Last year I took a first look at a phishing campaign that was interestingly targeting YouTube channel owners’ email addresses. The aim of the campaign was to guide people to fake YouTube sign in page and phish their login credentials. Note, this did not target YouTube accounts in general, but actual channels. These were my main findings:
- Despite being hilariously obvious, first four of these were not caught by ProtonMail’s spam filter
- Out of several YouTube channels I manage, only one has been targeted
- Same email was CC’d to others
- Unclear where they have found my email address
- Senders’ email service providers started as Russian. Little to no typosquatting involved.
- After few iterations, phishing content seems to have reached its final form (for now)
The campaign came in a burst, stopping as suddenly as it had started. Now after a couple of months it has started again, and it’s time to re-examine what has changed.
Continue reading “YouTube Channel Phishing, Part 2: The Enemy Evolves”
Continuing my seemingly never-ending quest of digging through privacy policies, this time I analyzed how the most popular wearables companies handle their customers’ data. Fitbit, Biostrap, Motiv, Oura and Whoop all are on the cutting edge of health technology, but are their privacy practices on par with that or not?
A fellow biohacker Alex Fergus provided me with the opportunity to publish my little research article on his website. Over the years he has published tons of information on fitness, sleep and – of course – health gadgets. Few days ago he published the most comprehensive red light panel comparison I’ve ever seen, analyzing everything from EMF levels to irradiance and LED flicker. Let’s just say he knows his stuff, so I’m excited to try to match his professionalism on that space with mine about privacy.
I believe it’s time for the biohacker community to start valuing their data more. In my guest blog post you’ll learn:
- What data do these wearables collect?
- Are they selling or exchanging data with third parties?
- Data retention – how long are they storing your data?
- What can you do?
- And more…
So head over to alexfergus.com and learn everything you need to know about wearables and privacy!
During past few months I’ve witnessed and been targeted by rather simple, but still interesting phishing campaign. Well, not me personally, but instead a YouTube channel that I run. This campaign has noticeably sped up in November, so I decided to take a closer look at these phishing emails and share with you my findings.
Continue reading ““YouTube channel will be disabled within 24 hours!” Phishing Campaign First Look”
(I got access to thinkspot beta and this was my first post on that platform. I decided to crosspost it here to increase awareness of thinkspot, and also because the issues I raise here are relevant on other social media platforms as well.)
Hi, I’m Joel, and I eat Privacy Policies for breakfast.
Continue reading “Freedom of Speech in the Age of Privacy Policies”
(Tämä on suomennos Bruce Schneierin vuonna 2006 julkaisemasta artikkelista “The Eternal Value of Privacy”. Käännetty ja julkaistu hänen luvallaan.)
Yleisin vasta-argumentti, mitä yksityisyyden puolestapuhujat kuulevat – ja tämä argumentti tulee yleensä niiltä, jotka kannattavat henkilötietojen tarkastuksia, valvontakameroita, tietokantoja, tiedon louhintaa ja muita valvontamenetelmiä – on tämä: “Jos et tee mitään väärää, niin eihän sinulla ole mitään salattavaa?”
Tässä on joitakin käteviä vastauksia: “Jos en tee mitään väärää, niin sitten sinulla ei ole syytä tarkkailla minua.” “Koska valtiovalta päättää mikä on väärää, ja he voivat vaihtaa väärän määritelmää.” “Koska sinä voit tehdä jotain väärää minun informaatiollani.” Ongelma näissä vastauksissa – vaikka ne toisaalta oikeita ovatkin – on se, että ne hyväksyvät yksityisyyden olevan lähtökohtaisesti jonkin väärän piilottelua. Se ei kuitenkaan pidä paikkaansa. Yksityisyys on ihmisoikeus, ja edellytys arvokkaan ja kunnioitettavan ihmisarvon ylläpitämiselle.
Continue reading “Yksityisyyden ikuinen arvo”
First things first: Instagram is owned by Facebook. As such, no matter your settings or how you operate the app, you can never obtain real privacy on the platform. There exists a decentralized, ad-free alternative called Pixelfed that seems to have been getting some praise, but without personal experiences I can’t say much about it. Still worth the look if you’re thinking about migrating from Instagram.
Alright, now on to the guide. Here are the concrete steps you should take in order to increase your privacy and security on Instagram.
Continue reading “Instagram Hardening – Private Profile is NOT Enough!”
When it comes to privacy and social media platforms, LinkedIn is the necessary evil we have to put up with. While it’s a no-brainer to delete your Facebook account and the likes of Snapchat attention-span-of-a-goldfish platforms are easy to skip, but so much of job recruitment revolves around LinkedIn that it’s a lot harder to severe ties with it. Many companies don’t even post their offerings anywhere else than on LinkedIn, and prefer applications that come directly through the platform. It’s also a great tool for headhunters to find suitable candidates.
So let’s assume you have a LinkedIn profile, you want to build up your online resume and personal brand, and want to be able to jump on a once-in-a-lifetime opportunity if it presents itself. However, you can accomplish all that without revealing every aspect of your professional self for the whole world to see. Let’s start of with LinkedIn settings and then move on to platform behavior and other tips.
Continue reading “How to Setup LinkedIn for Better Privacy and OPSEC”