UK infosec experts flag concern over NHSX contact tracing appLaurie ClarkeNS Tech

Mobile app displaying a text message from the government

This is the sort of reason why I don’t trust the state with my data as much as I trust many private companies. Apple and Google have worked together (itself a minor miracle) to develop a method of contact tracing that does not collect personal data and does not invade people’s privacy.

NHSX has rejected that model in favour of one that will enable them to deanonymise people, and store that information in a centralised database. This is the surveillance state. It risks reducing goodwill towards the NHS and other public institutions.

A statement for medical privacy campaign group Medconfidential reads: “Given NHSX has chosen to build an unnecessary massive pool of sensitive data, it must ensure that the data is well protected. With combined effort, GCHQ and NHS Digital will likely be good at defending the big pool of sensitive data. But there is no need to have that data. The best way to make sure data doesn’t leak, is to have chosen the method that never collected it.”

Apple contractors ‘regularly hear confidential details’ on Siri recordingsAlex HernThe Guardian

Apple device with Siri activated

Apple contractors regularly hear confidential medical information, drug deals, and recordings of couples having sex, as part of their job providing quality control, or “grading”, the company’s Siri voice assistant, the Guardian has learned.

Looks like Apple’s big claims on privacy are — like most things from Apple — a superficial marketing line.

Ring doorbell footage

For owners of Amazon’s Ring security cameras, strangers may have been watching — Sam Biddle, the Intercept

This is jaw-dropping stuff about lacklustre security practices at Ring, the smart doorbell manufacturers — as well as a story about rather lacklustre technology problems. Perhaps I’m naive, but I’m amazed that unencrypted live video footage is available to Ring employees at all. It makes me think twice about internet of things gadgets.

Illustration of a woman in a workplace

Thoughts on vulnerability

This is a really enlightening and enjoyable article about how vulnerability can sometimes be a strength.

What I’ve realized is that sometimes being vulnerable is a really powerful feeling, like being bilingual: being present and making clear decisions in a meeting while rocking a baby, or confidently stopping someone mid-presentation to ask what an acronym means. Or having my waters break and calmly finishing a meeting. Like, that’s bad-ass, right?

But what struck me most about this article was the point about how a thoughtless office space design in a less-than-diverse workplace created an unforeseen problem for a woman who needed a little privacy.

Facebook is giving advertisers access to your shadow contact information

Facebook is not content to use the contact information you willingly put into your Facebook profile for advertising. It is also using contact information you handed over for security purposes and contact information you didn’t hand over at all, but that was collected from other people’s contact books, a hidden layer of details Facebook has about you that I’ve come to call “shadow contact information.”

Stylish browser extension steals all your internet history

If you use the Stylish browser extension, you ought to have a read of this. It might make you want to uninstall it immediately, as I did.

It appears that last year Stylish began collecting users’ data, including their full browser history, and even the contents of Google search results.

The above blog post explains exactly what is going on, and why it is a problem.

This is a great shame because Stylish provided a brilliant function enabling you to improve bad or unsuitable web designs very easily. I even created a style that improved the user interface for live timing on Formula1.com — which I still used up to last weekend, and has been installed by almost 500 others.

Not any more — I have uninstalled Stylish from my browser.

After the hiccup

Most customer relationships don’t stumble because something went wrong. Your best customers know that mistakes happen.

It’s what happens next that can cripple the relationship.

I would be tempted to agree with Seth Godin here. But it actually reminded me of the recent incident with Ghostery.

Ghostery is a browser plugin that is supposed to protect your privacy online. But on Friday, when attempting to email its users about GDPR, they accidentally leaked the email addresses of hundreds of their users by CCing them into the email — the most basic and facepalm-worthy data breach of all.

I once briefly used Ghostery. But I uninstalled it after I found it kept on crashing my browser.

My response in this case was to find it deeply ironic that Ghostery should fail at the one thing they were meant to do. It’s true “you had one job” stuff, this. So I deleted my Ghostery account entirely.

Perhaps if my prior experience with Ghostery had been more positive, I would have been more lenient.