IRS Says It Will Move Away From Requiring ID.me Facial Recognition

from the good-move dept

Last month, we wrote about how the IRS and other federal agencies were starting to require the use of private facial recognition from a somewhat sketchy private company, for people to access their own government's services. The main company in question, ID.me, had made some... questionable decisions that raised serious questions about why the government was forcing people to make use of such a private service.

Earlier this morning, Senator Ron Wyden sent a letter to the Treasury Department calling on them to drop the facial recognition requirement, and within hours the Treasury Department told Wyden it would be "moving away" from that plan, and then the IRS put up a more official statement:

The IRS announced it will transition away from using a third-party service for facial recognition to help authenticate people creating new online accounts. The transition will occur over the coming weeks in order to prevent larger disruptions to taxpayers during filing season.

During the transition, the IRS will quickly develop and bring online an additional authentication process that does not involve facial recognition. The IRS will also continue to work with its cross-government partners to develop authentication methods that protect taxpayer data and ensure broad access to online tools.

"The IRS takes taxpayer privacy and security seriously, and we understand the concerns that have been raised," said IRS Commissioner Chuck Rettig. "Everyone should feel comfortable with how their personal information is secured, and we are quickly pursuing short-term options that do not involve facial recognition."

The transition announced today does not interfere with the taxpayer's ability to file their return or pay taxes owed. During this period, the IRS will continue to accept tax filings, and it has no other impact on the current tax season. People should continue to file their taxes as they normally would.

Last week the Treasury Department had said it was "reviewing" the matter, but today's announcement is a big deal. It's rare to see a government agency move this fast, so kudos to Treasury/IRS for acting quickly (though, it can be argued that it never should have gotten this far in the first place). But also kudos to Wyden for helping make this happen as well.

Filed Under: facial recognition, irs, privacy, ron wyden, security, treasury department
Companies: id.me

The VPN Is On Everybody's Shitlist After Years Of Scammy Providers And Empty Promises

from the it's-not-magic dept

The high number of scammy providers and overall rise in encryption appears to have turned the public sentiment against virtual private network (VPN) VPNs, and whether most consumers actually even need one. As privacy scandals and hacks grew over the last decade, VPNs quickly emerged as a sort of mystical panacea, that could protect you from all harm on the internet. Of course, this resulted in a flood of VPN competitors who were outright scams, made misleading statements about what data is collected, or failed to protect consumer data.

The end result is a new trend in the press where about once a month we get a new story informing you that you probably don't actually need a VPN. NBC News was the latest last week, pointing out that VPNs aren't the panacea many people seem to assume:

"Most commercial VPNs are snake oil from a security standpoint,” said Nicholas Weaver, a cybersecurity lecturer at the University of California, Berkeley. “They don’t improve your security at all."

Scammy VPN providers are a major reason for the shift. A Consumer Reports study last month took a look at 16 top VPN providers, and found that the majority of them misrepresented their products or their data retention practices, and many of the companies actually put consumer privacy at greater risk. Only a quarter of the VPNs looked at clearly indicated how long they retain user browsing and other data. The gold rush and regulatory apathy created an environment where the industry's floorboards rotted out below it, creating products that actually put consumer privacy and security at greater risk.

Granted simple technical innovation is another reason why the VPN is no longer deemed essential. Most browsers implemented HTTPS, making the dreaded (and frankly often unlikely) scenario whereby a nearby coffee shop hacker hijacks the entirety of your finances no longer as much of a threat. There's also (much to the chagrin of total surveillance fans in intelligence and law enforcement) greater encryption overall, and a parade of browser extensions and plugins that can help provide additional security. Now, you're far more likely to be subject to a basic human engineering phishing attack, which a VPN won't help with:

"Users now need to worry far less about being hacked by a fellow coffee shop patron than by a hacker simply sending an email from anywhere around the world to trick them into giving up their passwords and other sensitive information, she said.

Hackers “would likely do a phishing attack on you before they would walk into a cafe with free Wi-Fi,” Hancock said. “Sending people nefarious emails, it’s much easier to do that kind of campaign. Those have been tried and true, unfortunately,” she said."

That's not to say VPNs don't still have their function. The technology is still an essential security layer for governments, corporations, or others dealing with extremely sensitive information. But for many ordinary consumers, they're more trouble than they're worth, in no small part thanks to an industry that completely lost its soul at the data collection and monetization trough.

Filed Under: encryption, overhype, scams, security, vpn

Sci-Hub's Creator Thinks Academic Publishers, Not Her Site, Are The Real Threat To Science, And Says: 'Any Law Against Knowledge Is Fundamentally Unjust'

from the put-up-or-shut-up dept

A year ago, Techdirt wrote about an important lawsuit in India, brought by the academic publishers Elsevier, Wiley, and the American Chemical Society against Sci-Hub and the similar Libgen. A couple of factors make this particular legal action different from previous attempts to shut down these sites. First, an Indian court ruled in 2016 that photocopying textbooks for educational purposes is fair use; the parallels with SciHub, which provides free access to copies of academic papers for students and researchers who might not otherwise be able to afford the high subscription fees, are clear. Secondly, the person behind Sci-Hub, Alexandra Elbakyan, is fighting, rather than ignoring, the case, as she has done on previous occasions.

One manifestation of her new pro-active approach is a tweet she posted recently. It included a screenshot of an email she wrote to Nature magazine, which had contacted her about a forthcoming article on the Indian court case. Following standard practice, the journalist writing the article, Holly Else, asked Elbakyan to comment on some of the accusations the academic publishers had made against Sci-Hub. Her responses are fascinating, not least because they provide Elbakyan's perspective on several important issues.

For example, according to the publishers' comments as transmitted by Else, "Pirate sites like Sci-Hub threaten the integrity of the scientific record, and the safety of university and personal data". In reply, Elbakyan points out Sci-Hub is unique, and the use of the phrase "Pirate sites like Sci-Hub" is a clever attempt to lump Sci-Hub in with quite different sites, thus prejudging the legality of its activities. Elbakyan says that it's academic publishers -- not Sci-Hub -- which threaten the progress of science:

open communication is [a] fundamental property of science and it makes scientific progress possible. Paywalled access prevents this and is a great threat to science. Also the great threat is also when the whole scientific knowledge became the private property of some corporation such as Elsevier, that has full control of it. That is the threat, not Sci-Hub.

Elbakyan points out that Sci-Hub doesn't threaten the "integrity of the scientific record", since she simply disseminates copies of the academic papers without changing them in any way. But perhaps the most interesting part of her reply concerns the accusation that Sci-Hub threatens the safety of university and personal data. Techdirt has written previously about claims that Elbakyan allegedly has links to Russian intelligence, and that Sci-Hub is some kind of security risk. According to Else, the publishers assert:

Pirate sites like Sci-Hub compromise the security of libraries and higher education institutions to gain unauthorized access to scientific databases and other proprietary intellectual property, and illegally harvest journal articles and e-books.

Sci-Hub uses stolen user credentials and phishing attack to extract copyrighted articles illegally

These are serious allegations, and ones that have been made several times in the past. Elbakyan's response is probably the first time that she has addressed them directly:

Do they have any actual case when Sci-Hub somehow compromised the security of any library or a person? Any person that complained about credentials that were 'stolen' from them? Or is it again, nothing more than empty accusations. Nobody is complaining about 'compromised security' except academic publishers.

In other words, it is time for Elbakyan's accusers to put up or shut up. She concludes by stating that "Any law against knowledge is fundamentally unjust", and hopes that "Nature will have enough honesty to publish my comments in full.

It didn't, of course.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: academic journals, academic research, alexandra elbakyan, copyright, education, holly else, india, publishers, security
Companies: nature, sci-hub

Banks, ISPs Increasingly Embrace 'Voice Print' Authentication Despite Growing Security Risk

from the this-probably-won't-go-well dept

While it's certainly possible to sometimes do biometrics well, a long line of companies frequently... don't. Voice print authentication is particularly shaky, especially given the rise of inexpensive voice deepfake technology. But, much like the continued use of text-message two-factor authentication (which is increasingly shown to not be secure), it apparently doesn't matter to a long list of companies.

Banks and telecom giants alike have started embracing voice authentication tech at significant scale despite the added threat to user privacy and security. And they're increasingly collecting user "voice print" data without any way to opt out:

"despite multiple high-profile cases of scammers successfully stealing money by impersonating people via deepfake audio, big banks and ISPs are rolling out voice-based authentication at scale. The worst offender that I could find is Chase. There is no “opt in”. There doesn’t even appear to be a formal way to “opt out”! There is literally no way for me to call my bank without my voice being “fingerprinted” without my consent."

The U.S. has generally been extremely lax on privacy and security legislation and oversight, generally opting for baseline requirements that companies at least be transparent about their security and privacy practices, and provide users with working opt out tools. But time and time again neither are really adhered to. Eventually our lack of any meaningful privacy rules for the internet era will culminate in a privacy scandal that makes past scandals look like a grade school picnic. And with companies increasingly prioritizing convenience and simplicity over security and common sense, that day could arrive sooner than we think.

The rush toward voice authentication tech is particularly problematic given the quick rise of automated deepfake systems and the growing trove of user voice data available online. With parades of online creators, and smart televisions and other gadgets hoovering up voice data (and frequently failing to secure or encrypt it), availability of this data is ballooning. As are examples where faking a user's voice has been used for significant thefts. What happens when voice print authentication is adopted at scale, and exploitation of that trend becomes automated by robocall scammers already running amok? Nothing good.

Using voice authentication to secure your finances (or much of anything notable) is, at its base, already very much a hit or miss proposition:

If you figure voice deepfake tech will only get cheaper and better over time, you can also figure replacing passwords and pins with voice authentication isn't a great idea in a country already drowning in robocall scams. Yet we're apparently doing it anyway:

"Again, society must adjust to the following reality: It’s become easy for anyone to spoof the voices of others who have public recordings of them talking (very common). Therefore, companies (especially banks) should not be using this as a @#%!ing way to log into accounts! You would think this is SIMPLE-enough for corporate America to understand, but alas, here we are."

At the very least informed users should have the ability to opt out of voice data collection, yet in many cases they can't even do that. It's yet another example of why the nation needs at least some kind of baseline privacy rules that at an extreme minimum mandates that both data collection and security options should be transparent, and users should always retain opt out control. Baseline privacy legislation should also include meaningful penalties and accountability for the very long line of companies that view consumer privacy and security as an annoying afterthought.

Given this would cost a large number of politically powerful industries money we're not going to do any of that. Instead, we're going to continue to embrace the current paradigm: a few badly crafted state privacy proposals and a generalized apathy on the federal level. Surely that will work out well, right?

Filed Under: banks, security, voice authentication

EU's Latest Internet Regulatory Madness: Destroying Internet Security With Its Digital Identity Framework

from the just-stop dept

The EU is at it again. Recently Mozilla put out a position paper highlighting the latest dangerous move by busybody EU regulators who seem to think that they can magically regulate the internet without (1) understanding it, or (2) bothering to talk to people who do understand it. The issue is the Digital Identity Framework, which, in theory, is supposed to do some useful things regarding interoperability and digital identities. This could be really useful in enabling more end user control over identity and information (a key part of my whole Protocols, Not Platforms concept). But the devil is in the details, and the details are a mess.

It would force browsers to support a specific kind of authentication certificate -- Qualified Web Authentication Certificates (QWACs) -- but as Mozilla points out, that would be disastrous for security:

At the same time, the types of website certificates that browsers would be forced to accept, namely QWACs, are based on a flawed certificate architecture that is ill-suited for the security risks users face online today. In the years since the original eIDAS regulation was adopted in 2014, an increasing body of research has illustrated how the certificate architecture upon which QWACs are inspired – namely, extended validation certificates – lull individuals into a false sense of security that is often exploited for malicious purposes such as phishing and domain impersonation. For that reason, since 2019 no major browser showcases EV certificates directly in the URL address bar.

As such, should the revised Article 45 be adopted as is, Mozilla would no longer be able to honour the security commitments we make to the hundreds of millions of people who use our Firefox browser or any of the other browser and email products that also depend on Mozilla’s Root Program. It would amount to an unprecedented weakening of the website security ecosystem, and undercut the browser community’s ability to push back against authoritarian regimes’ interference with fundamental rights (see here and here for two recent examples).

As Mozilla notes, the EU can still fix this. Whether or not it does is an open question.

Filed Under: certificates, digital identity, eu, regulations, security

New Report Again Shows Global Telecom Networks Aren't Remotely Secure

from the maybe-we-should-fix-that dept

Last year, when everybody was freaking out over TikTok, we noted that TikTok was likely the least of the internet's security and privacy issues. In part because TikTok wasn't doing anything that wasn't being done by thousands of other app makers, telecoms, data brokers, or adtech companies in a country that can't be bothered to pass even a basic privacy law for the internet era. If we're serious about security and privacy solutions, we need to take a much broader view.

For example, while countless people freaked out about TikTok, none of those same folks seem bothered by the parade of nasty vulnerabilities in the nation's telecom networks, whether we're talking about the SS7 flaw that lets governments and bad actors spy on wireless users around the planet or the constant drumbeat of location data scandals that keep revealing how your granular location data is being sold to any nitwit with a nickel. Or the largely nonexistent privacy and security standards in the internet of broken things. Or the dodgy security in our satellite communications networks.

This week, Crowdstrike drove this myopia home again with a new report showcasing how Chinese hackers have compromised global telecom networks for years. The security firm found that since 2016 or so, a (likely Chinese state backed) hacking organization dubbed "LightBasin" or "UNC1945" targeted global telecom companies and was able to compromise 13 of them since 2019. First accessing an eDNS server through an SSH connection from the network of another compromised company, the hackers were able to obtain a trove of telecom data including subscriber information, call metadata, text messages and more, helping them develop a wide collection of snooping tricks:

"The report lays out how this group has developed highly customized tools and a precise working knowledge of global telecommunications network architectures such that it can emulate network protocols to allow scanning and “to retrieve highly specific information from mobile communication infrastructure.” The nature of the data targeted “aligns with information likely to be of significant interest to signals intelligence operations."

Of course this comes on the heels of a steady parade of other telecom security scandals, ranging from the SS7 flaw we still haven't fully fixed (opening the door to covert surveillance), revelations that most satellite networks have the security of damp cardboard, and recent reports of a company that handles billions of global text messages from carriers all over the world was compromised for years before anybody knew anything about it. Most of these reports come and go quietly without even a tiny fraction of the hysteria we saw aimed at TikTok.

Speaking to the press, Crowdstrike researchers were quick to point out that freaking out about malware and apps doesn't mean much if the underlying telecom infrastructure is compromised (and it very much is):

"People leverage their cellphones like they’re magic,” said Adam Meyers, CrowdStrike’s senior vice president of intelligence. “They don’t think about the fact that there’s this whole infrastructure that makes it work … and that infrastructure is not something that you can take for granted."..."They don’t need to deploy the malware onto your phone if they’re owning the network that your phone is riding on,” he said.

Granted much like everyday infrastructure issues like bridge repair, shoring up overall internet network security isn't a sexy topic that sees much traction. Unless you're a U.S. company lobbyist leveraging Xenophobia to your competitive and political tactical advantage (see the sometimes narrow hysteria surrounding 5G), much of this stuff doesn't see anywhere near the attention it deserves in a press and policy discourse that often couldn't care less.

Filed Under: privacy, security, ss7, telco equipment, telcos, telecom networks
Companies: crowdstrike

Report: Client-Side Scanning Is An Insecure Nightmare Just Waiting To Be Exploited By Governments

from the 14-out-of-14-cybersecurity-experts-agree dept

In August, Apple declared that combating the spread of CSAM (child sexual abuse material) was more important than protecting millions of users who've never used their devices to store or share illegal material. While encryption would still protect users' data and communications (in transit and at rest), Apple had given itself permission to inspect data residing on people's devices before allowing it to be sent to others.

This is not a backdoor in a traditional sense. But it can be exploited just like an encryption backdoor if government agencies want access to devices' contents or mandate companies like Apple do more to halt the spread of other content governments have declared troublesome or illegal.

Apple may have implemented its client-side scanning carefully after weighing the pros and cons of introducing a security flaw, but there's simply no way to engage in this sort of scanning without creating a very large and slippery slope capable of accommodating plenty of unwanted (and unwarranted) government intercession.

Apple has put this program on hold for the time being, citing concerns raised by pretty much everyone who knows anything about client-side scanning and encryption. The conclusions that prompted Apple to step away from the precipice of this slope (at least momentarily) have been compiled in a report [PDF] on the negative side effects of client-side scanning, written by a large group of cybersecurity and encryption experts (Hal Abelson, Ross Anderson, Steven M. Bellovin, Josh Benaloh, Matt Blaze, Jon Callas, Whitfield Diffie, Susan Landau, Peter G. Neumann, Ronald L. Rivest, Jeffrey I. Schiller, Bruce Schneier, Vanessa Teague, and Carmela Troncoso). (via The Register)

Here's how that slippery slope looks. Apple's client-side scanning may be targeted, utilizing hashes of known CSAM images, but once the process is in place, it can easily be repurposed.

Only policy decisions prevent the scanning expanding from illegal abuse images to other material of interest to governments; and only the lack of a software update prevents the scanning expanding from static images to content stored in other formats, such as voice, text, or video.

And if people don't think governments will demand more than Apple's proactive CSAM efforts, they haven't been paying attention. CSAM is only the beginning of the list of content governments would like to see tech companies target and control.

While the Five Eyes governments and Apple have been talking about child sex-abuse material (CSAM) —specifically images— in their push for CSS, the European Union has included terrorism and organized crime along with sex abuse. In the EU’s view, targeted content extends from still images through videos to text, as text can be used for both sexual solicitation and terrorist recruitment. We cannot talk merely of “illegal” content, because proposed UK laws would require the blocking online of speech that is legal but that some actors find upsetting.

Once capabilities are built, reasons will be found to make use of them. Once there are mechanisms to perform on-device censorship at scale, court orders may require blocking of nonconsensual intimate imagery, also known as revenge porn. Then copyright owners may bring suit to block allegedly infringing material.

That's just the policy and law side. And that's only a very brief overview of clearly foreseeable expansions of CSS to cover other content, which also brings with it concerns about it being used as a tool for government censorship. Apple has already made concessions to notoriously censorial governments like China's in order to continue to sell products and services there. Additional demands will obviously be made if Apple implements scanning that can be exploited to locate and censor critics of the government.

There's plenty of bad stuff on the technical side, too. CSS is pretty much malware, the report says:

CSS is at odds with the least-privilege principle. Even if it runs in middleware, its scope depends on multiple parties in the targeting chain, so it cannot be claimed to use least-privilege in terms of the scanning scope. If the CSS system is a component used by many apps, then this also violates the least-privilege principle in terms of scope. If it runs at the OS level, things are worse still, as it can completely compromise any user’s device, accessing all their data, performing live intercept, and even turning the device into a room bug.

CSS has difficulty meeting the open-design principle, particularly when the CSS is for CSAM, which has secrecy requirements for the targeted content. As a result, it is not possible to publicly establish what the system actually does, or to be sure that fixes done in response to attacks are comprehensive. Even a meaningful audit must trust that the targeted content is what it purports to be, and so cannot completely test the system and all its failure modes.

Finally, CSS breaks the psychological-acceptability principle by introducing a spy in the owner’s private digital space. A tool that they thought was theirs alone, an intimate device to guard and curate their private life, is suddenly doing surveillance on behalf of the police. At the very least, this takes the chilling effect of surveillance and brings it directly to the owner’s fingertips and very thoughts.

While the report does offer some suggestions on how to make scanning less exploitable, the downsides are too numerous to conclude this can somehow be done safely. Given how many intrusive surveillance programs have already been justified with concerns about terrorism or the spread of illicit material, CSS -- no matter how implemented -- with become a tempting tool for governments to exploit.

In a world where our personal information lies in bits carried on powerful communication and storage devices in our pockets, both technology and laws must be designed to protect our privacy and security, not intrude upon it. Robust protection requires technology and law to complement each other. Client-side scanning would gravely undermine this, making us all less safe and less secure.

Despite this comprehensive report warning against the implementation of client-side scanning, there's a chance Apple may still roll its version out. And once it does, the pressure will be on other companies to do at least as much as Apple is doing to combat CSAM. The only upside is that if governments decide scanning should be used for reasons other than Apple intends, it has the power to shut its system down.

Filed Under: client side scanning, csam, iphones, security
Companies: apple

Many Digital Divide 'Solutions' Make Privacy And Trust A Luxury Option

from the First-do-no-harm dept

We've noted a few times how privacy is slowly but surely becoming a luxury good. Take low-cost cellular phones, for example. They may now be available for dirt cheap, but the devices are among the very first to treat consumer privacy and security as effectively unworthy of consideration at that price point. So at the same time we're patting ourselves on the back for "bridging the digital divide," we're creating a new paradigm whereby privacy and security are something placed out of reach for those who can't afford it.

A similar scenario is playing out on the borrowed school laptop front. Lower income students who need to borrow a school laptop to do their homework routinely find that bargain comes with some monumental trade offs; namely zero expectation of privacy. Many of the laptops being used by lower-income students come with Securly, student-monitoring software that lets teachers see a student’s laptop screen in real time and even close tabs if they discover a student is "off-task."

But again, it creates a dichotomy between students with the money for a laptop (innately trusted) and lower income students who are inherently tracked and surveilled:

"Hootman says she and other parents wouldn’t have chosen school-issued devices if they knew the extent of the monitoring. (“I’m lucky that’s an option for us,” she says.) She also worried that when monitoring software automatically closes tabs or otherwise penalizes multitasking, it makes it harder for students to cultivate their own ability to focus and build discipline."

Teachers and school administrators may be well intentioned, but they're not thinking particularly large picture. But the creation of this bifurcated treatment of privacy wasn't lost on the Center for Democracy and Technology, which issued a report last month that found, unsurprisingly, wealthier kids that can afford their own devices are subject to less surveillance and are inherently trusted more overall. Sometimes just by nature of the laptop surveillance systems, but also thanks to school district concerns about liability:

"LEAs (local education agencies) with wealthier student populations reported that their students are more likely to have access to personal devices, which are subject to less monitoring than school-issued devices...LEAs feel compelled to monitor student activity to satisfy perceived legal requirements and protect student safety."

So in trying to "help" kids, by not thinking broadly enough you're teaching them that they're inherently inferior and less deserving of overall trust. Combine that with the overarching problem that less expensive computer and phone hardware is often inherently less private and secure, and it's not particularly hard to see how efforts to "bridge the digital divide" could make some aspects of it worse if they're not particularly well thought out.

Filed Under: digital divide, luxury, privacy, school laptops, schools, security, students, surveillance, tracking

Most People Probably Don't Need A VPN, Experts Now Advise

from the first-do-no-harm dept

Given the seemingly endless privacy scandals that now engulf the tech and telecom sectors on a near-daily basis, many consumers have flocked to virtual private networks (VPN) to protect and encrypt their data. One study found that VPN use quadrupled between 2016 and 2018 as consumers rushed to protect data in the wake of scandals, breaches, and hacks.

Unfortunately, many consumers are flocking to VPNs under the mistaken impression that such tools are a near-mystical panacea, acting as a sort of bulletproof shield that protects them from any potential privacy violations on the internet. Not only is that not true (ISPs, for example, have a universe of ways to track you anyway), many VPN providers are even less ethical than privacy-scandal-plagued companies or ISPs.

After a repeated few years where VPN providers were found to be dodgy or tracked user data when they claimed they didn't, professionals have shifted their thinking on recommending even using one. While folks requiring strict security over wireless may still benefit from using a reputable VPN provider, experts say the landscape has changed. Improvements in the overall security of ordinary browsing (bank logins, etc.), plus the risk of choosing the wrong VPN provider, means that many people may just be better off without one:

"It’s time we retire the stock advice to get a personal VPN," Bob Lord, former chief security officer at the Democratic National Committee, told Motherboard in an email. "Most people do not need personal VPNs today because the internet is much safer than it was in 2010. Personal VPNs create additional risks. Giving everyone advice that only pertains to some people misdirects them from the steps that will actually help them secure their digital lives."

Granted there are plenty of journalists, government officials, or folks researching dangerous or volatile people who probably still benefit from using a quality VPN. There are also instances where using a VPN can help thwart invasive advertising data tracking:

"There is at least one thing that some VPNs could help with: blocking malicious ads. The online advertising ecosystem is so dangerous that the U.S. Intelligence Community has blocked advertisements on a network-level, Motherboard reported recently. But online ads are not just a threat to intelligence agencies; Motherboard has repeatedly shown how data brokers harvest 'bidstream' data by participating in the online advertising process. This sort of information can include location data."

But as the VPN field has become crowded by dodgy players, just injecting an entirely new dodgy player into your traffic flow isn't really helping anybody. Especially if you lack the capacity to ferret out which VPN provider is keeping its word, and which is just another shady business collecting, storing, and monetizing your data (while breathlessly insisting they don't do that).

Filed Under: cybersecurity, encryption, privacy, security, vpns