No, ActivityPub votes aren't anonymous


Logo for ActivityPub.

Several years ago, I posted this poll on Twitter. Terence Eden is on Mastodon@edentIf the recent Twitter hack had exposed they way you voted on every Twitter poll, how would you feel?(There is no suggestion that this has happened, I'm just curious about people's relationships to voting and privacy.)Meh. So what?: (167)167Hmph. That's annoying.: (68)68Umm… This could be bad!: (32)32Delete account & run away: (8)8❤️ 0💬 8🔁 005:55 - Thu 23 July 2020 Most of the tech world that I interact with has …

Continue reading →

Book Review: Understanding Privacy - Heather Burns


Book cover for Understanding Privacy.

Heather Burns has an absolutely deft way of turning the sometimes-dull world of digital privacy into entertaining, informative, and actionable prose. Too many of these sorts of books end up being a list of woes and end with "someone should do something, I guess?". Understanding Privacy is different. All the way through the mantra is "You are someone! You do something! And here's how..." Digital privacy is, I think it is fair to say, not a universally loved topic. Too often it is seen as…

Continue reading →

What the UK Government gets wrong about QR codes


A leaflet for Childcare with a prominent QR code.

One of my most memorable experiences in the Civil Service was discussing link shortening services with a very friendly person from the Foreign and Commonwealth Office. I was trying to explain why link shortners like bit.ly and ow.ly weren't sensible for Government use. They didn't seem to particularly care about the privacy implications or the risk of phishing. I needed to take a different tack. "So, you know how .uk is the UK and .de is Germany, right?" "Yes." "What country do you think .ly …

Continue reading →

Can you trust ProtonApps.com?


Screenshot of the ProtonApps page.

I've recently signed up to the privacy-preserving service Proton. All the email, calendar, drive, VPN, and other services seem to hang off the proton.me domain. I wanted to download the Android apps to my phone - without using the Google Play Store. The VPN app is on F-Droid but none of the others are. So, because I'm lazy, I Googled "Download Proton Mail". I landed on https://protonapps.com/. It looks like a genuine site. But is it? .me is signed by Let's Encrypt, whereas .com is…

Continue reading →

O2 UK's Weird MSISDN Lookup API


Sorry, we don’t recognise this number. Please try again.

It's always fun keeping your network inspector tab open. While looking around the O2 UK website, I found this page all about eSIMs. For some reason, it wants to know the user's phone number. I put in a random number, and it refused to let me in. Putting in a genuine O2 number let me through. So what is it doing to validate numbers? It is making an API call to this URl: https://www.o2.co.uk/o/customer/mods/lookup/447700900123 After a bit of testing, this is how I think it works. If you …

Continue reading →

Safelinks are a fragile foundation for publishing


Screenshot showing a document. The cursor hovers over a link. The pop up shows a safelinks URl.

Microsoft loves you and wants to protect you. So every time you receive an email with a link in it, Microsoft Outlook helpfully rewrites it so that it goes through their "safelinks" system. Safelinks allow your administrator, or someone at Microsoft, to stop you visiting a link which is malicious or suspicious. Rather than going to example.com, your link now goes to safelinks.protection.outlook.com/?url=example.com. Hurrah! If you accidentally click on a naughty link you won't cause chaos…

Continue reading →

Envelopes and GDPR


A letter addressed to me. Just inside the plastic window you can see the word "colonoscopies".

Privacy is a funny concept, isn't it? Very few people want the whole world to know what medical complaints they have. But most hospitals are open-access buildings, where the waiting rooms have large monitors to tell patients that their doctor is running late. A few years ago I was sat in the proctology waiting room. Anyone who knew me would have seen I was waiting for an bum doctor. They may not have known my specific complaint, but the laser-display board announced that my appointment was…

Continue reading →

I don't think you need to be civil to puppy-smashers


AI generated image of a small industrial machine crushing a cute puppy.

My good friend Jess wrote this a little while ago: Jessica Rose@jesslynnroseThe function of a system is its output.If you have dog grooming machine that sometimes smashes puppies and you keep running it, you're in the dog smashing business.If you work for a mass surveillance company that keeps enabling genocide and undermining democracy...❤️ 2,711💬 26♻️ 013:19 - Thu 07 January 2021 The whole thread is worth reading. One thing she doesn't cover is how you should respond when someone proposes to…

Continue reading →

Let's track footballers' heart rates!!


Photo of a football match. The striker's BPM is a high 150, the goalie a more leisurely 75. Original photo from https://www.flickr.com/photos/wonker/8603265115/

I don't follow football - or any sports - which made me an unusual choice for this particular pitch. Let's wind back the clock a decade... A relatively unknown hardware company has just released one of the first "fitness trackers" which can measure a wearer's physiology. As well as counting steps, it now has the ability to measure heart-rate and a bunch of other things. They think that athletes and exercisers will be interested in knowing these vital statistics. But they're wondering if…

Continue reading →

Fediverse Account Portability And Blocking


Cartoon of a tusked mastodon holding a phone.

One of the many great things about the Fediverse (Mastodon, PixelFed, Lemmy, etc) is that your account is portable. Let's say you're [email protected] and, one day, you decide to move your account to [email protected]. Well, with a few clicks of a button, all of your old followers are now following your brand new account. You're still following all your old friends. The accounts you wanted to block and mute are still silenced. Perfect! Except... What happens to the people who blocked …

Continue reading →

The IAB loves tracking users. But it hates users tracking them.


Logo of the IAB tech lab.

The Interactive Advertising Bureau (IAB) is a standards development group for the advertising industry. Their members love tracking users. They want to know where you are, who you're with, what you're buying, and what you think. All so they can convince you to spend slightly more on toothpaste. Or change your political opinions. Either way, they are your adversaries. The IAB's tech lab is working on a system called UID2. It's a more advanced way to track you no matter what you do and no…

Continue reading →

ProctorU is dystopian spyware


To take this exam online you will need to borrow a friend or family member's laptop.

As part of my MSc, I have to take an online exam. Obviously, this means I am highly likely to cheat by looking up things on Wikipedia or by having a bit of paper with notes on it. EVIL! So, the exam body requires me to install ProctorU. It's a service which lets someone watch you through your laptop camera while you do the exam. Creepy, but I get it. They also want to see your screen to make sure you're not alt-tabbing. A bit grim, but I get it. They also want complete control over your…

Continue reading →