Google Stops Collecting Location Data from Maps
Google Maps now stores location data locally on your device, meaning that Google no longer has that data to turn over to the police.
Continue reading Google Stops Collecting Location Data from Maps
Author Archives: Bruce Schneier
Friday Squid Blogging: Squid Parts into Fertilizer
It’s squid parts from college dissections, so it’s not a volume operation.
As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.
Read my blog posting guidelines here.
Continue reading Friday Squid Blogging: Squid Parts into Fertilizer
Ben Rothke’s Review of A Hacker’s Mind
Ben Rothke chose A Hacker’s Mind as “the best information security book of 2023.”
Continue reading Ben Rothke’s Review of A Hacker’s Mind
Data Exfiltration Using Indirect Prompt Injection
Interesting attack on a LLM:
In Writer, users can enter a ChatGPT-like session to edit or create their documents. In this chat session, the LLM can retrieve information from sources on the web to assist users in creation of their documents. We show that attackers can prepare websites that, when a user adds them as a source, manipulate the LLM into sending private information to the attacker or perform other malicious activities.
The data theft can include documents the user has uploaded, their chat history or potentially specific private information the chat model can convince the user to divulge at the attacker’s behest…
Continue reading Data Exfiltration Using Indirect Prompt Injection
Cyberattack on Ukraine’s Kyivstar Seems to Be Russian Hacktivists
The Solntsepek group has taken credit for the attack. They’re linked to the Russian military, so it’s unclear whether the attack was government directed or freelance.
This is one of the most significant cyberattacks since Russia invaded in … Continue reading Cyberattack on Ukraine’s Kyivstar Seems to Be Russian Hacktivists
GCHQ Christmas Codebreaking Challenge
Looks like fun.
Details here.
Continue reading GCHQ Christmas Codebreaking Challenge
OpenAI Is Not Training on Your Dropbox Documents—Today
There’s a rumor flying around the Internet that OpenAI is training foundation models on your Dropbox documents.
Here’s CNBC. Here’s Boing Boing. Some articles are more nuanced, but there’s still a lot of confusion.
It seems not to be true. Dropbox isn’t sharing all of your documents with OpenAI. But here’s the problem: we don’t trust OpenAI. We don’t trust tech corporations. And—to be fair—corporations in general. We have no reason to.
Simon Willison nails it in a tweet:
“OpenAI are training on every piece of data they see, even when they say they aren’t” is the new “Facebook are showing you ads based on overhearing everything you say through your phone’s microphone.”…
Continue reading OpenAI Is Not Training on Your Dropbox Documents—Today
Police Get Medical Records without a Warrant
More unconstrained surveillance:
Lawmakers noted the pharmacies’ policies for releasing medical records in a letter dated Tuesday to the Department of Health and Human Services (HHS) Secretary Xavier Becerra. The letter—signed by Sen. Ron Wyden (D-Ore.), Rep. Pramila Jayapal (D-Wash.), and Rep. Sara Jacobs (D-Calif.)—said their investigation pulled information from briefings with eight big prescription drug suppliers.
They include the seven largest pharmacy chains in the country: CVS Health, Walgreens Boots Alliance, Cigna, Optum Rx, Walmart Stores, Inc., The Kroger Company, and Rite Aid Corporation. The lawmakers also spoke with Amazon Pharmacy…
Continue reading Police Get Medical Records without a Warrant
Friday Squid Blogging: Underwater Sculptures Use Squid Ink for Coloring
The Molinière Underwater Sculpture Park has pieces that are colored in part with squid ink.
As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.
Read my blog posting guidelines here.
Continue reading Friday Squid Blogging: Underwater Sculptures Use Squid Ink for Coloring
A Robot the Size of the World
In 2016, I wrote about an Internet that affected the world in a direct, physical manner. It was connected to your smartphone. It had sensors like cameras and thermostats. It had actuators: Drones, autonomous cars. And it had smarts in the middle, using sensor data to figure out what to do and then actually do it. This was the Internet of Things (IoT).
The classical definition of a robot is something that senses, thinks, and acts—that’s today’s Internet. We’ve been building a world-sized robot without even realizing it.
In 2023, we upgraded the “thinking” part with large-language models (LLMs) like GPT. ChatGPT both surprised and amazed the world with its ability to understand human language and generate credible, on-topic, humanlike responses. But what these are really good at is interacting with systems formerly designed for humans. Their accuracy will get better, and they will be used to replace actual humans…