Every year, @huertanix.bsky.social and I do a "Worst of Cybersecurity Reporting" talk at @cactuscon.com. We first roasted 2019 articles and keep getting invited back. We work on this talk all year long, discussing candidates in a shared doc, and we'd love your help.

Hoo boy. I am analyzing this to learn more about how it happened. I will have a writeup about how newsrooms can prevent Signal username hijacking risks. www.dropsitenews.com/p/intercept-...

Hoo boy. I am analyzing this to learn more about how it happened. I will have a writeup about how newsrooms can prevent Signal username hijacking risks. www.dropsitenews.com/p/intercept-...

Job alert! The Open Tech Fund (OTF) is hiring program managers: www.opentech.fund/jobs/working...

If you or me download a copyrighted work from the web, it's piracy. So don't do that. But if you pirate the entire public internet, including copyrighted works, that's actually okay. So long as you use it to train LLMs and start a company.

I don't know how any AI companies can justify being upset when someone copies content from them to train their models. arstechnica.com/tech-policy/...

🎉🎉🎉🎉🎉🎉 Nearly 400 local newspapers sue OpenAI, Microsoft over alleged copyright theft.

This indictment seems to allege, specifically, that Alexander Iniguez Mercado committed obstruction of justice "by uninstalling the Signal application" from his phone:

Microsoft constantly demonstrates that the killer app is maintenance and stability. They aren't good at those things. www.windowslatest.com/2026/06/25/w...

NEW: buried within the trove of hacked documents from Madison Square Garden, the folks @404media.co found the company was keeping files on activists that criticized their use of facial recognition. Including me. Here's @fightforthefuture.org's statement: www.fightforthefuture.org/news/2026-06...

On top of boiling the ocean, the price of the Steam Machine means I will forever curse AI companies.

There we go. US Gov tightens post-quantum cryptography transition deadlines for high-value systems to 2030 for key exchange and 2031 for signatures. Also, speeding up the CMVP (FIPS 140 validation) processes. That’s how you know the rush is real. The quantum computers are (potentially) coming.

This is basically how I feel about these chatbots. They can be fun. But ultimately they are software operating on behalf of a company. They’re not doing this for free. techcrunch.com/2026/06/20/s...

I’ve been seeing misinformation about Signal related to this indictment. It goes something like this: The FBI sees your Signal messages, it must be compromised. This is wrong. If you have a public group, anyone can join. If someone’s phone is compromised or seized, those are weak points.

I OCR'd this and unsurprisingly, there's no indication the feds cracked Signal. Your Signal group chats appear to remain technically secure, but practically only safe if no one in the group is a fed or willing to make a deal with law enforcement.

"“We’ve undermined the trust you have that your specific expertise and contribution will be valued, that you will grow and advance your career, and that this will be a place where you can actually have an impact,” Bosworth wrote." Yeah. Maybe stop doing huge layoffs. www.wired.com/story/andrew...

Mary Tyler and will be @opennews.bsky.social’s with a workshop on how to work with folks to get them the answers they wanted, not just the ones they asked for.

My feed is competing for the World Cup, or intermittent bouts of building scaffolding.

This week and last, we’ve been advertising our tip line in workplaces of interest to our reporters across the country. If you’ve seen it, let us know. Insider information fuels our investigations. And to our readers: Consider this our elevator pitch. Where would you put our tips line next?

I am really excited to see what developers do with this. We could see a lot more end-to-end encrypted communication and collaboration tools. www.wired.com/story/signal...

Widespread use of risk profiling by law enforcement, social security and migration programs is incompatible with international human rights law and must be banned, Amnesty International said in a new report which includes Australia’s Robodebt Scheme as an example www.amnesty.org.au/amnesty-repo...

Silicon Valley really said, let's make Celery Man real. www.youtube.com/watch?v=maAF...

Amnesty Tech is looking for a technologist Vitally important work with opportunity for extraordinary impact. ✪ Ability to investigate cyber-surveillance from state actors and industry ✪ Mobile device forensics Locations: Bangkok, Colombo, Johannesburg, London, Mexico City, Nairobi Apply now!

A Pennsylvania Rep “has introduced a bill that would require every pair of smart glasses ‘manufactured, sold, and used’ in the state to have a ‘visual indicator’ that tells others when they’re recording.”

We're seeing a new iteration on "Signal Support" scam attacks. Now attackers aren't just trying to hijack Signal accounts, but they are also trying to get backup recovery keys. Simply put, Signal will not reach out to you from a support account. Report and move on. freedom.press/digisec/blog...

We're adding to our guidance on Signal and WhatsApp. We added more about features to relay your IP through their servers. This prevents your ISP from being able to discern the IP addresses of those you are speaking to via voice or video. freedom.press/digisec/blog... freedom.press/digisec/blog...

We're adding to our guidance on Signal and WhatsApp. We added more about features to relay your IP through their servers. This prevents your ISP from being able to discern the IP addresses of those you are speaking to via voice or video. freedom.press/digisec/blog... freedom.press/digisec/blog...

Next time you hear lawmakers talking about limiting your right to use a VPN, because they want age verification, my colleague Caitlin Vogus and I want you to share this. freedom.press/issues/how-j...

VPN users in the U.S.: Did you know that using a VPN may subject you to foreign intelligence spying? freedom.press/digisec/blog...

We're seeing a new iteration on "Signal Support" scam attacks. Now attackers aren't just trying to hijack Signal accounts, but they are also trying to get backup recovery keys. Simply put, Signal will not reach out to you from a support account. Report and move on. freedom.press/digisec/blog...

I notice lately that Signal now shows an "Official chat" badge on comms from the developers, presumably part of strategy to deal with "Signal Support" scams/impersonators. This is a hard problem… Users don't necessarily know which surfaces to trust. Devs still need to foreground trusted surfaces.

The future does not have to suck. Here I am at BSides Prague, talking about AI and telling folks "Do Not Build the Torment Nexus." www.youtube.com/watch?v=T3K-...

“Hacking” in 2026: Someone politely asks for the account, and the company’s robot intern says yes sir, right away sir

Lately Google has been sending me notices that my old email addresses are being deleted, unless I log in to recover them. So I've been logging into these accounts and finding emails dating back to ~2006, showing that my Myspace account is going to be deleted. Stuff like that. Holy shit.

Next time you hear lawmakers talking about limiting your right to use a VPN, because they want age verification, my colleague Caitlin Vogus and I want you to share this. freedom.press/issues/how-j...

Move fast and break things, indeed. www.404media.co/hackers-simp...

I have found myself using DuckDuckGo more often recently. Sometimes you just want the links that you search for. techcrunch.com/2026/05/26/d...

Journalists are asking us about Lockdown Mode more than ever. In this most recent advice column I talk about my experience using it. On an iPhone, it has massive positives and meaningful trade-offs. On a Mac, though, it's effortless. Try it out and see how you like it. freedom.press/digisec/blog...

Journalists are asking us about Lockdown Mode more than ever. In this most recent advice column I talk about my experience using it. On an iPhone, it has massive positives and meaningful trade-offs. On a Mac, though, it's effortless. Try it out and see how you like it. freedom.press/digisec/blog...

Some good news. This is also just days after Instagram removed end-to-end encrypted direct messages. Each example says a lot about each org's approach to empowering their users. techcrunch.com/2026/05/19/d...

The tyranny of the defaults is powerful. It seems like a lot of companies are betting that in the short term, you might not be happy about features that meaningfully change the service you once enjoyed. But in spite of everything, you'll probably tolerate it. techcrunch.com/2026/05/19/g...

In the future, I suspect textbooks will uses these kinds of prompts as a fun little illustration of what models can do and what they can't do

It's true! I'm hiring another senior writer for my team. Position is FT, remote. Come work with me and some truly brilliant, creative folks to create Cyberpunk 2 💥🦾 www.cdprojektred.com/en/jobs/2205...

I am honored to share the 2026 Pulitzer Prize for Best International Reporting with Dake Kang, Byron Tau, Aniruddha Ghosal and Garance Burke for our reporting revealing how Silicon Valley largely designed and built China's surveillance state and enabled human rights abuses.

Big update: I secured a commitment that the FISA court opinion revealing abuses of Americans' rights will be DECLASSIFIED before Congress votes on reauthorization. The more Americans know about these abuses, the more they’ll demand real reforms.

Journalists sometimes ask us, is my employer watching what I do on my laptop or tracking my whereabouts at work? Sorry, I'm giving the classic "it depends" security person response. Check out our advice column on the topic. freedom.press/digisec/blog...

Using a VPN may subject Americans to warrantless government surveillance. We need much more transparency — and stricter limitations on how the government can use this data to bypass Americans’ privacy rights.

VPN users in the U.S.: Did you know that using a VPN may subject you to foreign intelligence spying? freedom.press/digisec/blog...

Signal gives you a way to stop this in Settings > Notifications > Notification Content