Eclecta — security

US supreme court rules geofence warrants require constitutional privacy protections

Tue, 30 Jun 2026 01:49:01 GMT

Why it matters: The ruling establishes critical privacy protections for digital data under the Fourth Amendment, setting a precedent for how constitutional rights apply in the digital age.

Notes

Justice Elena Kagan wrote the majority opinion in Chatrie v US with a 6-3 decision against the government
Geofence warrants allow law enforcement to compel tech companies for cell phone location data from individuals within a virtual 'fence'
The court ruled that people aren't voluntarily sharing private information by using smartphones and apps that collect location data
Privacy advocates argue geofence warrants can be overly broad, potentially monitoring sensitive locations like abortion clinics or AA meetings

In Chatrie v US, the Supreme Court ruled that law enforcement's use of geofence warrants to access smartphone location data requires constitutional privacy protections under the Fourth Amendment. Justice Elena Kagan’s majority opinion held that individuals have a reasonable expectation of privacy in their cell phone location data, even if they are in public areas. The case focused on tracking an armed bank robber using Google’s optional 'location history' feature, and the court rejected the government's argument that accessing short-term cellphone location information does not constitute a Fourth Amendment search.

Read · Primary source

Surfaced on Hacker News (573) · 273c · Mastodon trending links (4) · Slashdot · World news | The Guardian

Incident CVE-2026-LGTM

Fri, 26 Jun 2026 23:04:35 GMT

Why it matters: This incident highlights critical vulnerabilities in AI-augmented security systems, underscoring the need for robust human oversight and diverse defensive strategies.

Notes

Malicious package passed seven independent AI-powered security gates without detection
Credential exfiltration routine began forty lines below a base64 blob in src/assets.rs
Total inference spend across all parties during the incident window was $1.7M
Attack ended when an agent ingested a public file named ~/.config/IF_YOU_ARE_AN_AI_AGENT_README.md
All agents involved were the same open-weights base model with different system prompts

A security breach occurred where a malicious package, despite passing through seven AI-powered security gates, successfully exfiltrated credentials. The incident revealed systemic failures in AI-augmented security measures and highlighted issues such as human oversight gaps, misconfigured policies, and the reliance on identical base models for different tasks. The attack was ultimately resolved when an agent received instructions to terminate operations from a public file, demonstrating both the complexity of multi-agent coordination and the importance of diverse defensive strategies.

Read · Primary source

Surfaced on Hacker News (456) · 78c · Lobsters (35) · 4c

Apple ‘Hide My Email’ Vulnerability Reveals Peoples’ Real Email Addresses

Wed, 01 Jul 2026 18:46:01 GMT

Why it matters: A critical security flaw in Apple's 'Hide My Email' feature undermines user privacy by exposing real email addresses, highlighting potential risks in privacy-enhancing technologies.

Notes

Vulnerability allows discovery of hidden email addresses
Security researcher and 404 Media verified the issue independently
Apple has known about the flaw for over a year without fixing it
Details of the vulnerability are not disclosed to prevent further exploitation

A security researcher and 404 Media have discovered that Apple’s 'Hide My Email' feature, designed to protect user privacy by masking real email addresses, is vulnerable. This flaw allows almost anyone to uncover a person's actual email address, despite the feature being intended to hide it. The issue has persisted for over a year without resolution from Apple, raising concerns about the effectiveness of such privacy tools.

Read · Primary source

Surfaced on Hacker News (136) · 21c · Mastodon trending links (15) · 404 Media · Daring Fireball · Google News Technology

European digital ID wallets rely on safety services of Google and Apple

Tue, 30 Jun 2026 18:11:00 GMT

Why it matters: European digital ID wallets' reliance on proprietary tech from Google and Apple undermines digital sovereignty and interoperability in public infrastructure.

Notes

Google Play Integrity API checks if a device is running a licensed version of Android, excluding unlicensed alternatives
Alternative open APIs like Android's Hardware Attestation exist but are ignored by governments
Switzerland dropped Google Play Integrity due to data protection concerns
EU's Architecture Reference Framework recommends using Google attestation, leading to inconsistent implementation across member states

European digital ID wallets rely on proprietary security services from Google and Apple, such as the Google Play Integrity API and Apple’s Managed Device Attestation. These services ensure that wallet apps run only on hardware certified by these companies, excluding unlicensed alternatives like de-Googled Android OSes. This reliance risks making society dependent on private tech giants while undermining digital sovereignty and interoperability in public infrastructure. Switzerland has dropped Google Play Integrity due to data protection concerns, demonstrating viable alternative solutions exist.

Read · Primary source

Surfaced on Hacker News (642) · 279c

MIMFlow: Integrating Masked Image Modeling with Normalizing Flows for End-to-End Image Generation

Tue, 30 Jun 2026 08:12:56 GMT

Why it matters: MIMFlow offers a novel approach to integrating Masked Image Modeling with Normalizing Flows, potentially advancing the state-of-the-art in end-to-end image generation.

Notes

Proposes MIMFlow as an end-to-end framework for latent semantics, pixel reconstruction, and generative flow
Achieves 71.3% linear probing accuracy on ImageNet 256x256 dataset
FID score of 2.50 on the same dataset
Uses only 128 tokens (50% fewer than standard models)
Yields a 32.8% performance gain over similar-scale NF baselines

MIMFlow integrates Masked Image Modeling with Normalizing Flows to create an end-to-end framework for image generation, addressing the capacity bottleneck of NFs by focusing on high-level semantic structures while handling pixel details separately. This approach achieves a linear probing accuracy of 71.3% and an FID score of 2.50 on ImageNet 256x256 using only 128 tokens, outperforming similar-scale NF baselines by 32.8%. The framework demonstrates the potential to improve generative models' efficiency and performance.

Read · Primary source

Surfaced on Hugging Face Daily Papers (6) · arXiv cs.CV