All news with #privacy engineering tag

🔍 Samsung’s entry into AI-powered smart glasses alongside Apple, Google, and Meta has renewed CISO concern about data leakage, privacy, and compliance risks. Enforcing restrictions is difficult because users control device settings and devices can ignore guardrails; visual indicators like recording lights can be defeated. Experts recommend tiered policies focusing on high-risk spaces, education for employees, and narrowly scoped exceptions for accessibility rather than blanket bans.

🔒 Cloudflare has open sourced pvcli, a command-line tool designed to simplify debugging and testing of privacy-preserving protocols such as Oblivious HTTP (OHTTP). The tool automates binary HTTP encoding, key parsing, encryption steps, and protocol flows across relay, gateway, and origin, replacing fragile, script-heavy workflows. Released under the Apache-2.0 License, pvcli supports curl-like arguments, detailed logs, headers forwarding, and mTLS, and will expand to include MASQUE and other privacy protocols.

💬 Live chat widgets on many websites include a real-time typing preview that lets agents see everything you type, even drafts you never send. This feature is common across popular customer support platforms and is used to speed responses and monitor quality, but it can expose sensitive information without your consent. Users rarely notice the feature and most chat widgets lack an option to disable it. To reduce risk, avoid entering personal data in chat boxes and use security tools to block malicious sites and tracking.

🔐 This article summarizes a new paper updating 2012 research on encryption and globalization, focusing on “Round 3” of the Going Dark Debate over end-to-end encryption (E2EE). It outlines the technical foundations, market changes, and government proposals to limit E2EE for law enforcement and national security. The paper identifies five distinct E2EE scenarios and explains why broad restrictions would harm cybersecurity, commerce, and government operations. It concludes by urging skepticism toward new claims for restricting effective encryption, noting persistent lessons from prior rounds.

📱 Google’s phone number verification notifies users when their SIM is confirmed and links that number to all Google accounts on the device. The feature supports RCS messaging and fraud protection but can surface hidden verification SMS or metadata collection. Verification runs by default, may use carrier APIs or hidden SMS, and can attach identifiers like ICCID/IMSI. Users can opt out per account but may lose RCS and risk re-enablement.

🔒 After a breakup, shared digital ties like accounts, subscriptions, and devices can leave you vulnerable if not properly separated. Review active sessions, update passwords and recovery options, and remove your ex from trusted devices and family-sharing settings. Revoke access to smart home devices, unlink payment methods, and cancel or recreate shared subscriptions. Use password managers, privacy tools, and support services to reclaim control and protect your safety.

🛡️ Daniel Solove argues in the Wall Street Journal that individual control over personal data is insufficient to protect privacy in the AI era. He urges shifting regulatory focus to hold companies accountable—similar to food and drug oversight—through measures like data minimization, fiduciary duties, and liability for negligent design. Solove also recommends liability for harmful algorithms and multi-stakeholder review of technologies to ensure safer outcomes.

🔒 A coalition of 43 state attorneys general reached an $18 million settlement with 23andMe (now Chrome Holding Co.) over a 2023 data breach that exposed genetic data of 6.9 million customers. Investigators found the company lacked basic protections against credential-stuffing attacks, including multifactor authentication, password blocklisting, and adequate monitoring. The settlement imposes new security requirements, governance measures, and preserves consumer deletion rights while following prior lawsuits and fines.

🎯 Meta launched Muse Image on July 7, 2026 — an AI image generator that reasons through prompts and scrapes the web for context. Journalists found it could reference any public Instagram account without notifying creators, enabling use of others’ content without permission. Meta disabled the feature on July 10 after criticism, offering no clear commitments on future safeguards or data use policies.

🔎 Researchers at KU Leuven analyzed 85 popular browser-based crypto wallet extensions and found systemic privacy leaks that can link and de-anonymize users. The wallets reveal addresses in clear text to external servers, announce installed wallets to sites, and often fail to revoke access on logout. These behaviors allow separate addresses to be correlated, stale permissions to persist across sessions, and authorized wallets to expose addresses inside embedded frames, enabling cross-site tracking and potential deanonymization.

📰 Meta filed a patent for an AI system that listens to users' voices throughout the day, timestamps emotional readings, and links them to context like location and device usage. The application, published July 2, 2026, describes devices from phones to smart glasses transcribing speech and tagging segments with emotional labels, and optionally combining biometrics and eye-tracking. A related set of claims describes a mood-aware fitness coach that adjusts guidance based on inferred emotional state. The filing is a claim on the idea rather than an announced product, and raises regulatory and privacy questions.

🔎 Members of the European Parliament failed to block an interim measure that extends mass scanning of private communications through 2028. The motion to reject and an amendment requiring warrants both secured more votes in favor than against, but neither reached the necessary absolute majority due to many absences. The extension permits service providers to scan DMs and emails on platforms like Discord, Instagram, Gmail and iCloud without warrants, while end-to-end encrypted services remain unaffected. Supporters argue it combats child sexual abuse; critics warn it threatens privacy and could lead to false positives affecting enterprises.

🔍 AI-powered surveillance will soon monitor and penalize public and private behavior in real time, combining advanced facial recognition, mass databases, and personalized enforcement. These systems, already widespread in China and being trialed globally, can produce chilling effects on personal freedoms, democracy, and social progress by encouraging conformity and self-censorship. Policy interventions like bans, privacy protections, and AI regulation are proposed to prevent such outcomes.

🕶️ Meta’s Ray‑Ban smart glasses, boosted by AI, have sparked privacy concerns after leaked documents revealed a facial‑recognition feature called NameTag. The tool could match faces seen by the glasses to contacts or public profiles across Meta platforms and store unmatched faces in a “Pending” folder. Wired later reported that NameTag code and third‑party facial recognition components from Rank One Computing were embedded in the Meta AI companion app before being partially removed following public outcry.

🎧 This episode of Smashing Security discusses a rash of recent cybersecurity incidents, including a 15-year-old who used a chatbot to cancel nearly 47,000 anime subscriptions and the first documented agentic ransomware, JadePuffer. The hosts also examine Apple’s problematic Hide My Email feature, which has been known to leak addresses for over a year. Guest Zoë Rose joins Graham Cluley to assess implications for security and privacy.

🚨 A 2024 company presentation reveals that Flock uses a so-called “Vehicle Fingerprint” combining decals, bumper stickers, racks and temporary tags to identify cars when license plates are incomplete or absent. The system enables officers to search that dataset, perform multi-geo queries and locate vehicles believed to be traveling together. Bruce Schneier notes this capability echoes older surveillance practices and warns that similar outcomes are possible with broad access to cell phone location data.

🍕Papa John’s partnered with NBCUniversal, Instacart, and media agency Carat to target consumers when they’re likely low on groceries by analyzing Instacart purchase patterns. The campaign creates custom audiences based on purchases of staples like eggs, milk, and produce, then serves tailored creatives on NBCU streaming with prompts such as “Light on groceries?” and QR codes. Carat framed the approach as learning what’s in consumers’ fridges without being “too creepy.” The author notes historical parallels and ethical concerns about such predictive advertising.

🧩 AWS Clean Rooms now supports writing SQL query results to intermediate tables within a collaboration, enabling multi-step analytical workflows between partners. These intermediate tables allow reuse of complex joins and creation of shared ID mapping tables for downstream analyses, all within the collaboration’s privacy boundary. The feature helps reduce costs and improve performance for subsequent analyses such as reach, frequency, and attribution.

🔒 WhatsApp is introducing reserved usernames so users can hide their phone numbers from people who are not in their contacts. The company says reservations are open now and the feature will roll out globally later this year, with an optional username key that others must know to message you for the first time. Users can change or delete reserved usernames, while certain names are reserved for governments, public figures, and businesses.

🔐 WhatsApp has begun global reservations for usernames to let users connect without sharing phone numbers. The optional feature allows creation and reservation of a unique username now, ahead of a wider rollout later this year. Users can also set a username key for extra protection, requiring both the exact username and key to message someone initially. Content creators and businesses may claim matching Instagram or Facebook names, and once enabled others cannot view a user's phone number.