduce bandwidth consumption, and protect against malicious ads and nation-states that use ads for offensive cyber operations. The US Federal Bureau of Investigation in 2022 advised, “Use an ad blocking extension when performing internet searches,” as a defense against malicious search ads.

And as Nazer observes, there are many reasons other than ad blocking that one might wish to alter a webpage, such as improving accessibility, evaluating accessibility, or protecting privacy.

[…]

“If the German Supreme Court rules that this is a copyright violation then they would be in direct breach of TFEU [Treaty on the Functioning of the European Union] as such a judgment would not comply with EU law,” he told The Register in an email, pointing to Recital 66 of 2009/136/EC.

Hanff said he was told in writing around 2016 by the EU Commission’s Legal Services that “ad blockers and other such tools absolutely fall into the category of ‘appropriate settings of a browser or other application’ as a means of providing or refusing consent for such technologies (adtech).”

[…]

Source: German court revives case that could threaten ad blockers • The Register

Philipp-Christian Thomale, you are an evil man. Internet without an ad blocker is a horrible horrible thing you should not force on anyone.

New Brain Device Is First to Read Out Inner Speech

[…]

on the cutting edge of this field, neuroscientists have more recently developed brain implants that can turn neural signals directly into whole words. These brain-computer interfaces (BCIs) largely require users to physically attempt to speak, however—and that can be a slow and tiring process. But now a new development in neural prosthetics changes that, allowing users to communicate by simply thinking what they want to say.

The new system relies on much of the same technology as the more common “attempted speech” devices. Both use sensors implanted in a part of the brain called the motor cortex, which sends motion commands to the vocal tract. The brain activation detected by these sensors is then fed into a machine-learning model to interpret which brain signals correspond to which sounds for an individual user. It then uses those data to predict which word the user is attempting to say.

But the motor cortex doesn’t only light up when we attempt to speak; it’s also involved, to a lesser extent, in imagined speech. The researchers took advantage of this to develop their “inner speech” decoding device and published the results on Thursday in Cell. The team studied three people with amyotrophic lateral sclerosis (ALS) and one with a brain stem stroke, all of whom had previously had the sensors implanted. Using this new “inner speech” system, the participants needed only to think a sentence they wanted to say and it would appear on a screen in real time. While previous inner speech decoders were limited to only a handful of words, the new device allowed participants to draw from a dictionary of 125,000 words.

[…]

“Largely, [there was] a lot of excitement about potentially being able to communicate fast again,” she says—adding that one participant was particularly thrilled by his newfound potential to interrupt a conversation—something he couldn’t do with the slower pace of an attempted speech device.

To ensure private thoughts remained private, the researchers implemented a code phrase: “chitty chitty bang bang.” When internally spoken by participants, this would prompt the BCI to start or stop transcribing.

[…]

Source: New Brain Device Is First to Read Out Inner Speech | Scientific American

Hair based toothpased could fix your tooth enamel

Keratin-based films guide biomimetic enamel remineralization by promoting organized hydroxyapatite growth under physiological conditions. Advanced biophysical characterization confirms keratin’s structural adaptability and mineral ions-binding affinity, supporting mineral nucleation and hierarchical crystal assembly. This study establishes keratin as a promising, sustainable platform for functional enamel regeneration, offering a clinically translatable approach for repairing demineralized dental enamel lesions and restoring enamel architecture.

[…]

This study establishes a pre-clinical framework for using water-based keratin platforms to repair enamel demineralization lesions, demonstrating keratin’s potential as a cheap, abundant, and biocompatible biomaterial for functional enamel regeneration. Keratin films self-assembled into β-sheet-rich spherulitic architectures, forming organized nucleation sites that directed the growth of enamel-like mineral layers with aligned apatite nanocrystals and fluoride incorporation. The transition from β-sheets to α-helix and β-turn structures upon mineralization underscores keratin’s dynamic role in orchestrating hierarchical mineralization, mimicking natural enamel formation. These newly formed crystals exhibited significant recovery in hardness and elastic modulus, restoring both surface and subsurface mechanical integrity beyond that achievable with resin infiltration, while preserving crystalline architecture. Importantly, keratin facilitated controlled mineral phase development, transitioning ACP to organized apatite, confirming its capacity to mediate biomineralization efficiently.

Collectively, these findings establish keratin as a clinically viable, sustainable biomaterial for enamel repair, enabling functional regeneration of enamel architecture with a simple, solvent-free fabrication process. Future studies should focus on optimizing keratin’s structural tuning and functionalizing it with additional acidic domains to enhance mineral binding affinity, while conducting systematic in vitro and in vivo cellular studies to evaluate cytocompatibility, bioactivity, and integration within hard tissue environments, thereby supporting its broader application in dental tissue engineering and regenerative medicine. Beyond enamel repair, keratin-based matrices hold promise for addressing bony defects, dentine hypersensitivity, and erosive tooth wear, with broad implications for dental and biomedical fields. The simplicity, scalability, and affordability of this system position keratin as a resourceful platform for advancing sustainable, clinically feasible regenerative strategies in tissue engineering and structural biomimetics.

Source: Biomimetic Mineralization of Keratin Scaffolds for Enamel Regeneration – Gamea – Advanced Healthcare Materials – Wiley Online Library

Pluralistic: “Privacy preserving age verification” is bullshit

[…]

when politicians are demanding that technologists NERD HARDER! to realize their cherished impossibilities.

That’s just happened, and in relation to one of the scariest, most destructive NERD HARDER! tech policies ever to be assayed (a stiff competition). I’m talking about the UK Online Safety Act, which imposes a duty on websites to verify the age of people they communicate with before serving them anything that could be construed as child-inappropriate (a category that includes, e.g., much of Wikipedia):

https://wikimediafoundation.org/news/2025/08/11/wikimedia-foundation-challenges-uk-online-safety-act-regulations/

The Starmer government has, incredibly, developed a passion for internet regulations that are even stupider than Tony Blair’s and David Cameron’s. Requiring people to identify themselves (generally, via their credit cards) in order to look at porn will create a giant database of every kink and fetish of every person in the UK, which will inevitably leak and provide criminals and foreign spies with a kompromat system they can sort by net worth of the people contained within.

This hasn’t deterred Starmer, who insists that if we just NERD HARDER!, we can use things like “zero-knowledge proofs” to create “privacy-preserving” age verification system, whereby a service can assure itself that it is communicating with an adult without ever being able to determine who it is communicating with.

In support of this idea, Starmer and co like to cite some genuinely exciting and cool cryptographic work on privacy-preserving credential schemes. Now, one of the principal authors of the key papers on these credential schemes, Steve Bellovin, has published a paper that is pithily summed up via its title, “Privacy-Preserving Age Verification—and Its Limitations”:

https://www.cs.columbia.edu/~smb/papers/age-verify.pdf

The tldr of this paper is that Starmer’s idea will not work and cannot work. The research he relies on to defend the technological feasibility of his cherished plan does not support his conclusion.

Bellovin starts off by looking at the different approaches various players have mooted for verifying their users’ age. For example, Google says it can deploy a “behavioral” system that relies on Google surveillance dossiers to make guesses about your age. Google refuses to explain how this would work, but Bellovin sums up several of the well-understood behavioral age estimation techniques and explains why they won’t work. It’s one thing to screw up age estimation when deciding which ad to show you; it’s another thing altogether to do this when deciding whether you can access the internet.

Others say they can estimate your age by using AI to analyze a picture of your face. This is a stupid idea for many reasons, not least of which is that biometric age estimation is notoriously unreliable when it comes to distinguishing, say, 16 or 17 year olds from 18 year olds. Nevertheless, there are sitting US Congressmen who not only think this would work – they labor under the misapprehension that this is already going on:

https://pluralistic.net/2023/04/09/how-to-make-a-child-safe-tiktok/

So that just leaves the privacy-preserving credential schemes, especially the Camenisch-Lysyanskaya protocol. This involves an Identity Provider (IDP) that establishes a user’s identity and characteristics using careful document checks and other procedures. The IDP then hands the user a “primary credential” that can attest to everything the IDP knows about the user, and any number of “subcredentials” that only attest to specific facts about that user (such as their age).

These are used in zero-knowledge proofs (ZKP) – a way for two parties to validate that one of them asserts a fact without learning what that fact is in the process (this is super cool stuff). Users can send their subcredentials to a third party, who can use a ZKP to validate them without learning anything else about the user – so you could prove your age (or even just prove that you are over 18 without disclosing your age at all) without disclosing your identity.

There’s some good news for implementing CL on the web: rather than developing a transcendentally expensive and complex new system for these credential exchanges and checks, CL can piggyback on the existing Public Key Infrastructure (PKI) that powers your browser’s ability to have secure sessions when you visit a website with https:// in front of the address (instead of just http://).

However, doing so poses several difficulties, which Bellovin enumerates under a usefully frank section header: “INSURMOUNTABLE OBSTACLES.”

The most insurmountable of these obstacles is getting set up with an IDP in the first place – that is, proving who you are to some agency, but only one such agency (so you can’t create two primary credentials and share one of them with someone underage). Bellovin cites Supreme Court cases about voter ID laws and the burdens they impose on people who are poor, old, young, disabled, rural, etc.

Fundamentally, it can be insurmountably hard for a lot of people to get, say, a driver’s license, or any other singular piece of ID that they can provide to an IDP in order to get set up on the system.

The usual answer for this is for IDPs to allow multiple kinds of ID. This does ease the burden on users, but at the expense of creating fatal weaknesses in the system: if you can set up an identity with multiple kinds of ID, you can visit different IDPs and set up an ID with each (just as many Americans today have drivers licenses from more than one state).

The next obstacle is “user challenges,” like the problem of households with shared computers, or computers in libraries, hotels, community centers and other public places. The only effective way to do this is to create (expensive) online credential stores, which are likely to be out of reach of the poor and disadvantaged people who disproportionately rely on public or shared computers.

Next are the “economic issues”: this stuff is expensive to set up and maintain, and someone’s gotta pay for it. We could ask websites that offer kid-inappropriate content to pay for it, but that sets up an irreconcilable conflict of interest. These websites are going to want to minimize their costs, and everything they can do to reduce costs will make the system unacceptably worse. For example, they could choose only to set up accounts with IDPs that are local to the company that operates the server, meaning that anyone who lives somewhere else and wants to access that website is going to have to somehow get certified copies of e.g. their birth certificate and driver’s license to IDPs on the other side of the planet. The alternative to having websites foot the bill for this is asking users to pay for it – meaning that, once again, we exclude poor people from the internet.

Finally, there’s “governance”: who runs this thing? In practice, the security and privacy guarantees of the CL protocol require two different kinds of wholly independent institutions: identity providers (who verify your documents), and certificate authorities (who issue cryptographic certificates based on those documents). If these two functions take place under one roof, the privacy guarantees of the system immediately evaporate.

An IDP’s most important role is verifying documents and associating them with a specific person. But not all IDPs will be created equal, and people who wish to cheat the system will gravitate to the worst IDPs. However, lots of people who have no nefarious intent will also use these IDPs, merely because they are close by, or popular, or were selected at random. A decision to strike off an IDP and rescind its verifications will force lots of people – potentially millions of people – to start over with the whole business of identifying themselves, during which time they will be unable to access much of the web. There’s no practical way for the average person to judge whether an IDP they choose is likely to be found wanting in the future.

So we can regulate IDPs, but who will do the regulation? Age verification laws affect people outside of a government’s national territory – anyone seeking to access content on a webserver falls under age verification’s remit. Remember, IDPs handle all kinds of sensitive data: do you want Russia, say, to have a say in deciding who can be an IDP and what disclosure rules you will have to follow?

To regulate IDPs (and certificate authorities), these entities will have to keep logs, which further compromises the privacy guarantees of the CL protocol.

Looming all of this is a problem with the CL protocol as being built on regulated entities, which is that CL is envisioned as a way to do all kinds of business, from opening a bank account to proving your vaccination status or your right to work or receive welfare. Authoritarian governments who order primary credential revocations of their political opponents could thoroughly and terrifyingly “unperson” them at the stroke of a pen.

The paper’s conclusions provide a highly readable summary of these issues, which constitute a stinging rebuke to anyone contemplating age-verification schemes. These go well beyond the UK, and are in the works in Canada, Australia, the EU, Texas and Louisiana.

Age verification is an impossibility, and an impossibly terrible idea with impossibly vast consequences for privacy and the open web, as my EFF colleague Jason Kelley explained on the Malwarebytes podcast:

https://www.malwarebytes.com/blog/podcast/2025/08/the-worst-thing-for-online-rights-an-age-restricted-grey-web-lock-and-code-s06e16

Politicians – even nontechnical ones – can make good tech policy, provided they take expert feedback seriously (and distinguish it from self-interested industry lobbying).

When it comes to tech policy, wanting it badly is not enough. The fact that it would be really cool if we could get technology to do something has no bearing on whether we can actually get technology to do that thing. NERD HARDER! isn’t a policy, it’s a wish.

Wish in one hand and shit in the other and see which one will be full first:

https://www.reddit.com/r/etymology/comments/oqiic7/studying_the_origins_of_the_phrase_wish_in_one/

Source: Pluralistic: “Privacy preserving age verification” is bullshit (14 Aug 2025) – Pluralistic: Daily links from Cory Doctorow

This Is the New Pebble Smartwatch, and Yes, It’s Now Called Pebble Again

After more than a decade, the Pebble smartwatch is back, and it already looks enticing for those of us who can’t be bothered with today’s health data-obsessed, sensor-filled, and all-too-weighty wearables. The company behind the revitalized watch shared its final designs for what’s coming, and it may be the simple smartwatch we’ve been missing since 2016.

Last month, original Pebble designer Eric Migicovsky reported that his new company, Core Devices, was able to recover the Pebble trademark, meaning we no longer have to pretend the previous “Core 2 Duo” and “Core Time 2” weren’t an update to the older e-paper wearables. It’s a good thing the name’s back. Pebble is a brand name that fits the revitalized wearable’s identity so perfectly. It’s small and smooth, and anybody with fidgety hands can fiddle with it. On Wednesday, Migicovsky dropped pictures, renders, and specs for the upcoming smartwatches.

First on the list is the Pebble Time 2. The smartwatch has a small, 1.5-inch color e-paper touch display with a bottom heart rate monitor, step counter, and sleep tracker. The update showed off the new smartwatch face frame and buttons—now both made from stainless steel akin to the 2014 Pebble Steel. The back is screwed on in case you ever need to access the internals (though it may also require some glue to hold it together). The head of Core Devices also said the new smartwatch will have a compass and a second microphone that could allow for better noise cancellation for any kind of assistant feature.

“Nobody really uses the compass,” Migicovsky said in a video accompanying his most recent blog post. “90-something percent of people haven’t used the compass on a Pebble, so I wasn’t feeling inclined to put another chip on it. But we found a relatively inexpensive chip… no guarantees how good it’s going to be.”

Pebble Time 2 Design Reveal 2 3020a181 3a95 4c83 91d4 5b872c69e76a
The Pebble Time 2 sports a color e-paper display with an RGB backlight. © Core Devices

The Pebble Time 2 will potentially sport four colorways. Two of the color options are a silver or blackened shade of metal, but there may also be a blue and red polycarbonate option. The final colors haven’t been finalized, but Migicovsky said the company will email all customers with a preorder to finalize their selection. Similarly, anybody who wants to swap their preorder from a $150 Pebble 2 Duo to a $225 Pebble Time 2 can just wait for a survey that will let them choose the more expensive option. The cheaper, polycarbonate option is akin to a Pebble 2, with a 1.2-inch black and white non-touch e-paper display with a barometer and compass, though it also lacks a heart rate monitor.

Migicovsky has been regularly blogging his efforts in China to get the first Pebble units manufactured through his X account. The new images imply we’re getting closer to an actual launch. Core Devices still needs to finalize colors and polish, and the smartwatch shown in the video is still a “very early” rendition of the hardware. The smartwatch is running age-old PebbleOS with a few modern amenities, but there are still glitches to work out. The company still has to go through the process of engineering testing through design and production, so there’s no official word on a release date. Either way, it may be a more exciting wearable than the upcoming Apple Watch Series 11, which is likely to debut in little under a month’s time.

Source: This Is the New Pebble Smartwatch, and Yes, It’s Now Called Pebble Again

UK passport database images used in facial recognition scans

Privacy groups report a surge in UK police facial recognition scans of databases secretly stocked with passport photos lacking parliamentary oversight.

Big Brother Watch says the UK government has allowed images from the country’s passport and immigration databases to be made available to facial recognition systems, without informing the public or parliament.

The group claims the passport database contains around 58 million headshots of Brits, plus a further 92 million made available from sources such as the immigration database, visa applications, and more.

By way of comparison, the Police National Database contains circa 20 million photos of those who have been arrested by, or are at least of interest to, the police.

In a joint statement, Big Brother Watch, its director Silkie Carlo, Privacy International, and its senior technologist Nuno Guerreiro de Sousa, described the databases and lack of transparency as “Orwellian.” They have also written to both the Home Office and the Metropolitan Police, calling for a ban on the practice.

The comments come after Big Brother Watch submitted Freedom of Information requests, which revealed a significant uptick in police scanning the databases in question as part of the force’s increasing facial recognition use.

The number of searches by 31 police forces against the passport databases rose from two in 2020 to 417 by 2023, and scans using the immigration database photos rose from 16 in 2023 to 102 the following year.

Carlo said: “This astonishing revelation shows both our privacy and democracy are at risk from secretive AI policing, and that members of the public are now subject to the inevitable risk of misidentifications and injustice. Police officers can secretly take photos from protests, social media, or indeed anywhere and seek to identify members of the public without suspecting us of having committed any crime.

“This is a historic breach of the right to privacy in Britain that must end. We’ve taken this legal action to defend the rights of tens of millions of innocent people in Britain.”

[…]

Recent data from the Met attempted to imbue a sense of confidence in facial recognition, as the number of arrests the technology facilitated passed the 1,000 mark, the force said in July.

However, privacy campaigners were quick to point out that this accounted for just 0.15 percent of the total arrests in London since 2020. They suggested that despite the shiny 1,000 number, this did not represent a valuable return on investment in the tech.

Alas, the UK has not given up on its pursuit of greater surveillance powers. Prime Minister Keir Starmer, a former human rights lawyer, is a big fan of FR, having said last year that it was the answer to preventing future riots like the ones that broke out across the UK last year following the Southport murders. ®

Source: UK passport database images used in facial recognition scans • The Register

Epic Games has another win over Apple and Google, in Oz

Australia’s Federal Court has given Epic Games another win in its global fight against the way Apple and Google run their app stores.

The Court yesterday delivered its oral decision in a long-running case that, like similar cases elsewhere, considered whether the tech giants abuse market power by preventing developers from pursuing distribution channels that cost less than using their app stores or alternative payment systems.

The Australian case also represented the first major test of a revised definition of abuse of market power under local law.

As explained by law firm Gilbert + Tobin, the court found that both Apple and Google abused market power. Justice Beach found Apple’s App Store and requirement to use only its payment systems for apps sold there “had the purpose, effect or likely effect of substantially lessening competition” and therefore breached Australian competition law.

The Court found Google also misused power it wields in the market for app stores and payment services on Android.

Epic Games hailed the result as a win for developers and consumers. The games developer interpreted the judgement as meaning Apple will be forced to allow it to sell its wares in the App Store, something Cupertino has declined to do after Epic started using external payment systems.

However Epic also noted that the written decision runs to over 2,000 pages, and its expectation it may therefore contain other matters it needs to consider. At the time of writing the Court had not published the judgment and it may be some time before it emerges, because Gilbert + Tobin says the full terms outlined in the decision “are currently embargoed pending resolution of confidentiality claims.”

The matter is therefore far from over, for several reasons. One is that Apple and Google can appeal and appear likely to do so as both already expressed their concerns with some aspects of the judgement. Another is that a class action seeking compensation for overcharging flowing from Apple and Google’s abuse of market power has scarcely begun.

Gilbert + Tobin does, however, note that Australia joins South Korea, India, and Japan in having found or decided that app store operators need to allow more competition, and that the UK is investigating the same issues. Epic, Apple, and Google have also fought over the same issues in the US, where the games developer scored important wins. ®

Source: Epic Games has another win over Apple and Google, in Oz • The Register

Wikipedia:Signs of AI writing – Wikipedia

This is a list of writing and formatting conventions typical of AI chatbots such as ChatGPT, with real examples taken from Wikipedia articles and drafts. Its purpose is to act as a field guide in helping detect undisclosed AI-generated content. Note that not all text featuring the following indicators is AI-generated; large language models (LLMs), which power AI-chatbots, have been trained on human writing, and humans might happen to have a writing style similar to that of an AI.

Source: Wikipedia:Signs of AI writing – Wikipedia

Be Warned: Lessons From Reddit’s Chaotic UK Age Verification Rollout

Age verification has officially arrived in the UK thanks to the Online Safety Act (OSA), a UK law requiring online platforms to check that all UK-based users are at least eighteen years old before allowing them to access broad categories of “harmful” content that go far beyond graphic sexual content. EFF has extensively criticized the OSA for eroding privacy, chilling speech, and undermining the safety of the children it aims to protect. Now that it’s gone into effect, these countless problems have begun to reveal themselves, and the absurd, disastrous outcome illustrates why we must work to avoid this age-verified future at all costs.

Perhaps you’ve seen the memes as large platforms like Spotify and YouTube attempt to comply with the OSA, while smaller sites—like forums focused on parenting, green living, and gaming on Linux—either shut down or cease some operations rather than face massive fines for not following the law’s vague, expensive, and complicated rules and risk assessments.

But even Reddit, a site that prizes anonymity and has regularly demonstrated its commitment to digital rights, was doomed to fail in its attempt to comply with the OSA. Though Reddit is not alone in bowing to the UK mandates, it provides a perfect case study and a particularly instructive glimpse of what the age-verified future would look like if we don’t take steps to stop it.

It’s Not Just Porn—LGBTQ+, Public Health, and Politics Forums All Behind Age Gates

On July 25, users in the UK were shocked and rightfully revolted to discover that their favorite Reddit communities were now locked behind age verification walls. Under the new policies, UK Redditors were asked to submit a photo of their government ID and/or a live selfie to Persona, the for-profit vendor that Reddit contracts with to provide age verification services.

 "SUBMIT PHOTO ID" or "ESTIMATE AGE FROM SELFIE."

For many, this was the first time they realized what the OSA would actually mean in practice—and the outrage was immediate. As soon as the policy took effect, reports emerged from users that subreddits dedicated to LGBTQ+ identity and support, global journalism and conflict reporting, and even public health-related forums like r/periods, r/stopsmoking, and r/sexualassault were walled off to unverified users. A few more absurd examples of the communities that were blocked off, according to users, include: r/poker, r/vexillology (the study of flags), r/worldwar2, r/earwax, r/popping (the home of grossly satisfying pimple-popping content), and r/rickroll (yup). This is, again, exactly what digital rights advocates warned about.

The OSA defines “harmful” in multiple ways that go far beyond pornography, so the obstacles the UK users are experiencing are exactly what the law intended. Like other online age restrictions, the OSA obstructs way more than kids’ access to clearly adult sites. When fines are at stake, platforms will always default to overcensoring. So every user in the country is now faced with a choice: submit their most sensitive data for privacy-invasive analysis, or stay off of Reddit entirely. Which would you choose?

[…]

Rollout Chaos: The Tech Doesn’t Even Work! 

In the days after the OSA became effective, backlash to the new age verification measures spread across the internet like wildfire as UK users made their hatred of these new policies clear. VPN usage in the UK soared, over 500,000 people signed a petition to repeal the OSA, and some shrewd users even discovered that video game face filters and meme images could fool Persona’s verification software

[…]

age verification measures still will not achieve their singular goal of protecting kids from so-called “harmful” online content. Teenagers will, uh, find a way to access the content they want. Instead of going to a vetted site like Pornhub for explicit material, curious young people (and anyone else who does not or cannot submit to age checks) will be pushed to the sketchier corners of the internet—where there is less moderation, more safety risk, and no regulation to prevent things like CSAM or non-consensual sexual content. In effect, the OSA and other age verification mandates like it will increase the risk of harm, not reduce it.

If that weren’t enough, the slew of practical issues that have accompanied Reddit’s rollout also reveals the inadequacy of age verification technology to meet our current moment. For example, users reported various bugs in the age-checking process, like being locked out or asked repeatedly for ID despite complying.

[…]

it is excessively clear that age-gating the internet is not the solution to kids’ online safety. Whether due to issues with the discriminatory and error-prone technology, or simply because they lack either a government ID or personal device of their own, millions of UK internet users will be completely locked out of important social, political, and creative communities. If we allow age verification, we welcome new levels of censorship and surveillance with it—while further lining the pockets of big tech and the slew of for-profit age verification vendors that have popped up to fill this market void.

[…]

Source: Americans, Be Warned: Lessons From Reddit’s Chaotic UK Age Verification Rollout | Electronic Frontier Foundation