Privatnost i sigurnost podataka i korisnika

[Bono]

Across West Asia and North Africa (WANA), growing concerns about digital surveillance have placed Israeli cybersecurity firms and their software under intense scrutiny. Among the most alarming cases is AppCloud, a pre-installed application on Samsung’s A and M series smartphones.

The bloatware cannot be uninstalled easily because it runs on the device’s operating system. Uninstalling it requires root access (the highest level of control in a computer system) of the phone to remove the AppCloud package. Its privacy policy is nowhere to be found online and opting out is not always available.

https://smex.org/invasive-israeli-so...users-in-wana/

Sent from my SM-S931B using Tapatalk

[tomek@vz]

"On October 24, 2025, Azure DDOS Protection automatically detected and mitigated a multi-vector DDoS attack measuring 15.72 Tbps and nearly 3.64 billion packets per second (pps). This was the largest DDoS attack ever observed in the cloud and it targeted a single endpoint in Australia," reads a report published by Microsoft. "The attack originated from Aisuru botnet."

"Attackers are scaling with the internet itself. As fiber-to-the-home speeds rise and IoT devices get more powerful, the baseline for attack size keeps climbing," concludes the post. "As we approach the upcoming holiday season, it is essential to confirm that all internet-facing applications and workloads are adequately protected against DDOS attacks."

[tomek@vz]

Cloudflare suffered its worst network outage in six years on Tuesday, beginning at 11:20 UTC. The disruption prevented the content delivery network from routing traffic for roughly three hours. The failure, writes Cloudflare in a blog post, originated from a database permissions change deployed at 11:05 UTC. The modification altered how a database query returned information about bot detection features. The query began returning duplicate entries. A configuration file used to identify automated traffic doubled in size and spread across the network's machines. Cloudflare's traffic routing software reads this file to distinguish bots from legitimate users. The software had a built-in limit of 200 bot detection features. The enlarged file contained more than 200 entries. The software crashed when it encountered the unexpected file size.

Users attempting to access websites behind Cloudflare's network received error messages. The outage affected multiple services. Turnstile security checks failed to load. The Workers KV storage service returned elevated error rates. Users could not log into Cloudflare's dashboard. Access authentication failed for most customers.

Engineers initially suspected a coordinated attack. The configuration file was automatically regenerated every five minutes. Database servers produced either correct or corrupted files during a gradual system update. Services repeatedly recovered and failed as different versions of the file circulated. Teams stopped generating new files at 14:24 UTC and manually restored a working version. Most traffic resumed by 14:30 UTC. All systems returned to normal at 17:06 UTC.

MI5 has warned U.K. lawmakers that Chinese intelligence operatives are using LinkedIn and recruitment fronts to target them for information gathering and long-term cultivation. PBS reports: Writing to lawmakers, House of Commons Speaker Lindsay Hoyle said a new MI5 "espionage alert" warned that Chinese nationals were "using LinkedIn profiles to conduct outreach at scale" on behalf of the Chinese Ministry of State Security. "Their aim is to collect information and lay the groundwork for long-term relationships, using professional networking sites, recruitment agents and consultants acting on their behalf," he said. MI5 issued the alert because the activity was "targeted and widespread," he added.

The MI5 alert cited LinkedIn profiles of two women, Amanda Qiu and Shirly Shen, and said other similar recruiters' profiles were acting as fronts for espionage. Home Office Minister Dan Jarvis said that apart from parliamentary staff, others including economists, think tank consultants and government officials have been similarly targeted. Jarvis said the government is rolling out a series of measures to tackle the risk, including investing 170 million pounds ($224 million) to renew encrypted technology used by civil servants to safeguard sensitive work. Opposition parties say authorities are not doing enough and are too wary of jeopardizing trade ties with China.

And while there were a few more "skibidis" among the Zoomer dataset compared to those who came before them, the trends were largely similar. Variants on the "123456" were among the most common for all age groups, with that exact string proving to be the most common among all users -- the sixth time in seven years it holds the undesirable crown.

Some of the more adventurous would stretch to "1234567," while budding cryptologists shored up their accounts by adding an 8 or even a 9 to the mix. However, according to Security.org's password security checker, a computer could crack any of these instantly. Most attackers would not even need to expend the resources required to reveal the password, given how commonly used they are. They could just spray a list of known passwords at an authentication API and secure a quick win.

[kopija]

A valjda svi imaju 2FA pa se labave s passwordima

[mkey]

Ma pitanje je koji to servisi dopuštaju lozinke sa samo 5 znakova, i to brojeva? Već godinama 8 znamenki je minimum a samo brojevi da su dopušteni, to pak ne znam da li sam ikada vidio.

[Ivo_Strojnica]

Autor Ivan357

lidl/kaufland već neko vrijeme miču rampe i stavljaju kamere pa ne vidim da se netko bunio

Objasni ti meni kako oni mogu naplatiti KAZNU?

[d0X]

Autor Ivo_Strojnica

Objasni ti meni kako oni mogu naplatiti KAZNU?

Pa ne moraju naplatiti kaznu. Mogu zvati pauka da ti odveze auto, pa njemu plaćaj :P

[Ivo_Strojnica]

šalju mi uplatnicu na kućnu adresu.
nema tu pauka.

[Bono]

Autor Ivo_Strojnica

šalju mi uplatnicu na kućnu adresu.
nema tu pauka.

Otkud podaci?

Sent from my SM-S931B using Tapatalk

[Ivo_Strojnica]

točno to, sve mi je to čudno.
Upravo sam posla AZOPu mail, živo me zanima šta će mi odgovoriti.

[d0X]

Autor Ivo_Strojnica

šalju mi uplatnicu na kućnu adresu.
nema tu pauka.

Ma sprdam se jer ni ne znam kako ide. Tko šalje kaznu, firma ili Grad?

[OuttaControl]

Autor Ivo_Strojnica

točno to, sve mi je to čudno.
Upravo sam posla AZOPu mail, živo me zanima šta će mi odgovoriti.

Javi odgovor i mene bas zanima, odakle njima pravo na vrlo privatne podatke. Nek stave rampe i nema potrebe za privatnim podatcima.

[the.elles.d]

Ovo je situacija da nema rampi i nema potrebe za privatnim podacima ako platiš parking
Ako ne platiš, onda imaju pravne osnove za tražiti podatke od MUP-a.
Kao kad prijaviš krađu, MUP nađe počinitelja i ustupi ti podatke za privatnu tužbu. Je li i to sada problem?

[Alister]

pa ako je u pitanju par € onda je to problem. Jer oni te podatke budu spremili samo i čuvali, kreirali svoje baze, prodali dalje i tako u krug.

[spawn]

Autor Ivo_Strojnica

točno to, sve mi je to čudno.
Upravo sam posla AZOPu mail, živo me zanima šta će mi odgovoriti.

“Na temelju Zakona o sigurnosti prometa na cestama, pravne osobe koje odrede jedinice lokalne samouprave mogu obavljati nadzor parkiranja vozila na mjestima na kojima je parkiranje vremenski ograničeno, što daje pravnu osnovu tim pravnim osobama da mogu od MUP-a pribaviti podatke o vlasnicima vozilima”

AZOP

[Neo-ST]

Pošto nema teme "Orwell unfolding", moram pastati ovdje, pa slobodno prebacite ako treba:

The EU censorship network expands

The EU is expanding censorship through the Digital Services Act (DSA). By the end of 2025, all member states must appoint "trusted flaggers" to enhance online security.


Germany and Austria began this process early, with Austria already certifying five reporting bodies. Belgium and France are also designating reporting organizations to address issues like "hate speech and disinformation."


Critics warn that this network undermines national sovereignty, allowing foreign NGOs to influence freedom of expression.


As of now, eleven EU countries have yet to appoint any flaggers. The Commission plans to standardize this process to prevent "unconventional appointments."

The EU’s “trusted flagger” system (DSA) basically works like this:
Governments in each EU country approve certain NGOs and institutions as trusted flaggers. These groups then monitor social media for things like “illegal content,” hate speech, scams, or disinformation. When they report something, platforms must treat their reports as priority cases, ahead of normal users, or risk fines.

Because of this special status, platforms often remove or demote content quickly to avoid trouble. One controversial part is that a trusted flagger from one country can influence content moderation in another — for example, a German NGO flagging a Croatian user’s post still gets priority. The system keeps logs of all actions, and the EU says tens of millions of posts get removed or down-ranked each quarter. The network is expanding, and by the end of 2025 every EU country must appoint these flaggers.

In short: it’s a government-approved fast lane for content takedowns, with cross-border effects and strong incentives for platforms to over-remove content.

Fact-checkeri na steroidima. A mislili ste da smo ih se riješili? Ne ne.

[mkey]

A nakotilo se fact checkera, moraju ih nekako zbrinuti. Tek sada će vlahov iskakati iz paštete.

[Neo-ST]

Misliš Vidov

[mkey]

Da da, to je ta protuha. Zaboravio sam mu prezime pošto slabo pratim vucibatine.

[Ivo_Strojnica]

Autor spawn

“Na temelju Zakona o sigurnosti prometa na cestama, pravne osobe koje odrede jedinice lokalne samouprave mogu obavljati nadzor parkiranja vozila na mjestima na kojima je parkiranje vremenski ograničeno, što daje pravnu osnovu tim pravnim osobama da mogu od MUP-a pribaviti podatke o vlasnicima vozilima”

AZOP

Poštovani,
Nastavno na Vaše obraćanje ovoj Agenciji vezano uz kazne za parkiranje od strane Lidl i Kauflanda navodimo da je Agencija već zaprimila prijave u odnosu na isto te je u tijeku ispitni postupak radi utvrđivanja svih relevantnih činjenica i okolnosti.
S poštovanjem,


Ovo nije sigurnost na cesti, tako da ne vidim kako se taj zakon može iskoristiti u ovu svrhu.
U prijevodu, ja mogu sa svojim parkingom u Dalmaciji o svima vama saznati registracije, samo trebam reći MUP-u broj rege?
How yes no.

[blackshtef]

Na Redditu sam nedavno baš naletio na ovu raspravu - https://www.reddit.com/r/croautomobi...fland_parking/


Registracijska oznaka auta jest privatan podatak, ali najbitniji dio je ovaj quote sa prvog komentara:

Dakle, naplatu vrsi tvrtka Tilia, koja prema Kaufland stranici ima sporazum s MUP-om. Sporazum moze imati jedino ako joj je neki grad prepustio obavljanje komunalnih poslova vezanih za javna parkiralista. Takav sporazum se ne moze sklopiti za privatna parkiralista jer to nije u skladu sa Zakonom o sigurnosti prometa na cestama niti sa Zakonom o zastiti osobnih podataka.
Tilia zbilja ima ugovor za određene gradove te su pristup MUP-ovim podacima do nedavno zloupotrebljavali i za privatna parkiralista pokraj trgovina. Za to im je AZOP izrekao kaznu od 80 000€. Nemaju nikakve pravne osnove da nastave takvu praksu.
Ako netko dobije kaznu prvo zatrazite ocitovanje od njih o izvoru osobnih podataka, zatim to provjerite s MUP-om i kao posljednji korak prijavite AZOP-u.

[mkey]

Privatno javna partnerstva

[Nikky]

Evo još jedan alat iz naslova za W10 / W11:
W10Privacy
https://www.w10privacy.de/english-home/
https://www.neowin.net/software/w10privacy-5300/

[Pupo]

Autor Ivo_Strojnica

Poštovani,
Nastavno na Vaše obraćanje ovoj Agenciji vezano uz kazne za parkiranje od strane Lidl i Kauflanda navodimo da je Agencija već zaprimila prijave u odnosu na isto te je u tijeku ispitni postupak radi utvrđivanja svih relevantnih činjenica i okolnosti.
S poštovanjem,


Ovo nije sigurnost na cesti, tako da ne vidim kako se taj zakon može iskoristiti u ovu svrhu.
U prijevodu, ja mogu sa svojim parkingom u Dalmaciji o svima vama saznati registracije, samo trebam reći MUP-u broj rege?
How yes no.

Možeš saznati vlasnika vozila, al ne u smislu da nazoveš mup i oni ti izdiktiraju vlasnika vozila.

Meni je lik stajao danima na mom privatnom parkingu, pa sam zvao murju i postoji procedura, može se doći do vlasnika.

[vex]

Autor Pupo

Možeš saznati vlasnika vozila, al ne u smislu da nazoveš mup i oni ti izdiktiraju vlasnika vozila.

Meni je lik stajao danima na mom privatnom parkingu, pa sam zvao murju i postoji procedura, može se doći do vlasnika.

prvi dan ceduljica na šajbi, drugi dan cigla

[tomek@vz]

I imagine that most people who take an interest in de-Googling are concerned about privacy. Privacy on the Internet is a somewhat nebulous concept, but one aspect of privacy is surely the prevention of your web browsing behaviour being propagated from one organization to another. I don’t want my medical insurers to know, for example, that I’ve been researching coronary artery disease. And even though my personal safety and liberty probably aren’t at stake, I don’t want to give any support to the global advertising behemoth, by allowing advertisers access to better information about me.
Unfortunately, while distancing yourself from Google and its services might be a necessary first step in protecting your privacy, it’s far from the last. There’s more to do, and it’s getting harder to do it, because of browser fingerprinting.

> The privacy nightmare of browser fingerprinting

[tomek@vz]

Gmail users who are concerned about how Google handles their data should look for the toggles for smart features in the settings menu. The fine print states that the AI functionality, which includes many features, is intended mainly for personalizing the user experience. However, some remain suspicious given Google's efforts to insert Gemini into all of its products.
The settings menu states that users who enable smart features agree to let Google use their information and activity to personalize the experience. Malwarebytes and blogger Dave Jones interpreted the wording to mean that the company is training AI with user content, but Google insists this isis inaccurate.

> Google denies Gmail reads your emails and attachments to train AI, but here's how to opt-out anyway

[Bono]

France and are continuing the process of leaving OVH. We'll be rotating our TLS keys and Let's Encrypt account keys pinned via accounturi. DNSSEC keys may also be rotated. Our backups are encrypted and can remain on OVH for now.

Our App Store verifies the app store metadata with a cryptographic signature and downgrade protection along with verification of the packages. Android's package manager also has another layer of signature verification and downgrade protection.

Our System Updater verifies updates with a cryptographic signature and downgrade protection along with another layer of both in update_engine and a third layer of both via verified boot. Signing channel release channel names is planned too.

Our update mirrors are currently hosted on sponsored servers from ReliableSite (Los Angeles, Miami) and Tempest (London). London is a temporary location due to an emergency move from a provider which left the dedicated server business and will move. More sponsored update mirrors are coming.

Our ns1 anycast network is on Vultr and our ns2 anycast network is on BuyVM since both support BGP for announcing our own IP space. We're moving our main website/network servers used for default OS connections to a mix of Vultr+BuyVM locations.

We have 5 servers in Canada with OVH with more than static content and basic network services: email, Matrix, discussion forum, Mastodon and attestation. Our plan is to move these to Netcup root servers or a similar provider short term and then colocated servers in Toronto long term.

France isn't a safe country for open source privacy projects. They expect backdoors in encryption and for device access too. Secure devices and services are not going to be allowed. We don't feel safe using OVH for even a static website with servers in Canada/US via their Canada/US subsidiaries.

We were likely going to be able to release experimental Pixel 10 support very soon and it's getting disrupted. The attacks on our team with ongoing libel and harassment have escalated, raids on our chat rooms have escalated and more. It's rough right now and support is appreciated.

https://x.com/GrapheneOS/status/1993...800584103?s=20

Sent from my SM-S931B using Tapatalk