Our weekly picks of digital trust-related articles

Most people are nowadays aware of phishing attempts by e-mail and double-check an e-mails trustworthiness before clicking any links. But how many are just as cautious with their physical mail? This unusual campaign distributes its malware via the Swiss postal services. Phishing attempts by letter is definitely a new one for me, and a reminder to always be vigilant when visiting links - be it by directly clicking on a link or by scanning a QR code - no matter the medium.

Perhaps you heard of iPhones rebooting if they are not in use for some time. This addresses security vulnerabilities where the phones have been unlocked, so the decryption keys are in the memory, but currently the screen-lock is active. In this article you'll learn which parts of the iPhone are responsible for triggering the reboot. And that the reboots are probably not triggered over wireless, as some reports wrote.

Interesting to see that 12 out of the 15 top vulnerabilities published by CISA, America's cyber defense agency, are from 2023. Log4j2 from 2021 is also still in the list! So make sure that your systems are up-to-date with regard to these vulnerabilities, even if it's not 0-days anymore.Bleeping Computer

The Markup's guide to protecting your privacy when seeking abortion care has thankfully less urgency in Switzerland than in the United States. It serves nonetheless as a stark reminder that preserving privacy in the digital age is neither an academic exercise nor an end in itself, but a means to protect vulnerable people should the political environment deteriorate.

I found this article fascinating since it highlights the complexity of defining what 'open-source AI' should mean. Today, it is a confusing topic, with many models being 'open-source' in name only. For neural networks, training data and source code are inseparable; together, they define how the model is programmed. Therefore, should we be allowed to exclude the training data? Probably not. But what about in privacy-preserving federated learning of AI models, for example, in healthcare where data cannot be legally shared...? OSI's definition will struggle to get unanimous approval.

As this real estate agency discovered only in hindsight, ChatGPT hallucinated into existence two schools that don’t even actually exist for one of the agency’s property listings. This serves as yet another reminder for all of us who increasingly rely on tools like ChatGPT that establishing AI trustworthiness remains very much a work in progress.

An interesting question about how current LLMs are answering our questions: do they have an accurate world model which they use to answer? Or are they more like a 'stochastical parrot', and simply answer using previously seen reasoning? The difference is important, because it indicates the maximum precision these models can attain - the better the world model, the better the precision.

Even if government surveillance isn't something you're worried about, this guide offers steps for improving your privacy in everyday life.

The Change Healthcare breach is deeply concerning, highlighting the vulnerabilities in centralized data systems used to protect sensitive healthcare information. The response to this illustrates a consistently reactive (rather than proactive) political action, where acceptable cybersecurity standards in legislation are only proposed after a significant data breach affects 100 million Americans.

Inwiefern 'verstehen' LLMs die Welt, und können sie 'denken'? Oder ist ihre vermeintliche Intelligenz doch nur eine Illusion der Statistik? Dieser Artikel arbeitet ein aktuelles Papier zu diesem Thema für ein nicht-technisches Publikum auf - ein wichtiger Beitrag dazu, dass das Wissen um die Fähigkeiten und Grenzen solcher Technologien nicht nur im Kreis von ExpertInnen bleibt, sondern auch in der Öffentlichkeit ankommt.

Dating apps are out to debunk the well-known mantra "If you're not paying for the product, then you are the product.". Even if users are paying, these services goad users into paying ever more through a pay-to-play system. The promise of finding a soulmate, a design that keeps users hooked and black-box algorithms make up a toxic mix that drives users to continue spending money instead of the advertised goal of being able to delete the app as soon as possible.

I really like this report and its accompanying FAQ for non-technical readers. Citizen Lab is of course a defender for human rights and freedom of expression, but in this article, they don’t rail on about how China’s weak data protection ecosystem impinges on people’s right to privacy. They just do the technical legwork and let the results speak for themselves.

Not sure if you heard of the latest misinterpretation of a paper describing an attack on symmetric encryption using quantum computers. It has been hyped by some journals as 'the end of encryption'. But it is at best a demonstration that future quantum computers might be as fast as classical computers. For hacking a very specific type of symmetric encryption which is rarely used. A nice read which deciphers the trail of hearsay from the original paper to the fear-mongering articles.

Wow - this is counter-attack made right! Sophos explains how they tracked hackers of their firewall product by adding code which tags attacks and reports them back to Sophos HQ. They managed to get a lot of information about the hackers, including their whereabouts. What I really liked about the article is how it shows a way the 'free and open internet' can be preserved without having to close it down like so many states do. But instead by intelligently investing in being one step ahead of the hackers.

A group from ETHZ looked into the end-to-end encryption vows of five providers and found that only one actually fulfils its promise. The problem is mostly that the servers can read the files, even though they should not be able to do so! What worries me more is that some of the companies didn't even reply to the researchers. Others did actually change their protocols to make them more secure.

The razor-thin victory for E.U. supports in Moldova is an uneasy one with the heavy Russian influence campaign on social media in the back of everyone's mind. Platforms like Meta have repeatedly demonstrated their inability to effectively tackle influence campaigns, no matter their target or scale. With the U.S. election just days away, American democracy might pay a steep price for not reining in these companies no matter which side the coin-flip election lands on, as eroding trust in the democratic system is at the core of these campaigns.

Again, for all those of us who don't mind being tracked 'because I have nothing to hide'. This nicely shows how you can target specific communities with opposite ads, but to drive down the same point: don't vote for that candidate. It strikes me because it is so clearly biased, not once, but twice…

The leaked internal TikTok documents confirm the long-held suspicion that we urgently need to stop entrusting social media companies with putting up safety-rails. Dampening addictive features, bursting filter bubbles and moderating content directly contradicts maximising user engagement, the metric by which such companies live and die. We need binding regulations with real teeth to protect users, both minor and adult.

Anthropic's CEO, Dario Amodei, is one of today's leading figures in AI. In his essay, he envisions a future where powerful AI could radically improve human life by accelerating progress in areas such as biology, mental health, economic development, and governance. He foresees a more equitable and prosperous world resulting from these advancements. I particularly appreciated his message of hope: 'Many implications of powerful AI are adversarial or dangerous, but there must be something we’re fighting for—a positive-sum outcome where everyone is better off, something to rally people to rise above their squabbles and confront the challenges ahead. Fear may motivate, but it’s not enough: we need hope as well.'

Social networks began by enabling us to connect online with our family and friends and with communities of interest. Influencers then helped generate the growth that was “missing” on the personal side. AI-generated content, which Mark Zuckerberg sees as the next “logical jump” in the engagement race, seems very creepy to me if you consider the initial goal of such networks.

A very popular top-level domain (.io) is facing a weird situation I never knew could happen. This particular domain is, in fact, a ccTLD, which means it's tied to a country code—particularly "the British Indian Ocean Territory"—whose ownership is about to be moved from the UK to a neighboring nation. This transfer could result in the termination of the TLD, leading to the termination of all domains that use it within a couple of years.

Finally some fun and fascinating news on AI. Penn State researchers have created an electronic tongue that uses AI to tell different liquids apart, like watered-down milk or various sodas, and check for food safety. This opens up a some cool possibilities to have AI as your very own food tester!

[DE] "Ein sehr empfehlenswerter Überblicksartikel über laufende EU-Verfahren gegen Meta. Als wären dies allein nicht schon genug negative Presse, enthält der Beitrag eine besorgniserregende Beobachtung: Meta scheint sich offenbar das Recht vorzubehalten Beiträge zu zensieren die die Plattform kritisieren. Sollte das über die im Artikel genannten Einzelfälle hinaus Standardvorgehen sein, wäre dieser Missbrauch ihrer Position als Betreiber ein erheblicher Vertrauensbruch gegenüber ihren Benutzer*innen.

The banning of Discord in Russia and Turkey is concerning because it serves as a crucial communication tool (without suitable alternatives available), and both countries justify the ban by citing security concerns, such as misuse for illegal activities. At the core of the ban is also Discord's alleged unwillingness to comply with local laws and share information. Discord is already banned in the UAE, China, Iran, Egypt, Oman and North Korea.