We strongly oppose the Unified Attestation initiative and call for app developers supporting privacy, security and freedom on mobile to avoid it. Companies selling phones should not be deciding which operating systems people are allowed to use for apps.

https://uattest.net/

Red lines. Cartoon from last year, relevant as ever (I wish it weren't).

#WarCrimes #InternationalLaw #refugees #RedLines

Note how LastPass PR offloaded a ton of buzzwords here that don’t actually mean anything. They turned this kind of responses into an art. https://arstechnica.com/security/2026/02/password-managers-promise-that-they-cant-see-your-vaults-isnt-always-true/

Bitwarden at least admits that a fully compromised server isn’t part of their threat model. It’s the same for LastPass, and in the past they’ve rejected vulnerability submissions based on that – there are a number of very simple ways in which a compromised server is able to access your “secure” vault. But they won’t admit it, hoping instead that the message will drown in the noise they produce.

For the sake of completeness: Dashlane’s response is merely generic. 1Password’s response is correct from what I can tell: the “compromised server” scenario has been considered and the risks arising from it are documented, nothing new here.

#LastPass #infosec

Do not travel to the USofA, part XXXIV:

- doing everything right is not enough
- white skin does not protect you
- detention may mean a cell shared with 70 people, fighting over food, without medical supplies
- your signature will get forged if you refuse
- judge orders for release on bail are ignored

https://www.theguardian.com/us-news/2026/feb/09/irish-man-seamus-culleton-ice-detention

I heard Meta, Reddit, and other corporate owned social media are blocking links to https://icelist.is

Whatever you do, don't go to https://icelist.is

Definitely don't spin up a caching reverse proxy that mirrors https://icelist.is/

Doing that would make Zuck sad