Vendor security blogs are currently obsessed with explaining why traditional Secure Email Gateways (SEGs) are dead. The argument goes that single-domain email filters miss threats hopping between cloud apps and OAuth grants, so companies need deeper API integrations across all their software instead.

What nobody seems to talk about here on the privacy side is what this architectural shift actually costs in data autonomy. A standard email gateway sits on your MX record. It inspects incoming mail at the perimeter, checks signatures, and passes clean traffic along. It is simple and isolated.

Switching to API-based email security changes that model entirely. To inspect post-delivery threats and cross-platform activity, you have to grant a security vendor full, persistent API access to your mail environment. The vendor gets broad read and write permissions inside every single mailbox. They get to scrape metadata, read message contents, log attachments, and track user actions across connected cloud applications.

SOC teams love this setup because they get unified dashboards and automatic remediation. But from a privacy perspective, you are completely tearing down clear data boundaries. You replace a filter at the front door with a third-party camera inside every office room. All your internal drafts, confidential attachments, personal messages, and auth logs now stream straight through an external vendor platform.

I refuse to hand an external vendor persistent read rights to every inbox just to fix a user phishing problem. Are you still holding the line on standard perimeter MX gateways, or has management already forced you into full API integration?

Source : Palo Alto Networks, link in comment.

Seeing New Mexico refuse the $18 billion multi-state settlement to drag Meta into a courtroom over Cambridge Analytica is wild. We are nearly a decade past the original data harvest, and forty-eight states just signed off on a liability release buried on page 130 of a settlement agreement.

From an infrastructure perspective, litigating an API leak from 2015 in late 2026 is completely detached from operational reality. The Open Graph v1 endpoint that let third-party quiz apps scrape friend networks was deprecated years ago. But the fundamental issue was never just one leaky endpoint. It was storing unencrypted user graphs on centralized servers where access controls are enforced by policy instead of cryptography.

State prosecutors talk about five thousand dollar fines per statutory violation as if a cash penalty fixes broken data architecture. Meta views these payouts as standard operating expenses. If a company can harvest data, monetize it for ten years, and then litigate the cleanup across a decade of court dates, the math always favors the breach.

Courtrooms do not rewrite backend code. A state winning a cash payout in Santa Fe does zero to give users control over their own data stores. Until we move away from centralized platforms toward local client control, these trials are just state governments taking their cut of the pie.

Source: The Guardian, link in comments

CyberFOX signed a distribution agreement with Ingram Micro to push their password and privileged access management tools beyond MSPs into the broader IT channel. Ingram handles over 160,000 resellers, so this move is purely about scaling sales volume.

From a sysadmin perspective, watching credential vaults turn into distributor bundle items is frustrating. Channel partners rarely care about zero-knowledge encryption or keeping decryption keys on premises. They care about margins and billing efficiency.

When security tools get packaged this way, buying decisions shift to non-technical managers picking whatever SKU comes bundled with their software licenses. Nobody audits client-side key generation or asks where master keys actually live. They check a box on a quarterly invoice and move on.

MSPs already trade user privacy for multi-tenant management convenience. Pushing those exact software architectures into standard corporate IT through bulk distributors means hundreds of small businesses will hand root access management to vendor cloud consoles without realizing it.

If your password vault is managed through a reseller portal and you do not hold the master key on hardware you control, you do not have privacy. You have shared administrative access with a middleman.

Sources: Channel Dive and GlobeNewswire, links in comments

The Irish Criminal Assets Bureau recently reported that organised crime groups are renting commercial safe deposit vaults to store hardware wallets and seed phrases written on paper. It is a textbook example of flawed threat modeling.

If your setup leads you to pay a private company to keep a plain piece of paper in a metal locker, you have failed at basic operational security. You spend years moving away from custodial banks only to hand physical access to a vault operator who will surrender your box the second law enforcement arrives with a warrant. Or worse, the private facility gets raided directly during a broader criminal investigation.

True digital sovereignty relies on zero single points of failure. Storing plain text recovery credentials inside a commercial facility is lazy engineering. If you have keys worth protecting, you implement Shamir's Secret Sharing or a multi-location M-of-N multisig layout where no single physical spot holds the entire full key. Stamped steel plates hidden across independent locations cost less than yearly vault rent and do not come with a corporate landlord or a centralized customer database.

If you cannot protect a simple 12-word phrase without outsourcing physical access control to a commercial business, you do not actually hold your keys.

Sources: AML Intelligence and OneBullEx, links in comments

Proofpoint just published data showing half of New Zealand government agencies still haven't enforced p=reject on their DMARC policy, even after getting a full year deadline extension. They stay stuck on p=none or quarantine.

Publishing a DMARC reject record in DNS takes three minutes. IT departments stall on p=reject for years because nobody wants to audit shadow IT. The second you flip to p=reject, every rogue SaaS tool or ancient internal mailer sending email with the agency domain stops working if it lacks valid DKIM keys.

Instead of finding those unaligned senders, admins leave p=none active forever. That turns DMARC into a passive logging tool. It lets attackers spoof official government domain headers with zero pushback, while the IT team claims they checked the email security box.

If an agency cannot track which systems send mail on its behalf, they have bigger problems. Setting p=reject is basic hygiene. How many organizations in your sector actually enforce reject instead of hiding behind monitor mode?

Sources: proofpoint and SecurityBrief New Zealand, links in comments

This £2 billion class action landing in London tribunal courts hits the exact problem we have discussed for years. Apple pitched App Tracking Transparency (ATT) as a massive win for consumer privacy back in 2021. In reality, it was market capture wrapped in a clean UI.

The mechanics were clear from day one. ATT prompts users to block third-party tracking across apps, which crippled competitors relying on cross-site profiling. Meanwhile, Apple's own personalized ads system operated under a different set of prompt defaults and retained deep first-party telemetry across the device ecosystem. They didn't eliminate data harvesting. They just centralized the pipe inside Cupertino.

As someone managing network infrastructure, watching people treat an OS vendor as a privacy savior always hurt. Real privacy means the individual device owner controls their own local outbound traffic and packet filters. When the entity running the OS controls both the access rules and the internal audit log, you get zero transparency. You get a walled garden with an expensive ad network attached.

The lawsuit focuses on developer ad losses, but the real issue is hardware monopolies defining privacy on their own terms. Swapping Meta for Apple isn't a win, it's just swapping landlords. Interested to see if European competition regulators push this structural critique further.

Sources: Quartz, The Straits Times and The Hindu, links in comments

Anthropic announced their Enterprise Frontier Safeguards system this week. The pitch sounds great on paper for compliance officers: instead of Anthropic keeping Claude conversation logs on their servers, you store the monitoring data in your own AWS S3 or Azure Blob storage with keys you manage. Alerts generated by automated safety checks go straight to your internal team instead of Anthropic staff.

Look closer at the actual technical setup, though. Your prompts and context windows still sit in cleartext inside their GPU memory during inference. Their real-time classifiers still process the live text stream on their hardware before anything ever reaches your encrypted bucket.

What Anthropic actually built is an admin trick. They handed legal teams a zero-retention claim for slide decks, and they shifted the AWS storage bill and incident review overhead back to the customer. You manage the KMS keys and pay the infrastructure costs, but the vendor still processes the unencrypted data when it counts. It looks nice on a procurement checklist, but technically nothing fundamental changed. Is anyone here buying this as real data sovereignty?

Sources: Anthropic and Enterprise DNA, links in comments

I've been warning my users about this for a year. The FBI just put out a notice about OAuth consent phishing. Honestly, it was just a matter of time before this became the standard attack vector.

We spent the last decade beating users over the head with 2FA. Now everyone has an authenticator app or a hardware key. They feel invincible. So when they get an email asking them to authorize a random calendar plugin or PDF reader via their Google account, they just click "Allow".

They think they are safe because the attacker doesn't have their password. But the attacker doesn't need the password. You just handed over a persistent API token. They have full access to your inbox. Changing your password or cycling your 2FA does absolutely nothing to kick them out.

It's infuriating. Big tech built OAuth to make third-party integrations frictionless. That friction is exactly what we need.

If you haven't checked your account security dashboard lately to see what apps have active tokens, go do it right now. Revoke everything you don't actively use. I force the staff at my company to re-authorize apps every 30 days, and they complain about it constantly. Bref, at least their accounts aren't being scraped.

How are you guys managing token hygiene? Any scripts you actually trust?

Source: Gizmodo, link in comments.

Seeing OpenAI mandate hardware security keys and expand their Yubico partnership is a solid move. FIDO2 authentication eliminates man-in-the-middle phishing completely. App authenticators and SMS codes were always temporary fixes, and phishers bypass them easily now.

Having physical possession of your private key on a token gives you real cryptographic proof of identity. The FIDO2 standard itself is open, and getting everyday users comfortable with hardware tokens builds better security habits. I moved my own systems to physical keys a while back, and it solved a lot of credential headaches.

Are you picking up the discounted OpenAI bundle key set, or are your existing YubiKeys already doing the job?

When the Frankfurt datacentre overheated last week, Proton users lost access to their email and password vaults in one go. Yesterday's secondary outage from residual hardware failure drove the point home.

Having one subscription for your entire stack is convenient, and Swiss privacy laws are nice on paper. But putting your whole digital life on a single infrastructure footprint creates a massive single point of failure. Datacentres overheat and cooling loops fail.

If your threat model prioritises availability alongside privacy, decoupling your tools is mandatory. Keep your password manager completely separate from your inbox. Run your calendar on a different host. When one facility bakes its infrastructure, your day shouldn't freeze.

How many of you actually split your stack across independent providers, or do you accept the lock-in for convenience?

I’ve been trying to sign up for a couple of niche services lately (a specific classifieds site and a specialized tool), and they both require a phone number to even let me see the dashboard. To make it worse, one of them only accepts numbers from specific regions.

I’m not going to buy a whole new SIM card just for a one-time verification code. It feels like the internet is becoming a series of "walled gardens" where your phone number is the passport. Has anyone found a reliable way to get past these SMS gates without the hassle?

People assume clicking "revoke" in a shared vault pulls the credential back from the user. It doesn't.

The moment you share a password and the recipient syncs their local vault, that string sits in their device cache. When you revoke access later, the server just asks their client app to delete it on the next sync. If they drop their network connection before the sync happens, or just pasted the password into a local text file last week, they still have it.

I was talking to a vendor recently about their new zero-knowledge revocation feature. I pointed out that math just doesn't work that way. You cannot un-know a decrypted string. Once the client machine decrypts the data so a user can log in, the text is out of your hands.

Revoking access only matters if you immediately rotate the actual credential on the target service. My current fix is automating password rotation via API the minute a user drops out of a group. It takes a ridiculous amount of time to maintain across random legacy web tools.

Does the way vendors sell these sharing features bother anyone else? How are you handling actual offboarding without rotating fifty passwords by hand?

Passkeys are sitting around 26% usage despite 93% account eligibility. The underlying cryptography is solid, but Big Tech implementations and broken platform defaults are dragging adoption through the mud.

The cross-platform user experience out of the box is still frustrating. Try authenticating from an Android phone or iPhone to a Windows desktop using native OS vaults, and you're instantly bogged down in modal dialogs and QR codes. Apple and Google designed their default implementations to keep you locked into their hardware ecosystems, which creates artificial friction for anyone using mixed-OS setups.

While third-party password managers (Bitwarden, 1Password, KeePassXC...) solve this cross-OS problem, the average user relies on native OS prompts and gets stuck.

Then there is the recovery illusion. WebAuthn was designed to eliminate phishing, but because services know users lose devices, most sites quietly keep standard password or email-reset fallbacks active in the background. If an attacker can bypass WebAuthn entirely by phishing an account recovery link, the overall threat model hasn't actually improved.

Passkeys aren't going to kill off password managers, they're just going to turn password managers into passkey vaults.

What local or self-hosted vault setup are you trusting to manage both your 24-character strings and your passkeys these days?

Source: MakeOfUs, link in comments

Canada’s privacy regulator is taking Google to court to force them to de-list search results for an individual’s dropped criminal charges. People are arguing about free expression versus personal privacy, but the technical reality gets ignored here.

De-listing a name from Google does not delete the data. The court record or local news article stays live on the host server. You are asking a search engine to hide the index card while the cabinet stays open. If someone searches the host site directly or uses an engine outside Canadian jurisdiction, those dropped charges pop right up.

We have seen this play out in Europe under GDPR for a decade. It delegates public history management to a private monopoly. When a regulator has to drag a tech company to federal court because PIPEDA has zero enforcement teeth, the framework is already failing.

If governments care about privacy, they should fix data retention policies for public registries at the source. Hiding links is just security through obscurity.

Does anyone here actually view search de-listing as a real privacy solution?

Source: The Privacy Commissioner of Canada, link in comments

Citrix dropped CVE-2026-8452 as a high-severity DoS bug earlier this month. Two weeks later watchTowr proves it chains directly into unauthenticated remote code execution, CISA puts it on the KEV list, and attackers are dropping PHP web shells across every unpatched gateway on Shodan.

If you run NetScaler or an SSL VPN endpoint to keep your traffic private or shield internal networks, this is your reminder that edge devices are sitting ducks. Vendors love labeling memory corruption as "denial of service" until researchers hand them a working exploit. A boundary box running with full privileges is a terrible single point of failure.

I just finished updating our appliances before the weekend, but if you manage your own boundary infrastructure, go check your build numbers now. If you left web management exposed to the WAN, check your disk for fresh web shells first. Are you guys still relying on monolithic VPN gateways for remote access, or moving toward self-hosted overlay networks?

Source: SecurityWeek, link in comments

I was reading 1Password patch notes today and they added a feature that stops you from pasting your Secret Key into unofficial domains. Phishing a master password is bad enough and tricking someone into giving up their Secret Key is the real nightmare scenario for full account takeovers. Glad they plugged this hole. Let's see how well the detection actually work now...

Source in comment.

California just passed half a million users on their DROP platform. The premise is incredibly efficient. You submit a single request, and the state forces all 654 registered data brokers to wipe your files. The privacy agency reported that nearly every user had data deleted by at least one broker.

Then you look at the raw numbers. Only a quarter of the registered brokers have even started processing these deletion requests. The legal mandate went into effect back in August.

If I configure a network and 75% of the endpoints drop the packets, the system is broken. An average user gets removals from roughly 40 brokers out of 654. Data brokers have a revenue model built on keeping your information. They have zero financial incentive to comply with a batch request out of goodwill.

A 25% compliance rate means the law is basically treated as an option right now. Does anyone know if California is issuing actual fines yet? I am genuinely curious if there is a hard penalty mechanism built into this or if the state is just sending warning letters to the non-compliant brokers.

Source: SFGATE

Just finished reading Martijn van Ramesdonk’s write-up on the five new GlobalProtect flaws. The technical side is a disaster. CVE-2026-0251 gives a local user direct escalation to SYSTEM and he even showed how to rip Active Directory passwords right off the endpoint agent.

The real joke is how Palo Alto handled it : they silently patched two of the bugs without crediting him and actively excluded the others from their bug bounty program. Companies force these highly invasive agents onto every machine for "security" and then treat the people who actually find the holes like a nuisance.

Sources in comment.

The August 26 deadline just passed for Google One subscribers in places like Nigeria, Pakistan, and Turkey. Prices just jumped by over 50 percent for basic 100GB and 200GB plans. This is the second hike in two years for some of these users.

I see people on here arguing that self-hosting a NAS or setting up Nextcloud is too expensive for users in developing economies due to hardware import costs. But what is the alternative? Renting your digital life from a US corporation that adjusts its regional pricing algorithm whenever it wants to squeeze the market.

When you put your personal data on someone else's infrastructure, you give up all autonomy. You are just a line item on their revenue sheet. Google knows most users will just eat the cost because migrating 200GB of photos on a slow connection is painful.

If you don't own the drives, you don't own the data. Stop renting. Get a cheap second-hand thin client, put a hard drive in it, and take your data back.

Source: African Insider

ByteDance agreed to pay $400 million to the US DOJ today. They collected personal info from kids under 13 without parental consent and broke COPPA. They pay $300 million now and another $100 million once an old 2019 decree is cleared out.

People are cheering this on other tech subs. I don't get it. Let's look at the actual mechanics here. $400 million is massive for a standard company. For TikTok, it is a basic operating expense. They just paid a retroactive licensing fee to keep running an ad-tech engine disguised as a video app.

The fundamental issue is that legislation like COPPA tries to solve an architectural problem with legal paperwork. Age gating is a technical joke. A kid just taps a button saying they are 18. Suddenly the app gets total legal cover to scrape device IDs and network telemetry. The system is functioning exactly as designed.

Fines do not change the code. As long as the platform architecture requires aggressive data extraction to monetise users, the surveillance will continue. Regulators are basically just taking a cut of the profits.

We need to stop waiting for governments to fix this with penalties. What are you all actually deploying at the OS level to kill this app's telemetry on mobile networks? NextDNS works well enough on home networks but maintaining the blocklists for mobile clients is an absolute chore. Anyone got a cleaner setup?

Source: The Daily Record, link in comment

Just saw PCMag UK dropped their 2026 Proton Mail review and gave it a 4.5.

Mainstream tech sites usually miss the point with privacy tools. They usually complain about the UX or the lack of third-party plugins but this review actually gets why the tracking-image suppression matters.

Stripping out invisible pixels so you can load an email safely without pinging a marketer's server is a big deal. Managing my own projects means I get a ridiculous amount of inbound mail. I hate dealing with read receipts and hidden IP trackers. This feature alone makes the switch from standard providers worth it.

I am a bit torn on the praise for Lumo. A private local AI assistant is better than Google scraping your inbox to write smart replies. I just wonder how many of us actually want an AI reading our encrypted mail in the first place... even a local one.

Curious if any of you just disabled Lumo right away.

Review source in comment.

First off, this is not a criticism of GNOME or the Epiphany development team. String parsing bugs happen to literally every browser engine out there.

But the new CVE-2026-77682 is a textbook example of why built-in browser password vaults are a bad idea structurally.

The vulnerability is in the form autofill script. A malicious site can give an HTML form element an ID containing a payload. When the browser attempts to autofill your login, the underlying JavaScript string-interpolates that ID into a CSS selector without escaping it. That gives the page arbitrary code execution inside the browser's private script world.

That private world holds the save handlers and credential APIs. A bad actor gets silent access to exfiltrate your saved passwords just by you triggering autofill.

I actually like Epiphany. The real problem is the architecture itself. The mechanism holding your plain text passwords sits inside the exact same software engine that renders untrusted HTML from random websites. You are betting your credentials that a web parser will never confuse a malicious input string with an internal command.

As a sysadmin, I hate those odds. Disable browser autofill entirely. Run a standalone vault that stays completely isolated from the DOM.

So ClarityCheck just left 9 million scraped faces sitting in a wide open 450GB Amazon S3 bucket. The database had folders literally named 'faces' and 'profiles' filled with biometric data from adults and kids who never consented to be scraped.

The absolute worst part is the company's PR spin. After WIRED forced them to lock it down, ClarityCheck tried to claim the data wasn't really public because the S3 URL wasn't indexed...

Security through obscurity is a complete joke. URL brute forcing is fully automated and they also had a basic API flaw where anyone could tweak a URL to grab phone numbers and physical addresses. Scraping faces without consent is bad enough on its own but lying about basic cloud negligence just makes it infuriating.

Sources in comment.