There are way too many data brokers and they have way too much of our data. We've talked a lot lately about what you can do to reclaim your privacy and claw back some of that data and today I'm going to give you yet another interesting tool for your privacy toolbox: Permission Slip. This app and the related service, brought to you by Consumer Reports, will work on your behalf to request that these data brokers relinquish your information, or at least suppress the sharing of that data to the extent that's legally possible. The tool has some helpful and interesting features that you may not find on other, similar services. Sukhi Gulati GIlbert is my guest today and will explain why you should consider using this tool and how it supports the overall effort to rein in dangerous business of data mining.
Interview Notes
Permission Slip app: https://permissionslipcr.com/
Protecting Your Privacy Online: https://www.consumerreports.org/electronics/privacy/from-our-president-protecting-your-privacy-online-a1603013649/
Digital Security & Privacy: https://www.consumerreports.org/digital-security-privacy/
CR Report on data deletion services (PDF): https://innovation.consumerreports.org/wp-content/uploads/2024/08/Data-Defense_-Evaluating-People-Search-Site-Removal-Services-.pdf
California data broker registry: https://cppa.ca.gov/data_broker_registry/
How to download the Vermont data broker list (which doesn’t seem to work): https://www.muckrock.com/foi/vermont-80/vermont-data-broker-db-107096/
My article series on data deletion: https://firewallsdontstopdragons.com/osint-reconnaissance/
Further Info
Annual listener survey!! https://fdsd.me/survey2025
Send me your questions! https://fdsd.me/qna
Check out my book, Firewalls Don’t Stop Dragons: https://fdsd.me/book
Subscribe to the newsletter: https://fdsd.me/newsletter
Become a patron! https://www.patreon.com/FirewallsDontStopDragons
Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch
Give the gift of privacy and security: https://fdsd.me/coupons
Support our mission! https://fdsd.me/support
Generate secure passphrases! https://d20key.com/#/
Table of Contents
Use these timestamps to jump to a particular section of the show.
0:00:12: Intro
0:00:51: Couple quick news notes
0:01:45: Last call: listener survey
0:02:47: Interview setup
0:03:48: What brought you to Consumer Reports and the Permission Slip app?
0:07:19: How does Permission Slip compare to other data deletion services?
0:14:17: Where are the data brokers getting so much of our personal info?
0:17:00: How do I use Permission Slip?
0:21:47: What info does Permission Slip give to brokers?
0:24:42: Is it more effective to request data deletion yourself versus using a service?
0:31:12: What level of success should I expect when deleting my data?
0:33:16: Are there any limitations or exclusions for data deletion?
0:38:19: What if you live in a state or country with no privacy laws?
0:39:44: Can we limit access to our public data records?
0:41:24: Does freezing your credit do anything to limit data sharing?
0:43:53: How broken is the 'notice and consent' model for privacy?
0:45:57: Would it help to actively spread incorrect personal info?
0:48:31: How else can we reduce our data footprint?
0:50:04: What's next for Consumer Reports in terms of privacy?
0:53:46: What does Permission Slip Pro cost?
0:55:19: Interview wrap-up
0:59:11: Patron content preview
0:59:50: Looking ahead
--------
1:00:50
New Year’s Resolutions 2025!
The start of a new year is always a good time to add some big juicy goals to your to-do list - call them New Year's Resolutions, if that works for you, but really it's just about making up your mind to tackle some important personal objectives. Today I'll give you several ideas to improve your privacy and security in 2025, and those around you.
In the news: dozens of malicious Chrome Browser extensions identified; net neutrality is dead, again, and probably for good this time; Apple to pay a meager $95M to settle a Siri privacy class action suit; Apple's new Enhanced Visual Search is enabled by default and sending data to Apple; proposed ban on TP-Link routers is missing the real problem; Google's change in its Privacy Sandbox policy seems to now allow the use of device fingerprinting; proposed HIPAA amendments will close major health data security gaps.
Article Links
[Ars Technica] Time to check if you ran any of these 33 malicious Chrome extensions https://arstechnica.com/security/2025/01/dozens-of-backdoored-chrome-extensions-discovered-on-2-6-million-devices/
Terms of service study: https://www.helpnetsecurity.com/2016/07/14/agree-terms-conditions-lie/
[nytimes.com] Net Neutrality Rules Struck Down by Appeals Court https://www.nytimes.com/2025/01/02/technology/net-neutrality-rules-fcc.html
[reuters.com] Apple to pay $95 million to settle Siri privacy lawsuit https://www.reuters.com/legal/apple-pay-95-million-settle-siri-privacy-lawsuit-2025-01-02/
[macrumors.com] Apple Says Siri Data Has Never Been Sold or Used for Marketing https://www.macrumors.com/2025/01/06/apple-siri-data-not-sold-for-marketing/
[9to5mac.com] Enhanced Visual Search shares your photos with Apple by default, to identify landmarks https://9to5mac.com/2024/12/30/enhanced-visual-search-shares-your-photos-with-apple-by-default-to-identify-landmarks/
[csoonline.com] No evidence that TP-Link routers are a Chinese security threat https://www.csoonline.com/article/3504775/no-evidence-that-tp-link-routers-are-a-chinese-security-threat.html
[Lukasz Olejnik blog] Biggest Privacy Erosion in 10 Years? On Google’s Policy Change Towards Fingerprinting https://blog.lukaszolejnik.com/biggest-privacy-erosion-in-10-years-on-googles-policy-change-towards-fingerprinting/
[Dark Reading] Proposed HIPAA Amendments Will Close Healthcare Security Gaps https://www.darkreading.com/cyber-risk/proposed-hipaa-amendments-close-healthcare-security-gaps
Tip of the Week: https://firewallsdontstopdragons.com/new-years-resolutions-2025/
Further Info
Annual listener survey!! https://fdsd.me/survey2025
Send me your questions! https://fdsd.me/qna
Check out my book, Firewalls Don’t Stop Dragons: https://fdsd.me/book
Subscribe to the newsletter: https://fdsd.me/newsletter
Become a patron! https://www.patreon.com/FirewallsDontStopDragons
Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch
Give the gift of privacy and security: https://fdsd.me/coupons
Support our mission! https://fdsd.me/support
Generate secure passphrases! https://d20key.com/#/
Table of Contents
Use these timestamps to jump to a particular section of the show.
0:00:07: Intro
0:01:24: News preview
0:02:59: Time to check if you ran any of these 33 malicious Chrome extensions
0:12:51: Net Neutrality Rules Struck Down by Appeals Court
0:16:49: Apple to pay $95 million to settle Siri privacy lawsuit
0:19:02: Apple Says Siri Data Has Never Been Sold or Used for Marketing
0:26:29: Enhanced Visual Search shares your photos with Apple by default
0:35:23: No evidence that TP-Link routers are a Chinese security threat
0:47:01: Biggest Privacy Erosion in 10 Years? On Google’s Policy Change Towards Fingerprinting
0:53:08: Proposed HIPAA Amendments Will Close Healthcare Security Gaps
0:57:16: Tip of the Week: New Years Resolutions for 2025!
1:04:53: Wrap-up
--------
1:05:57
ALPRs Are Everywhere
There are many ways in which we are tracked in the real world, but one of the most ubiquitous and insidious technologies is Automated License Plate Readers. These camera systems are deployed in just about every city by both public and private organizations. Furthermore, the third parties who sell and operate these systems collect and collate data from around the country, making it available to law enforcement and marketing firms. Because these systems capture images of your car, they can also document the make, model and color, any distinguishing marks, and even bumper stickers. Today we'll discuss how and where these systems are deployed, who has access to the data, the repercussions of this mass surveillance and how it can go horribly wrong with my guests Adam Schwartz and Gowri Nayar from the Electronic Frontier Foundation.
Interview Notes
Donate to the EFF: https://supporters.eff.org/donate/join-eff-today
The Human Toll of ALPR Errors: https://www.eff.org/deeplinks/2024/11/human-toll-alpr-errors
EFF’s Street Level Surveillance: https://sls.eff.org/
Community Control of Police Surveillance (CCOPS): https://www.eff.org/issues/community-control-police-surveillance-ccops
US 100-mile “border zone” facts: https://www.aclu.org/know-your-rights/border-zone
Flock camera map: https://www.404media.co/the-open-source-project-deflock-is-mapping-license-plate-surveillance-cameras-all-over-the-world/
DeFlock: https://deflock.me
Flock transparency page example: https://transparency.flocksafety.com/riverside-county-ca-sd
Further Info
Annual listener survey!! https://fdsd.me/survey2025
Send me your questions! https://fdsd.me/qna
Check out my book, Firewalls Don’t Stop Dragons: https://fdsd.me/book
Subscribe to the newsletter: https://fdsd.me/newsletter
Become a patron! https://www.patreon.com/FirewallsDontStopDragons
Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch
Give the gift of privacy and security: https://fdsd.me/coupons
Support our mission! https://fdsd.me/support
Generate secure passphrases! https://d20key.com/#/
Table of Contents
Use these timestamps to jump to a particular section of the show.
0:00:20: Intro
0:01:24: Listener survey and book giveaway
0:03:16: ShmooCon in DC this weekend
0:04:21: Interview setup
0:05:27: What prompted you to write about ALPRs?
0:08:11: How do ALPRs work and what info can they capture?
0:10:14: How long have ALPRs been around and how is EFF tracking their use?
0:11:34: Where are these systems deployed? How do we recognize them?
0:14:19: How does mobile ALPR data collection work?
0:15:58: Are police departments transparent about the use of ALPRs?
0:18:09: Is there a way know where ALPR systems are deployed?
0:20:46: How accurate are ALPRs? What are the consequences of failure?
0:22:37: Are license plate "hot lists" shared across jurisdictions?
0:25:41: Where is ALPR data stored? For how long? Who has access?
0:27:40: Is ALPR data shared among local and federal agencies? How often is the data abused?
0:31:04: Do the ALPR system operators sell this data to anyone else?
0:36:04: What legal expectation of privacy do I have in public spaces?
0:42:57: How does the legal "third party doctrine" apply to ALPR data?
0:45:01: How do we balance the need to catch bad guys with the use of surveillance tech?
0:50:18: Is there any surveillance tech that EFF feels should be banned outright?
0:52:17: Does EFF consult with law enforcement on deployment of surveillance tech?
0:53:05: If we're concerned about surveillance tech being deployed, what can we do?
0:58:19: Interview wrap-up
0:59:29: Notes on the "border zone" width in the US
1:01:09: Patron preview
1:02:01: Survey reminder
1:02:50: Looking ahead
--------
1:03:45
Best of Bonus 2024!
Every week, I record a special, private bonus podcast for my patrons. Until today, all of that content was restricted to my supporters. But today I’ve got a sampler platter of some of the best snippets from my bonus Q&A with my interview guests. You’ll hear from Micah Lee (author, journalist), Nick Weaver (cybersecurity researcher), Kate Black (health data specialist), Jason Edison (OSINT expert), Dani Cronce and Lizzie Moratti (TunnelVision hack), Bruce Schneier (cryptographer, author), and Carissa Véliz (author, professor).
Original Interview Links
Ep358: Micah Lee https://podcast.firewallsdontstopdragons.com/2024/01/08/investigating-data-leaks/
Ep360: Nick Weaver https://podcast.firewallsdontstopdragons.com/2024/01/22/rise-of-the-slaughterbots/
Ep368: Kate Black https://podcast.firewallsdontstopdragons.com/2024/03/18/health-data-privacy/
Ep386: Jason Edison https://podcast.firewallsdontstopdragons.com/2024/07/22/open-source-intelligence/
Ep388: Jack Daniel https://podcast.firewallsdontstopdragons.com/2024/08/05/catch-you-on-the-bside/
Ep396: Dani Cronce & Lizzie Moratti https://podcast.firewallsdontstopdragons.com/2024/09/30/tunnelvision-vpns-and-you/
Ep400: Bruce Schneier https://podcast.firewallsdontstopdragons.com/2024/10/28/episode-400-special/
Ep404: Carissa Véliz https://podcast.firewallsdontstopdragons.com/2024/11/25/privacy-is-power-2/
Related Links
Micah’s book: https://hacksandleaks.com/
Nick Weaver: https://www1.icsi.berkeley.edu/~nweaver/
Security BSides: https://bsides.org/w/page/12194156/FrontPage
Frankie’s Tiki Room (Las Vegas): https://frankiestikiroom.com/
Intel Techniques: https://inteltechniques.com/
TunnelVision: https://www.tunnelvisionbug.com/
Schneier Blog: https://www.schneier.com/
Privacy is Power: https://www.penguinrandomhouse.com/books/673341/privacy-is-power-by-carissa-veliz/
Further Info
Check out my book, Firewalls Don’t Stop Dragons: https://fdsd.me/book
Subscribe to the newsletter: https://fdsd.me/newsletter
Become a patron! https://www.patreon.com/FirewallsDontStopDragons
Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch
Give the gift of privacy and security: https://fdsd.me/coupons
Support our mission! https://fdsd.me/support
Table of Contents
Use these timestamps to jump to a particular section of the show.
0:00:24: New Years coming up
0:00:48: Show preview
0:02:33: Ep358: Micah Lee - the Snowden docs
0:11:48: Ep360: Nick Weaver - other types of killer drones
0:18:02: Ep368: Kate Black - how do you know if a site or app respects health privacy?
0:20:22: Ep386: Jason Edison - what's it like trying to protect the privacy of celebrities?
0:26:53: Ep388: Jack Daniel - the story of the Les Pukelele
0:33:39: Ep396: Dani Cronce & Lizzie Moratti - getting into hacking
0:42:08: Ep400: Bruce Schneier - can we ever make our devices secure out of the box?
0:48:01: Ep404: Cariss Veliz - should STEM students be required to take ethics classes?
0:53:05: Wrap-up
--------
54:02
Replay: Golden Age of Surveillance
I'm digging into the vault for a classic replay! I first interviewed Phil Zimmermann, creator of Pretty Good Privacy (PGP), on May 7, 2018. It was Episode 63 (we're now at 408) and it was entitled "We Now Live in the Golden Age of Surveillance". In this episode we talk a little about the origins of PGP in the 1990's and what he feels about the FBI's claims that we're "going dark" due to strong end-to-end encrypted communications. I've added some new commentary, but the original episode is preserved in all of its original glory!
Interview Notes
Original Ep63 interview: https://podcast.firewallsdontstopdragons.com/2018/05/07/we-now-live-in-the-golden-age-of-surveillance/
Ep214: Social Media is Ruining Society https://podcast.firewallsdontstopdragons.com/2021/04/05/social-media-is-ruining-society/
Ep243: Through the Past, Privately: PGP Turns 30 https://podcast.firewallsdontstopdragons.com/2021/10/25/through-the-past-privately-pgp-turns-30/
Phil Zimmermann’s website: https://philzimmermann.com/
Further Info
Send me your questions! https://fdsd.me/qna
Check out my book, Firewalls Don’t Stop Dragons: https://fdsd.me/book
Subscribe to the newsletter: https://fdsd.me/newsletter
Become a patron! https://www.patreon.com/FirewallsDontStopDragons
Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch
Give the gift of privacy and security: https://fdsd.me/coupons
Support our mission! https://fdsd.me/support
Generate secure passphrases! https://d20key.com/#/
Table of Contents
Use these timestamps to jump to a particular section of the show.
0:00:26: Flashback setup
0:02:18: Original intro
0:03:20: What drove you to create PGP?
0:06:32: Why were you prosecuted for PGP?
0:13:08: Isn't banning cryptography like trying to ban math?
0:15:13: What's the difference between security and privacy?
0:17:04: Is it possible to be truly anonymous online today?
0:19:06: How is the average person tracking online today?
0:21:49: What are the most private ways to communicate online?
0:24:44: How do we identify trustworthy attachments?
0:25:30: How secure is SMS (texting)?
0:29:41: Are we "going dark"?
0:32:44: Can we escape mass surveillance?
0:36:35: What's next for you?
0:38:09: Original interview wrap-up
0:40:38: Flashback wrap-up
0:41:00: ShmooCon 2025
0:41:56: Looking ahead
Denmark