Adam Katz

@adamhotep@infosec.exchange
400 Followers
782 Following
2.2K Posts

#Cybersecurity #antispam research leader at @TalosSecurity, FOSS advocate, zsh/bash #Linux geek, bastion of obscure knowledge.

Support freedom for ✊🏿🇺🇦🇵🇸🏳️‍🌈🏳️‍⚧️♀️
he/they.

Currently living in NYC.

Not representing any entity but myself (and occasionally your mom).

#fedi22 searchable

I run:opensource:​:debian:​:linux:​:bash:​:firefox:​:vim:​:signal:​:donor:
Githubhttps://github.com/adamhotep
Infosec Stack Exchangehttps://security.stackexchange.com/users/42391/adam-katz
Stack Overflowhttps://stackoverflow.com/users/519360/adam-katz
PGP FingerprintF8EC 5C50 92BA 06CA 8DCA 8BA1 8EBA 15BA F4AD 9292

RE: https://mstdn.ca/@paulisci/115769718574645378

This thread is a great way to end the year. It's not political and not bad news, just wholesome lunacy of the best kind.

Internet Sleuths Reveal Hack to Undo Epstein File Redactions

Trump’s DOJ has botched the Epstein files release even more than previously thought.

The Daily Beast

Canadians are the BEST neighbors! Here they've gone ahead and leaked the #CBS #60Minutes CECOT segment that Bari Weiss pulled for Trump. Enjoy!!!
#uspol #uspolitics #TangerineTyrant #FreeSpeech #journalism

https://archive.org/details/60-minutes-inside-cecot

60 Minutes Inside CECOT : Free Download, Borrow, and Streaming : Internet Archive

Full video of the 60 Minutes Inside CECOT episode that CBS pulled.

Internet Archive

This Gmail hack is unsettling not because it’s flashy, but because it’s bureaucratic. Attackers aren’t breaking encryption or outsmarting algorithms. They’re filling out forms. By changing an account’s age and abusing Google’s Family Link feature, they can quietly reclassify an adult user as a “child” and assume parental control. At that point, the rightful owner isn’t hacked so much as administratively erased.

The clever part is that everything happens inside legitimate features. Passwords are changed. Two-factor settings are altered. Recovery options are overwritten. And when the user tries to get back in, Google’s automated systems see a supervised child account and do exactly what they were designed to do: say no.

Google says it’s looking into the issue, which suggests this wasn’t how the system was supposed to work. But it’s a reminder of an old lesson. Security failures often happen when protective mechanisms are combined in ways no one quite imagined. The tools aren’t broken. The assumptions are.

There’s no dramatic fix here, only mildly annoying advice that suddenly feels urgent. Review recovery settings. Lock down account changes. Use passkeys. Because once an attacker controls the recovery layer, proving you’re you can become surprisingly difficult.

TL;DR
🧠 Family safety tools are being weaponized
⚡ Account recovery can be shut down entirely
🎓 Legitimate features enable the lockout
🔍 Prevention matters more than appeals

https://www.forbes.com/sites/daveywinder/2025/12/07/google-looking-into-gmail-hack-locking-users-out-with-no-recovery

#Cybersecurity #Gmail #IdentitySecurity #AccountRecovery #DigitalRisk #security #privacy #cloud #infosec

This took way too long to find. Blocking the "Sign in with google" on sites via #uBlock custom filter. Add accounts.google.com/gsi/* to the filter and adios stupid Sign in with google popups.

Edit: I tested this with logging into gmail (yeah i know, irony), and it still works fine.

Update: Thanks to @bill , this might be the more 'proper one'.

accounts.google.com/gsi/*$xhr,script,3p

#google #ublockorigin

The back page of last month's edition of The Onion.

I don't think I'll stop using Firefox anytime soon.
Yes, their management are fucking idiots and it's annoying that I'll have to disable new AI features whenever they release them..

But the alternative is to use something Chromium-based, which would make Google's domination of web technology absolute - and Google is 100x more evil than Mozilla ever could be.

I hope this fucking bubble pops before Mozilla fucks up Firefox so badly that it becomes completely unusable

This guy made the best counterfeit US cash the Secret Service had seen in 25 years. The article has a nice short documentary interviewing him. Yes, he shares some of his methods.
https://www.yahoo.com/news/counterfeit-money-actually-works-according-204204316.html
How counterfeit money actually works, according to a former forger

Jeff Turner counterfeited over $1 million in US currency. He forged the 1996-series $100 bill and later the 2013 "blue note." He was indicted on federal...

Yahoo News

Pete Buttigieg and Robert Reich have highlighted our plan to
✅ defeat Citizens United:

“Interesting things are happening across the country…
Montana is trying to address this through attention to what a corporation can and can’t do,
because that’s actually decided at the state level.

So instead of working it at the ‘speech’ side of the equation,
💥they’re working at the
‘what is a corporation’ side of the equation.” --Secretary #Buttigieg

And Former Labor Secretary Robert #Reich highlighted our plan as the path to beating Citizens United,
and a bipartisan coalition of state party leaders here are lending their efforts to the cause,
including Former Senator Jon #Tester and Former Governor Marc #Racicot.

⭐️. But the most important part is that 74% of surveyed voters
— regardless of party affiliation
— support our plan to get corporate money out of our elections.

👉 We’ve launched a ballot initiative to get undue corporate influence out of our politics and end dark money loopholes for good.

👉 Once we win here in Montana, we will have a legal precedent for all 49 other states. -- Yours could be next!

🔥We’re taking our elections back from the oligarchs, once and for all.

Thank you for supporting The Montana Plan today!
https://secure.actblue.com/donate/tei-roi-quotes

×

This Gmail hack is unsettling not because it’s flashy, but because it’s bureaucratic. Attackers aren’t breaking encryption or outsmarting algorithms. They’re filling out forms. By changing an account’s age and abusing Google’s Family Link feature, they can quietly reclassify an adult user as a “child” and assume parental control. At that point, the rightful owner isn’t hacked so much as administratively erased.

The clever part is that everything happens inside legitimate features. Passwords are changed. Two-factor settings are altered. Recovery options are overwritten. And when the user tries to get back in, Google’s automated systems see a supervised child account and do exactly what they were designed to do: say no.

Google says it’s looking into the issue, which suggests this wasn’t how the system was supposed to work. But it’s a reminder of an old lesson. Security failures often happen when protective mechanisms are combined in ways no one quite imagined. The tools aren’t broken. The assumptions are.

There’s no dramatic fix here, only mildly annoying advice that suddenly feels urgent. Review recovery settings. Lock down account changes. Use passkeys. Because once an attacker controls the recovery layer, proving you’re you can become surprisingly difficult.

TL;DR
🧠 Family safety tools are being weaponized
⚡ Account recovery can be shut down entirely
🎓 Legitimate features enable the lockout
🔍 Prevention matters more than appeals

https://www.forbes.com/sites/daveywinder/2025/12/07/google-looking-into-gmail-hack-locking-users-out-with-no-recovery

#Cybersecurity #Gmail #IdentitySecurity #AccountRecovery #DigitalRisk #security #privacy #cloud #infosec

@brian_greenberg Best move to fix the root cause: Get a real email provider.

Google crap comes w/ Google adverse effects, and causes Google crappy results. They are reading your mail and train GenAI LLM on it - feels good? You willingly serve the Google mission to monetise your private information thru targeted advertising. Get instantly fleeced by Google, or add using Google Gemini to surrender even more private information for their enhanced, cosy fleecing experience.

Spoiler: The Internet works w/o Google, but Google doesn't work w/o the Internet. Digital self-defence!

Just my 2 ct

The Saudi crown prince accused of hacking Jeff Bezos' phone met with more than a dozen tech execs and celebs during the same US trip. From Tim Cook to Oprah, here's everyone Mohammed bin Salman met with.

Tim Cook, Michael Bloomberg, and Oprah met with Mohammed bin Salman on the same trip in which he connected with Jeff Bezos.

Business Insider
@dazzr @brian_greenberg What is a safe alternative, a ‘real email alternative?’
@GPJohnston @dazzr @brian_greenberg Proton mail is the closest thing that comes to mind (I have used in the past on occasion). It does have its drawbacks, but Proton does emphasize and follow up on privacy to a reasonable extent

@GPJohnston @brian_greenberg

Mailbox (https://mailbox.org), Posteo (https://posteo.de), and Tuta (https://tuta.com) are security and privacy-focused mail providers. All three are based in Germany, bound and conforming to the rules of GDPR, as is Swiss company Proton (https://proton.me).

Your data – under your control.

Your digital workspace with email, cloud, office & meet. Secure & GDPR-compliant for businesses, public authorities and private individuals. ▶ Try us now!

mailbox
@dazzr @brian_greenberg I do use a different provider (that I pay for), but it's deeply naive to think that they're somehow immune to the same sort of thing. There will be exploitable gaps in their processes, too

@alex @brian_greenberg
Wait a sec - who said any IT product is somehow immune against exploitation? IT Security is a moving target under constant threat.

I am wondering what is more naive:
taking action to protect yourself against privacy-invading products/services from privacy-invading, greedy corporations on the Internet - or accepting to use privacy-invading products/services thrown at you by privacy-invading, greedy corporations on the Internet.

While I cannot guarantee success of my digital self-defence measures, why for Pete's sake should I surrender to privacy-invading, exploiting corporations in the first place?

@brian_greenberg this is why you need humans, and specifically humans with imagination and initiative, who care about processes

@brian_greenberg
I'm baffled when Google serfs dream that a "free" service that makes users a product should give any fucks at all if their data is inaccessible. As if Google, a company with many millions of users per "customer support" staff, is ever going to give a single second of attention to anyone's dissatisfaction.

The cattle don't have a say in how filthy rich the butchers get.

Easy choice: Leave Google now. Or muzzle your snout as you line up for the abattoir.

@brian_greenberg
Til; this is something in the news that I actually did.

It's not hard at all.
I locked myself out of an account not too long ago by setting the age below the minimum. The only way to unblock it was by a parent accout. So I made a brand new account and from there I re-set the age and some of the creds.

Thank god its at their attention.
Even thought they're "working on it"

@brian_greenberg

On the other hand, solving the newly existential question, "Will I cease to exist if I stop posting?" is easier to solve if you ignore the greater question "Is Google my bitch, or am I Google's bitch?"

If this question confuses you, bless your little heart.

@brian_greenberg Mm. It's analogous to attacking password recovery mechanisms rather than passwords.
@brian_greenberg alternatively, pay for Email. Then one can prove ownership using bank card number.
@brian_greenberg I wonder why it is so easy to change the birthday, especially if you set it to a birthday below 13 or even below the age of the account

@brian_greenberg

And once again the main issue is #bigTech not having an easily reachable human support team.

Any even mildly qualified human would have been able to spot such an abuse and assist. It's also not like Google wouldn't do ID verification for other age related things. Like wanting to watch youtube videos flagged as for adults only...

@brian_greenberg

Also just to add to this, you can do something similar with SSO links to google workplace. You won't be able to take over ones google account, but you can get their entire browser history, saved passwords, install extensions, ...

@brian_greenberg there's another catch, but correct me if I'm wrong: once you're added as a child in a Google Family Link group it's impossible to be removed. Unless the child account is deleted and recreated.
So as far as I know you're out of luck once you get added to a Google Family Link group. Google simply does not offer nor have the means to remove a child from such a group.
But like I said, I could be wrong, hope I am actually.

@jeremy @brian_greenberg If someone was added as a child and they then turn 18, how do they tell Google that they no longer fall under this arrangement?

Or does it just "expire" for Google at when you reach that age?

@martintheg @brian_greenberg From what I know you can't. Once an account is added to a Family Link group as a child it can't be removed unless you delete and recreate the account. And it doesn't expire, the child account will always be under control of the group owners.
@brian_greenberg Good thing my Gmail isn't important, I only have it because I proofread stories and a lot of the writers use Google docs, they can have my account for all I care.