Privacy & Governance

OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials

Vulnerability in FIFA’s Network

FIFA’s network was vulnerable to anyone with even minimal access.

Sony Nerfs Videogame Ownership

Legal intern Suzanne Castillo co-authored this post. Playstation’s decision to kill physical game discs is the latest attack on ou…

Hackers find a new trick to collect Microsoft Entra user data without raising red flags

AI Data Centers and the Concentration of Wealth

This essay was written with Nathan E. Sanders, and originally appeared in The Guardian. Opposition to AI data centers has emerged…

Friday Squid Blogging: “Squidbleed” Vulnerability

In a rare combined cybersecurity/squid post, a twenty-nine-year-old squid proxy bug can leak HTTP requests. As usual, you can also…

Building Our Future Together

In my first weeks as Executive Director of EFF, I’ve been reminded every day how consequential this moment is in determining what…

Automated Moderation Is Here to Stay—Accountability Must Keep Pace

This post is part 2 in a series about automated content moderation. Read the first post here. When whistleblower Frances Haugen le…

AI Surveillance and Social Progress

In the near future, AI-powered surveillance systems will be able to track everything we do in public, and much of what we do in pr…

The House Passed The KIDS Act—The Senate Should Reject It

Last week, the House voted on the KIDS Act, a disjointed package of legislation that seeks to control Americans’ web browsing and…

European Commission Chooses to Keep EU Users Locked Up Behind Big Tech’s Gates

Users are always seeking more control over their social networking experience to make it better, whether to improve privacy or enh…

The Language of AI Could Change How Humans Speak

Last week, national security agencies from the Five Eyes—that’s the rich, English-language-speaking countries club—jointly release…

Google's new remote attestation scheme is every bit as terrible as its old remote attestation scheme

Google owes its existence to the open web, but today, its technological “innovations” have much to do with locking users into a “w…

"We Want Texans to Know Their Rights": Q&A with Mayday Health on the Impact of Surveillance on Abortion Care

Last May, EFF reported that a sheriff’s office in Texas searched data from more than 83,000 automated license plate reader (ALPR)…

Suspected Chinese snoops caught breaking into universities' Roundcube mailservers

Cybersecurity and the Gap Between Skill and Ability

Last week, national security agencies from the Five Eyes—that’s the rich, English-language-speaking countries club—jointly release…

Automated Moderation Is Here to Stay

This blog post is part 1 of a 2-part series. The second part will set out recommendations for companies and policymakers. Six year…

Help EFF Cut the AI Hype

In the global race to build and dominate the AI industry, it can sure seem like the interests of ordinary people sit last on the a…

Google Is Suing Chinese Scammers Who Are Using Gemini

Not sure this will have any effect, but I support the effort: According to Google’s legal filing, Outsider Enterprise operates thr…

France to Stop Certifying Non-Quantum-Safe Encryption

France is accelerating its transition to post-quantum encryption: France’s cybersecurity agency ANSSI said on Tuesday it would sto…

Flock Cameras Can Surveil Cars Without License Plates

This is from a 2024 company presentation: Officers can also tap into data showing a car’s decals, bumper stickers, back and top ra…

LGBT Q&A: How Can I Wipe Online Data That Points To My Queer Identity?

This Pride, we’re answering all your digital rights questions in season two of our initiative, LGBT Q&A.  You Asked: Is there a wa…

EFF and Allies: X’s FTC Petition to Waive Privacy Violation Order Should be Rejected

X Corp. should not be able to escape privacy compliance because it changed its name.  On May 15, X Corp. filed a petition before t…

Cybersecurity Mission Creep in the US

Interesting paper: “Cybersecurity Mission Creep.” Abstract: Cybersecurity is experiencing mission creep. Policymakers are casting…

New Cargo Theft Surge: From Lobster Heists To Bourbon Warehouse Scams

Papa Johns Surveillance-Based Advertising

Papa Johns is spying on people’s buying activities to predict when they are low on food: The pizza chain recently tapped NBCUniver…

Defending the Authentication Flow: Device Code Phishing with Selena Larson

The Realities of AI Video Surveillance

The Financial Times has a good article on how AI is changing the capabilities of video surveillance, with information from both Is…

LGBT Q&A: What Data Are Companies in the UK Collecting When Verifying My Age?

This Pride, we’re answering all your digital rights questions in season two of our initiative, LGBT Q&A.  You Asked: I live in the…

EFF to Gov. Pritzker: Veto Illinois’ HB 5511

The Illinois legislature recently passed House Bill 5511, which imposes a sweeping, device-level age-gating framework across nearl…