Cock.li confirmed the validity of the breach based on sample data and column structure, stating that the exposed dataset includes roughly 1,023,800 user records. The compromised fields include email addresses, timestamps of first and last webmail logins, failed login attempt data, language preferences, and serialized Roundcube user settings such as webmail signatures and interface configurations. Additionally, approximately 93,000 contact entries associated with around 10,400 users were leaked, containing names, email addresses, comments, and vCard data.

Not sure why people ever trusted a meme email provider in the first place...

cross-posted from: https://programming.dev/post/32339919

The Nectar project offers 'advanced data analysis' using a wide range of sensitive personal information

A controversial US spy tech firm has landed a contract with UK police to develop a surveillance network that will incorporate data about citizens’ political opinions, philosophical beliefs, health records and other sensitive personal information.

Documents obtained by i and Liberty Investigates show Palantir Technologies has partnered with police forces in the East of England to establish a “real-time data-sharing network” that includes the personal details of vulnerable victims, children and witnesses alongside suspects.

Trade union membership, sexual orientation and race are among the other types of personal information being processed.

The project has sparked alarm from campaigners who fear it will trample over Britons’ human rights and “facilitate dystopian predictive policing” and indiscriminate mass surveillance.

Numerous police forces have previously refused to confirm or deny their links with Palantir, citing risks to law enforcement and national security. However, forces in Bedfordshire and Leicestershire have recently confirmed working with the firm.

Liberty Investigates and i have learned that those projects involve processing data from more than a dozen UK police forces and will serve as a pilot for a potential national rollout of the tech giant’s data mining technology — which has reportedly been used by police forces in the US to predict future crimes.

Original question by @[email protected]

I'm looking to direct people to message me on >Signal, Matrix, etc. Any suggestions? Thanks in advance

Matrix is going Freemium and WhatsApp is adding ads, which is sparking the annual "time to leave [app]" threads.

Users don't care that much about privacy, but they do care about enshittification, so XMPP not being built for it shouldn't be a problem.

Meanwhile, I've heard for years that XMPP has solved a lot of the problems that lead more popular apps to fail.

Is it really just a marketing/UX/UI problem?

If XMPP had a killer app with all the features that Signal/Whatsapp/Telegram has, would it have as many users?

If not, why does it keep getting out-adopted by new apps and protocols?

EDIT: I decided on Mailbox.org!

I'd like to use a third-party client like Thunderbird to handle my e-mails, which rules out both Tuta and Proton (I know Proton has their bridge, but I don't want to rely on it). I'm willing to compromise on my e-mails not being encrypted, as long as the e-mail provider has a reputation of caring about the customer's privacy. If I truly want to encrypt a message, I'll encrypt it myself. I've been looking at Mailbox.org, and while I've been hearing good things, people have also been complaining about their lack of support, outdated interface as well as that they don't enforce DKIM/DMARC which enables spoofing.

I would like to be able to use my own custom domain, but also to use their own domain for my e-mail aliases. EU-based only.

Any thoughts?

Some good info for those getting started and to share with those who are now taking interest.

cross-posted from: https://lemmy.zip/post/41151237

Arrest of Alejandro Theodoro Orellana comes as federal officials have been defending ICE use of face masks against mounting criticism

GrapheneOS statement on Mastodon: https://grapheneos.social/@GrapheneOS/114661914197695338

Calyx made an official statement on this development here: https://calyxos.org/news/2025/06/11/android-16-plans/

Concerning stuff. Hopefully a workaround or solution is found at some point, but if not, I'm already thinking of how to manage without them.

I can't see myself going back to a standard Android phone, so I suppose worse case scenario, I'd have to settle with LineageOS, or potentially abandon Android altogether and see if I can manage with discrete separate devices to fulfill the same needs, such as:

• a pocketable mini-Linux PC like a MNT Pocket Reform, which has the ability to use cellular networks. Should be able to text, browse web, and maybe GPS? Alternatively, perhaps the Mecha Comet?
• Small pocket-able dumb camera
• MP3 player
• Dumb-phone kept in a faraday bag when not in use?

EDIT:

Update on the situation from GrapheneOS in this thread (using Redlib, a proxy of Reddit)

The biggest problem for GrapheneOS is not the change to AOSP but rather our lead developer since 2022 being forcibly conscripted to fight in a war in April. That's why we've been asking for help since April.

In April, we were contacted by someone about upcoming changes to AOSP impacting us including the removal of device support in Android 16. We talked about it internally but didn't know if the information was credible. We prepared as much as we could for the Android 16 port but didn't know exactly what would happen with device support. If we had clearer information on it and knew it was accurate, we could have prepared much more in advanced.

Porting to Android 16 is required to continue shipping full Android privacy/security patches regardless of device. Only the latest stable release gets full privacy/security patches, which was the May release of Android 15 QPR2 and is not Android 16. Older releases only get backports.

Pixels also only have their driver and firmware patches for Android 16, although we're working on a release within the next 24 hours with backports of the most important firmware patches. We would normally have an experimental Android 16 release out already, if they hadn't made changes to AOSP.

There are further changes coming to AOSP. It is not only what is talked about there.

In another comment:

We're going to be continuing GrapheneOS but in the long term we'll need to shift to our own devices with an OEM partner.

It's not only Pixels which are going to be impacted. Pixels are still the only devices meeting our hardware requirements (https://grapheneos.org/faq#future-devices). It's clear we need our own hardware in partnership with an OEM that's serious about security and capable of delivering on it. We've had several attempts at OEM partnerships but they were unable to provide what we needed. It will cost millions of dollars to get a device meeting our basic requirements. We can do that, but we hoped for an OEM wanting to work with us instead of us needing to pay for everything through raising funds. We didn't end up finding a good OEM to work with that way so we'll do it the hard way.

Dark Web Interdiction Act of 2025

Here is the text of a bill introduced to Congress (US), ostensibly to combat the trafficking of opioids over "The Dark Web". There's a nice definition of "The Dark Web" at section 4.

I like the part where it says people are using "The Dark Web" both within the United States and "at the international border".

Full text to bypass paywall:

A data broker owned by the country’s major airlines, including Delta, American Airlines, and United, collected U.S. travellers’ domestic flight records, sold access to them to Customs and Border Protection (CBP), and then as part of the contract told CBP to not reveal where the data came from, according to internal CBP documents obtained by 404 Media. The data includes passenger names, their full flight itineraries, and financial details.

CBP, a part of the Department of Homeland Security (DHS), says it needs this data to support state and local police to track people of interest’s air travel across the country, in a purchase that has alarmed civil liberties experts.

The documents reveal for the first time in detail why at least one part of DHS purchased such information, and comes after Immigration and Customs Enforcement (ICE) detailed its own purchase of the data. The documents also show for the first time that the data broker, called the Airlines Reporting Corporation (ARC), tells government agencies not to mention where it sourced the flight data from.

“The big airlines—through a shady data broker that they own called ARC—are selling the government bulk access to Americans' sensitive information, revealing where they fly and the credit card they used,” Senator Ron Wyden said in a statement.

ARC is owned and operated by at least eight major U.S. airlines, other publicly released documents show. The company’s board of directors include representatives from Delta, Southwest, United, American Airlines, Alaska Airlines, JetBlue, and European airlines Lufthansa and Air France, and Canada’s Air Canada. More than 240 airlines depend on ARC for ticket settlement services.

Do you work at ARC or an agency that uses ARC data? I would love to hear from you. Using a non-work device, you can message me securely on Signal at joseph.404 or send me an email at [email protected].

ARC’s other lines of business include being the conduit between airlines and travel agencies, finding travel trends in data with other firms like Expedia, and fraud prevention, according to material on ARC’s YouTube channel and website. The sale of U.S. flyers’ travel information to the government is part of ARC’s Travel Intelligence Program (TIP).

A Statement of Work included in the newly obtained documents, which describes why an agency is buying a particular tool or capability, says CBP needs access to ARC’s TIP product “to support federal, state, and local law enforcement agencies to identify persons of interest’s U.S. domestic air travel ticketing information.” 404 Media obtained the documents through a Freedom of Information Act (FOIA) request.

A screenshot of the Statement of Work. Image: 404 Media.

The new documents obtained by 404 Media also show ARC asking CBP to “not publicly identify vendor, or its employees, individually or collectively, as the source of the Reports unless the Customer is compelled to do so by a valid court order or subpoena and gives ARC immediate notice of same.”

The Statement of Work says that TIP can show a person’s paid intent to travel and tickets purchased through travel agencies in the U.S. and its territories. The data from the Travel Intelligence Program (TIP) will provide “visibility on a subject’s or person of interest’s domestic air travel ticketing information as well as tickets acquired through travel agencies in the U.S. and its territories,” the documents say. They add this data will be “crucial” in both administrative and criminal cases.

A DHS Privacy Impact Assessment (PIA) available online says that TIP data is updated daily with the previous day’s ticket sales, and contains more than one billion records spanning 39 months of past and future travel. The document says TIP can be searched by name, credit card, or airline, but ARC contains data from ARC-accredited travel agencies, such as Expedia, and not flights booked directly with an airline. “[I]f the passenger buys a ticket directly from the airline, then the search done by ICE will not show up in an ARC report,” that PIA says. The PIA notes the data impacts both U.S. and non-U.S. persons, meaning it does include information on U.S. citizens.

“While obtaining domestic airline data—like many other transaction and purchase records—generally doesn't require a warrant, there's still supposed to go through a legal process that ensures independent oversight and limits data collection to records that will support an investigation,” Jake Laperruque, deputy director of the Center for Democracy & Technology's Security and Surveillance Project, told 404 Media in an email. “As with many other types of sensitive and revealing data, the government seems intent on using data brokers to buy their way around important guardrails and limits.”

CBP’s contract with ARC started in June 2024 and may extend to 2029, according to the documents. The CBP contract 404 Media obtained documents for was an $11,025 transaction. Last Tuesday, a public procurement database added a $6,847.50 update to that contract, which said it was exercising “Option Year 1,” meaning it was extending the contract. The documents are redacted but briefly mention CBP’s OPR, or Office of Professional Responsibility, which in part investigates corruption by CBP employees.

“CBP is committed to protecting individuals’ privacy during the execution of its mission to protect the American people, safeguard our borders, and enhance the nation’s economic prosperity. CBP follows a robust privacy policy as we protect the homeland through the air, land and maritime environments against illegal entry, illicit activity or other threats to national sovereignty and economic security,” a CBP spokesperson said in a statement. CBP added that the data is only used when an OPR investigation is open and the agency needs to locate someone related to that investigation. The agency said the data can act as a good starting point to identify a relevant flight record before then getting more information through legal processes.

On May 1, ICE published details about its own ARC data purchase. In response, on May 2, 404 Media filed FOIA requests with ICE and a range of other agencies that 404 Media found had bought ARC’s services, including CBP, the Secret Service, SEC, DEA, the Air Force, U.S. Marshals Service, TSA, and ATF. 404 Media found these by searching U.S. procurement databases. Around a week later, The Lever covered the ICE contract.

A screenshot of the Statement of Work. Image: 404 Media.

Airlines contacted by 404 Media declined to comment, didn’t respond, or deferred to either ARC or DHS instead. ARC declined to comment. The company previously told The Lever that TIP “was established after the Sept. 11 terrorist attacks to provide certain data to law enforcement… for the purpose of national security matters” and criminal investigations.

“ARC has refused to answer oversight questions from Congress, so I have already contacted the major airlines that own ARC—like Delta, American Airlines and United—to find out why they gave the green light to sell their customers' data to the government,” Wyden’s statement added.

U.S. law enforcement agencies have repeatedly turned to private companies to buy data rather than obtain it through legal processes such as search warrants or subpoenas. That includes location data harvested from smartphones, utility data, and internet backbone data.

“Overall it strikes me as yet another alarming example of how the ‘Big Data Surveillance Complex’ is becoming the digital age version of the Military-Industrial Complex,” Laperruque says, referring to the purchase of airline data.

“It's clear the Data Broker Loophole is pushing the government back towards a pernicious ‘collect it all’ mentality, gobbling up as much sensitive data as it can about all Americans by default. A decade ago the public rejected that approach, and Congress passed surveillance reform legislation that banned domestic bulk collection. Clearly it's time for Congress to step in again, and stop the Data Broker Loophole from being used to circumvent that ban,” he added.

According to ARC’s website, the company only introduced multifactor authentication on May 15.

cross-posted from: https://lemmy.sdf.org/post/36376926

Archived

On June 4, during a meeting with government officials, Vladimir Putin stated that all public services must be moved to the national messenger app called Max. According to Minister of Digital Development Maksut Shadayev, the multiplatform system is already operational.

[...]

The Max app — a Russian equivalent of China’s WeChat — was unveiled by the tech giant VK in late March. At present, it features a messenger, a chatbot builder, a payment system, and mini-apps. On June 5, VTB’s digital bank launched on the platform.

To register, a Belarusian or Russian SIM card is required — which, as The Insider noted, foreigners can no longer obtain without submitting biometric data.

As stated in the Max app’s privacy policy, the platform will collect data on:

• user devices
• IP address
• operating system
• browser
• location
• internet provider
• contacts from the address book
• all user activity within the service
• information obtained through the camera or microphone, if the user grants the app access (most users will, for example, in order to record voice messages)

Other messaging apps collect such data as well, but there's a catch. The Max app's privacy policy explicitly states that it may share this data with the “company's partners” as well as with “any government or local authority.”

[...]