Printers leave a watermark on each page indicating the exact printer that it came from. Are there any other examples of these privacy violations that aren't common knowledge?
One thing I'm concerned about is recording equipment leaving identifiable information without us knowing about it.
Well just recently learned that some printers exfiltrate data from air gapped networks through ink cartridges.
Most modern cars are SIM-enabled and are constantly sending data back to the mothership. But even those that aren't will still collect data locally and that data will be collected when you send the car to an "official/licenced/authorized" repair shop.
I hate this.
I'm still driving a '99 vehicle and the most advanced thing about it are the power windows. I dread upgrading to a vehicle that can break in so many new ways. I hate that everything has touch screens and the software on many is awful and if it breaks, surprise, you have no music in your car now.
Earlier this year during the CCC security conference it was revealed that the tracking info of 800k Volkswagen cars was publicly accessible...
The talk is available in English as well I believe: https://media.ccc.de/v/38c3-wir-wissen-wo-dein-auto-steht-volksdaten-von-volkswagen
I have heard firsthand that investigators just go for the car instead of the phone since it is way easier to get data from the car.
So where's the directory of where to find the transmitter/SIM in specific vehicles?
You can look this up for your model. When I was looking this, there was a youtube video showing how to physically renove chevy's onstar thing in the car
or any repair show that uses the brand specific diagnostic software, pirated or not
Tons of websites record your mouse, keyboard, and scroll activity, and can play back exactly what you saw on your browser window from its backend dashboard as a video. This is called session replay. There are pre-made libraries for this you can import so it's super common, I believe Mouseflow is one of the biggest providers.
When a mobile app, Windows app, or even website crashes nowadays, it automatically sends the crash dump to the app developer/OS vendor (the OS often does this whether the app requests it or not because the OS developer themselves are interested in what apps crash and in what ways). We're talking full memory dump, so whatever private data was in the app's memory when it crashed gets uploaded to a server somewhere without your consent, and almost certainly kept forever. God help you if the OS itself crashes because your entire computer's state is getting reported to the devs.
Your phone's gyroscope can record what you say by sensing vibrations in the air. It may or may not be something humans will recognize as speech if played back because the frequency range is too limited, but it's been shown that there's enough information for a speech recognition AI to decode. Good chance the accelerometer and other sensors can be used in the same way, and using them together will increase the fidelity making it easier to decode. Oh did I mention no device has ever implemented permission controls for sensors so any app or even website can access them without your consent or knowledge?
Correction: GrapheneOS has implemented permission controls for sensors. It also has sandboxing and permission scopes to prevent many of those leaks.
However, Graphene is not available to everyone, and it's still problematic due to bystanders/passerby.
nah only the minidump is reported back which only contains the memory the crashing stack is using. Sending the full dump would requires uploading gigabytes of data which would cripple any home internet as they mostly have very limited upstream bandwidth.
Though iirc a system crash report can include a kernel dump, which can contain things like private keys.
Though realistically, Microsoft controls your OS. They could easily add code to allow them to grab whatever they want from your system without any logging (by your system anyways).
That actually makes me wonder if there are any apps that run on both a system and the router that system is connected to to determine if the internet traffic as reported by the system (to the user) is the same as what the router sees as a way to detect anything using network resources but bypassing the normal network stack.
Photos taken by digital cameras are also trackable in a similar way as prints taken from a printer. I recall reading they were trying to identify the device after a Harry Potter book was leaked by someone taking digital photographs.
EXIF data?
Apparently! Just looked it up and reports presently say that the Serial Number of device was found to be 560151117 from EXIF data. Camera make : Canon Rebel 350 (also known as the Canon EOS 350D or Canon Digital Rebel XT);
Exif data. It can be removed with various apps but its in photos by default on most devices
or just the individual characteristics and flaws of the lens/sensor/postprocessing software, some of which can be unique per device, and potentially comparable to other photos made with it.
Even without EXIF data I would bet the actual encoding of the image will be identifiable to a specific instance of the camera software.
Similar to how websites fingerprint your browser by rendering something in the canvas or webgl and sending back the rendered image. The exact same rendering procedure will produce slightly different images for each browser instance. I suspect browsers are fully aware and complicit in this because why the actual fuck would they not make the rendering engines deterministic to their inputs?!
In that case, looks like they didn't remove the EXIF data.
Youre talking about img metadata right? With the right tool you can strip images out of them
That's the obvious one. But you can also add data to images by adding tiny values to the pixels, it'll still look the same to us (same as printer tiny dots).
I don't know if phones actually do this. Just saying it's possible.
But many uploading sites optimize the images, so it'll be gone on reshare, but they could get it on first upload.
Any image editing tool like mspaint or similar. Just copy paste the pixels into a new image file. Though, the program youre using will probably still add it's own metadata to the new file, but all the original metadata from the camera won't be there.
To be clear, this is not about EXIF data (which is its own problem).
Digital cameras can be fingerprinted from the images they produce, due to variations between pixels in any given sensor. If you're concerned about an image being traced back to your camera, you might consider some post-processing before distributing it.
There was a post not long ago about fingerprinting lense aberrations as a unique id. Idk how practical it is though?
https://www.technologyreview.com/2024/02/27/1088154/wifi-sensing-tracking-movements/
WiFi-based human motion detection through barriers
Social graph connections can be automatically inferred from location data. This has been done by governments (example) for a long time and is also done by private companies (sorry I can't find a link at the moment).
Maybe this. Most smartphones have a modem inside, this modem has a separate closed-sourced operating system and it usually has the main priority in controlling the smartphone relative to the processor running the main operating system, such as Android. Sometimes the modem has access to the microphone or memory, even bypassing the CPU. Although maybe everyone already knows that.
I've wondered for a while if something like this is why Google allowed their bootloaders to be unlocked, because they can get at everything anyways.
And I bet that if that was the case, they've backed off that for future phones because of those stories about law enforcement seeing having those phones as suspicious, which could hurt sales, since I bet the majority of pixel users don't switch operating systems.
Wouldn't that lead to a "Clipper Chip" situation where somone figured out how to isolate the issue? I think the Graphene team already did it.
They run a mini Linux distro and you can ssh or tyy into them if you have a serial port. They have access to much of the hardware but usually over something like a serial interface but still can inject code and stuff. They are a completely secret self-contained computer and I don't even think they get updated for security. They could easily be hacked by anyone probably mostly government regimes. There is only a few companies that make them and they are ultra secretive and protective over them. This is the main reason it's nearly impossible to get an open source phone. Arm is proprietary, modems are proprietary. They run blobs. I have probably the one phone in existence that can run an open source modem firmware, and interestingly I have figured out that there is basically no security whatsoever on the cell networks. (Monopolies gonna monopoly) So that might be one reason they are so secretive about it, another reason is because they don't want citizens being able to just have open source radios that they can't easily hack or sell to drug cartels or something.
It does have complete access to your mic and Bluetooth and other stuff since they share buses, it has access to all your data being sent. It can record phone calls. It can triangulate your position. It can even imitate other modems to pick up people's messages and calls, which means not only can it spy on you but also it can spy on other people around you. I don't think it's really possible to disable these things completely outside of physically cutting power. They boot up with the phone and can probably run even when the phone is powered off since it's a self contained system, often with a direct connection to the battery.
Between Bluetooth, and cellular modems, they have basically complete access to many bands around you, as well as sensor data and sound and video, and with satellites recording the entire planet, they can trace anyone who doesn't have a device back in time anyways. Cell towers can triangulate you as well and do. It's part of location services in all phones now. The modems can connect to almost any towers at least for "emergency purposes".
Basically the only place that's safe now is inside your own head but even that's becoming unsafe because of AI that can read your facial expressions and infer your mental state.
The ways they get around the legalities is originally with the eyes programs, where countries would spy on their allies citizens to escape domestic laws like those pesky constitutions, but nowadays they just literally sell everyone's personal data to the highest bidder, international or domestic. The CCP can buy this I do just as easily as Black Rock can, not that Black Rock is or every was an American company. These are international corporations that exist outside of the idea of a state.
It's also not the CIA or NSA spying on you, but private companies. Even the people in the CIA and NSA aren't allowed to know about the extent of the true intelligence apparatus which is completely secret, outside the law, and contained entirely in international corporations. The entire Internet has been saturated with bots since 2001 or something probably. The internet is just a massive psyop and propaganda program. The average person in the 90s would be horrified at the opinions of common people today. Nukes are also probably not real. Just a way to scare people into believing Russia and America and China are actually enemies while they partial up and nationalist culture that doesn't want to give all its resources up to the international secret world management and finance corporation. Fiat currency too is a giant scam to make sure the working person never acquires wealth, and has to work forever, and corporations and wealthy humans who's names will never be spoken publicly, can own anything and have unlimited leverage and I finite money without ever having to work or produce anything of value. The text books in nearly every school in America are made by a company in Israel who was co-founded by glisten Maxwell's father. The left in U.S politics is fake, and the whole social justice warrior movement was a clever psyop to push all the countries further right wing run by internationalist corporations btw. 25% of Americans are addicted to legal amphetamines, more on other drugs like weed which reduces people's ability to understand what's real, Md nearly half of working age people in America cannot or won't find work. Wages have been dropping for decades and now IQs are dropping. Most of human genetics have been completely ruined, as we as humanity has destroyed nearly every honest, principled and empathetic human on the planet for profit.
Snowden gave us this info, right?
Well if you have a better way of designing a hard RTOS I'd like to hear it.
That ATM cash tracking thing comes to mind
What is it?
Isn't it common knowledge? I've known about it for at least two decades...
BTW - you can easily work around it. Get someone else to buy your printer for you, or trade with someone who has the same printer... Now, they will still be able to match it to the printer, if they find it at your home, but other that that, you are free...
PS. Don't use your printer to blackmail FBI or CIA. ;-)
No... But i've thought about how easy it would be to implement in ebooks and pdfs (e.g. my daily newspaper i can download as pdf). I've thought about this when sailing the high seas.
Is it a thing?
Watermarking is definitely a thing. Whistle-blower have to think about that as well.
Yeah - was motivated to do a search :) https://www.lemonink.co/home#start-using
Most ebooks I bought recently come with a warning that the buyer's data is embedded in the file to deter from sharing it online. TBF it cannot be hard to remove it but I didn't bother to check how it's implemented.
It's prevalent among pdfs downloaded from academic publishers (text listing the receiving IP address and/or institution running down the margins). I wouldn't be surprised if it's also done with hidden white text or in the metadata.
Ive never noticed this or heard that printers do that.
Is this maybe specific to the USA?
Edit: TIL, thank you!
It's not specific to USA... They do it everywhere - with color-printers. Don't know if they do it with B/W printers.
They claim it's to track people who try to print money, but if it were, then they wouldn't really do it on laser printers too...
If you print a photo on a regular paper, and then shine an UV-light on it, you can see it. It's mostly small yellow dots.
Are there any other examples of these privacy violations that aren't common knowledge?
Here you go :)
Aren't these only produced by laser printers?
Are they in laser as well? This is way older than laser.
Doubt. Laser printers were invented in the early 1970s and were common by the mid 1980s. I don't think this tracking started until inkjets and scanners got good enough that the government got concerned about them being used for counterfeiting, I'd guess mid to late 90s at the earliest.
If you don’t connect your Fire TV or other Amazon device to the internet it will talk to your next door neighbors Echo or whatever to send your data back to Amazon.