CIRCLE WITH A DOT

For my newsletter and blog, I wrote about how Apple's Lockdown Mode, once billed as an "extreme" security protection for iPhones, iPads, Macs and Watches, has passed a major real-world test by blocking the feds from accessing a journalist's phone.

Free to read; with additional words, advice, and guidance for paying subscribers: https://this.weekinsecurity.com/apple-lockdown-mode-once-an-extreme-security-protection-now-a-necessity-for-americans/

Sign up/RSS for the weekly newsletter: https://this.weekinsecurity.com

@hrbrmstr Discord has more on its blog, as well. https://discord.com/press-releases/discord-launches-teen-by-default-settings-globally

@hrbrmstr tl;dr: Discord is widly used by lots of people for lots of reasons (including threat actors, ofc), and has been open to signups. now Discord faces age-gating laws in certain regions, so it's decided to roll out age-checks across the board, globally, requiring that anyone who uses Discord uploads their passport or license scan to prove they're 18+ and can access all of Discord's features.

just one major problem with that: Discord already had a breach of IDs!

Discord says users' government IDs used for age checks stolen by hackers

Thanks to age verification laws, expect more data breaches of users' government-issued passports and driver's licenses.

~this week in security~ (this.weekinsecurity.com)

A Politico story out today describes how Oura wearable rings are winning over Washington, but makes no real mention of their privacy or security risks.

But... in my piece about Oura rings from last year, I explain how Oura puts user data at risk from goverment agencies (like ICE), and hackers.

• Oura data isn't end-to-end encrypted
• Sensitive health data can be accessed by Oura staff
• Oura said it has received government demands for user data.

Oura ring deal raises valid concerns about users' health data security

The government partnership sparked customer concerns about the security of data collected by Oura's wearable, even if the spark was a red herring.

~this week in security~ (this.weekinsecurity.com)