Tech Brew Ride Home - Tue. 09/07 – How Private IS ProtonMail?

Episode Date: September 7, 2021

What does it mean if ProtonMail regularly discloses user data to certain authorities? How private is WhatsApp if Facebook has more than 1,000 contractors moderating your messages? Heck, how secure is Bluetooth? There’s a new vulnerability. Would you want the authorities monitoring your poop thanks to new smart toilets? And a quick word on Solana. Sponsors: UpStart.com/techmeme KiwiCo.com promocode Ride for 50% off your first month Links: ProtonMail logged IP address of French activist after order by Swiss authorities (TechCrunch) How Facebook Undermines Privacy Protections for Its 2 Billion WhatsApp Users (ProPublica) Billions of devices impacted by new BrakTooth Bluetooth vulnerabilities (The Record) TikTok reportedly overtakes YouTube in US average watch time (The Verge) SMARTWATCHES TRACK OUR HEALTH. SMART TOILETS AREN’T TOO FAR BEHIND. (WSJ) Ethereum Rival Solana Climbs to Seventh in Crypto Top 10 (Bloomberg) Learn more about your ad choices. Visit megaphone.fm/adchoices

On April 4th, 2023, around 2 in the morning, a man was found stabbed multiple times on a sidewalk in downtown San Francisco. Hey, who did this to you? What happened next turned the story into a political firestorm. Reports have identified the victim as Bob Lee, the founder of Cash App. From Bloomberg Podcasts, this is Foundering, the Killing of Bob Lee, beginning April 16. Welcome to the TechMeme right home for Tuesday, September 7th, 2021. I'm Brian McCullough today. What does it mean if Proton Mail regularly discloses user data to certain authorities? How private is WhatsApp? If Facebook has more than a thousand contractors moderating your messages, heck, how secure is Bluetooth? There's a new vulnerability that's been discovered in basically every device. Would you want the authorities monitoring your poop, thanks to new smart toilets, and a quick word on Solana? Here's what you missed today in the world of. Tech. Not a good day for the security or privacy-minded. Let's start with Proton Mail, the service lots of folks have used for years to, in theory, do private secure emailing. Proton Mail is under fire

for disclosing a French activist's IP address to Swiss authorities. Proton Mail had claimed to only log IPs, quote, in extreme criminal cases, end quote, but, quoting TechCrunch, Proton Mail, a hosted email service with a focus on end-to-end encrypted communications, has been facing criticism after a police report showed that French authorities managed to obtain the IP address of a French activist who was using the online service. The company has communicated widely about the incident stating that it doesn't log IP addresses by default, and it only complies with local regulation in that case Swiss law. While Proton Mail didn't cooperate with French authorities, French police sent a request to

Swiss police via Europol to force the company to obtain the IP address of one of its users. For the past year, a group of people have taken over a handful of commercial premises and apartments near Place Saint-Marth in Paris. They want to fight against gentrification, real estate speculation, Airbnb, and high-end restaurants. While it started as a local conflict, it quickly became a symbolic campaign. They attracted newspaper headlines when they started occupying premises rented by La Petit Cambodges, a restaurant. A restaurant, that was targeted by the November 13th, 2015 terrorist attacks in Paris. On September 1st, the group published an article on Paris lutes.info, an anti-capital news website, summing up

different police investigations and legal cases against some members of the group. According to their story, French police sent a Europol request to proton mail in order to uncover the identity of the person who created a proton mail account. The group was using this email address to communicate. The address has also been shared on various anarchist websites. Proton Males founder and CEO Andy Yan reacted to the police report on Twitter without mentioning the specific circumstances of that case in particular. Quote, Proton must comply with Swiss law. As soon as a crime is committed, privacy protections can be suspended and were required by Swiss law to answer requests from Swiss authorities, he wrote. In particular, Andy Yan wants to make it clear that his company didn't cooperate with French police nor Europol. It seems like Europol acted as the communication channel between French authorities and Swiss authorities.

at some point Swiss authorities took over the case and sent a request to Proton Mail directly. The company references these requests as, quote, foreign requests approved by Swiss authorities, end quote, in its transparency report, end quote. And that seems to be what's controversial here, quoting from later in the article. According to its transparency report, Proton Mail received 13 orders from Swiss authorities back in 2017, but that had swelled to over 3.5,000, actually 3,572, by the year 2020. The number of foreign requests to Swiss authorities which are being approved has also risen, although not as steeply, with Proton Mail reporting receiving 13 such requests in 2017,

rising to 195 in 2020. The company says it complies with lawful requests for user data, but it also says it contests orders where it does not believe them to be lawful. And its reporting shows an increase in contested orders with Proton Mail contesting three orders back in 2017, but in 2020, it pushed back against 750 of the data requests it received. In the transparency report, the company also signals an additional layer of data collection, which it may be legally obligated to carry out, writing that quote, in addition to the terms listed in our privacy policy, in extreme criminal cases, Proton Mail may also be obligated to monitor the IP addresses,

which are being used to access Proton mail accounts, which are engaged in criminal activities, end quote. It's that IP monitoring component which has caused such alarm among privacy advocates now, and no small criticism of Proton's marketing claims as a, quote, user privacy-centric company. It has faced particular criticism for marketing claims of providing, quote, anonymous email and for the wording of the caveat in its transparency disclosure, where it talks about IP logging only occurring in extreme criminal cases. Few would agree that anti-gentrification campaigners meet that bar, end quote. As Kevin Beaumont tweeted, quote, when services say they don't keep logs, laugh. Businesses are businesses and will business when the police turn up.

end quote. And user rabbit on Twitter tweeted, quote, I don't blame proton mail for complying with a lawful request, but I do blame them for having advertised anonymity features for years they can't ultimately provide legally. And while it may be possible to access proton mail via tour, etc, it's hard to deny they've marketed themselves as an anonymity slash privacy preserving service and have profited from that implication. In the end, a legal company cannot protect you from a legal request if they want to remain legal. End of story. If your threat model involves evading a legal system, a for-profit company is not going to help you, end quote. Meanwhile, a pro-publica investigation has found that Facebook has over a thousand contractors who are actively moderating

WhatsApp messages, including the private messages and media, undermining assurances of WhatsApp's overall privacy. Quote, WhatsApp messages are so secure. Mark Zuckerberg once said, said that nobody else, not even the company can read a word. As Zuckerberg had put it earlier in testimony to the U.S. Senate in 2018, quote, we don't see any of the content in WhatsApp, end quote. WhatsApp emphasizes this point so consistently that a flag with a similar assurance automatically appears on screen before users send messages, quote, no one outside of this chat, not even WhatsApp, can read or listen to them, end quote. Those assurances are not true. WhatsApp has more than a thousand contract workers filling floors of office buildings in Austin, Texas, Dublin, and Singapore,

where they examine millions of pieces of users' content. Seated at computers and pods organized by work assignments, these hourly workers use special Facebook software to sift through streams of private messages, images, and videos that have been reported by WhatsApp users as improper and then screened by the company's artificial intelligence systems. These contractors pass judgment on whether whatever flashes on their screen, claims of everything from fraud or spam to child porn, and potential terrorist plotting, typically in less than a minute. Policing users while assuring them that their privacy is sank or sanked makes for an awkward mission at WhatsApp. A 49-slide internal company marketing presentation from December obtained by

ProPublica emphasizes the fierce promotion of WhatsApp's quote privacy narrative. It compares its brand character to the immigrant mother who displays a photo of Malala Yusuf Sazi who survived a shooting by the Taliban and became a Nobel Peace Prize winner in a slide title, quote, brand tone parameters, end quote. The presentation does not mention the company's content moderation efforts. WhatsApp's director of communications, Carl Woug, acknowledged that teams of contractors in Austin and elsewhere review WhatsApp messages to identify and remove, quote, the worst abusers. But Woug told ProPublica that the company does not consider this work to be content moderation,

saying, quote, we actually don't typically use the term for WhatsApp, end quote. The company declined to make executives available for interviews for this article, but responded to questions with written comments. Quote, WhatsApp is a lifeline for millions of people around the world. The company said the decisions we make around how we build our app are focused on the privacy of our users, maintaining a high degree of reliability and preventing abuse, and quote. This isn't exactly related to all that, but I'll throw it in here. Researchers have uncovered Breaktooth, which I believe is pronounced that way, even though

it's spelled B-R-A-K-T-O-O-T-H, 16 flaws in Bluetooth firmware in system-on-a-chip boards used in billions of devices from 11 top vendors that can allow remote code execution, quoting the record. The vulnerabilities collectively known as Break-tooth allow attackers to crash or freeze devices or, in the worst-case scenarios, execute malicious code and take over entire systems. For their tests, researchers said they only examined the Bluetooth software libraries for 13 system-on-chipboards from 11 vendors. However, subsequent research found that the same Bluetooth firmware was most likely used inside more than 1,400 chipsets used as the base for a wide assortment of devices, such as laptops,

smartphones, industrial equipment, and many types of smart internet-of-things devices. The number of affected devices is believed to be in the realm of billions, but the impact is different based on the device's underlying system-on-a-chip board and Bluetooth software stack. The worst vulnerability part of the break-tooth findings is CVE 2021-28139, which allows remote attackers to run their own malicious code on vulnerable devices via Bluetooth LMP packets. According to the research team, this affects smart devices and industrial equipment built on expressive systems ESP32 system on its chipboards, but the issue is bound to impact many of the other 1,400 commercial products, some of which are bound to have reused the same

Bluetooth software stack, end quote. App Annie says TikTok has overtaken YouTube in the U.S. in terms of average watch time. This is only on Android devices at the moment, but given YouTube's dominance of social video, I thought this was worth noting, quote, in the U.S. BightDances app first overtook YouTube in August last year, and as of June 2021, its users watched over 24 hours of content per month compared with 22 hours and 40 minutes on Google's video platform. In the UK, the difference is even more stark. Tick-Tock overtook YouTube in May last year,

and users there now reportedly watch almost 26 hours of content a month, compared to less than 16 on YouTube. The figures only include viewership on Android phones, however, so may not be representative of mobile users as a whole. But caveats aside, they show the extent of TikTok's meteoric rise over just a few short years and are even more impressive given the three-minute maximum of most of its videos, compared to the 10-minute format preferred by many YouTubers. Not to mention the fact that for much of 2020, TikTok faced continued threats that it would be banned in the U.S. amid chaotic negotiations.

YouTube is still ahead in time spent overall, no doubt because of its 2 billion users compared to TikTok's roughly 700 million. BBC News notes, again, excluding iOS users and users of the app renamed Doyen in China, YouTube is still number one in terms of time spent on Android phones among social and entertainment apps, as of the first half of this year, with TikTok in at number five behind three Facebook apps, Facebook, WhatsApp, and Instagram. Users also spend more money on YouTube than TikTok across both iOS and Android worldwide, excluding Android users in China,

according to App Annie's data, end quote. Researchers are developing smart toilets that can scan urine and feces samples for health data using cameras and machine learning, raising privacy concerns, because, because, well, number one, of course, this is happening. And of course, that does raise concerns. But also, given this year of pandemic and how some localities have already been using wastewater test to determine COVID surges, I mean, everything else is getting smart, right? Why not toilets? Quoting the Wall Street Journal. Researchers and companies are developing high-tech toilets that go beyond adding smart speakers or a heated seat. These smart features are designed to look out for signs

of gastrointestinal disease, monitor blood pressure, or tell you that you need. to eat more fish, all from the comfort of your personal throne. Quote, all of the things that have come with smartwatches and phones, you can imagine that on another scale, says Joshua Kuhn, a bioanalytical chemist at the University of Wisconsin-Madison, and Moorgbridge Institute for Research who published a 2019 study exploring the potential of continuously monitoring a person's health by looking at molecules in their urine samples. You could really start to understand disease risk, he said. Doctors have long used fecal and urine samples for clues to people's health, but there has been a renewed interest in recent years as scientists have begun to better understand how the microbes in our gut influence our well-being. In the COVID-19 pandemic, more communities launched wastewater surveillance initiatives, enabling health officials to hunt for early signs of the virus in cities and neighborhoods and track its spread. Some researchers want to harness that wealth of information on the individual level and have come up with models to peer into the toilet bowl remotely. Some smart toilets are geared toward helping doctors.

doctors monitor patients with chronic conditions or heightened risk for certain diseases, whereas other companies aimed to sell the toilets with price tags in the hundreds or thousands of dollars, directly to consumers as a tool to track or improve their own health and wellness. Researchers at Stanford School of Medicine have outfitted a toilet pole with cameras and trained a machine learning algorithm to analyze the waste against a diagnostic chart. The toilet can also track the flow, color, and volume of urine. It is equipped with a urine test strip, similar to a pregnancy test that detect specific molecules that can provide insight into a person's health.

To tell users apart, the toilet has both a fingerprint scan when a person flushes and a scan of their, well, in our house we call it Dupa's characteristics, or essentially a Dupa print. The Stanford team has signed an agreement with Aizen, a Korean toilet maker, to manufacture the toilet. They hope to have working prototypes that can be used in clinical trials by the end of this year, says Sungmin Park, who leads the project, which was started by Sanjeev Gampir, the former chair of Radiology at Stanford who died in 2020. Another prototype smart toilet developed at Duke University also deploys cameras and machine learning to analyze waste after it has been flushed.

It uses other sensors to capture consistency, presence of blood and specific proteins, and extracts a small vial of stool that can be shipped off to a lab for further analysis. The smart toilet, along with others in development, is designed to connect with an app on a person's phone. Quote, you could get personalized alerts for having more fiber or avoiding certain foods to avoid flare-ups, says Sonia Grago, founder of the Duke Smart Toilet Lab, and Copra Inc., a startup that she and two other team members launched in 2021 to commercialize the technology. A remote smart toilet could help doctors monitor patients with chronic conditions such as irritable bowel syndrome or spot early signs of disease, says Dr. Grego. Another plus is that it could allow for frequent

measurements that can be tracked over time, which could be more effective, non-invasive ways to track certain metrics, and quickly identify and flag changes, then sporadic readings during a doctor visit. Quote, what your blood pressure is at 2 p.m. on a Tuesday doesn't matter. To get that information with real trends behind it is super valuable, says Austin McCord, the chief executive of Cassana, a home health monitoring startup working on a toilet seat that can measure vital signs including blood pressure, blood oxygen levels, or heart rate. The company said in February that it had raised $14 million in Series A funding and is working toward getting clearance from the Food and Drug Administration for the seat to measure a handful of vital signs, Mr. McCord says, and

quote. Now, normally I would have ended the show with that last segment, but I wanted to squeeze this in as well for reasons that I'll explain at the end of the show. According to Coin Gecko, Solana's S-O-L token, I'm assuming it's pronounced Sol, has more than tripled in value over the last three weeks, and has a greater than $45 billion market cap, making it the seventh most valuable cryptocurrency all of the sudden, quoting Bloomberg. Solana has a growing ecosystem, projects are being built on it, and it's benefited hugely from the mania that's taking place in NFTs. And Tony Trenchev, co-founder at Cryptolender Nexo, wrote in an email.

NFTs are non-fungible tokens used to trade digital collectibles. He said the backing of crypto figure Sam Bankman-Fried, chief executive of Crypto Exchange FTCX, is also helping. Solana bills itself as the world's fastest blockchain and its website says the average cost per transaction is 0.0025 cents. In June, it announced that it had raised $314 million in a funding round with investors including Bankman Freed's Alameda Research, venture capital firm Andreson Horowitz, Pollychain Capital, and Coin shares. Major players in the space, such as FDX and Jump are recognizing its potential, says Alexander Clark, sales trader at UK-based digital asset broker Global Block in an email Monday.

Quote, not only that, but with the networks foray in NFTs with Solenart, the marketplace built on the Seoul blockchain, has been instrumental in driving the altcoins price higher, she said. Seoul's current price rally is likely to continue, end quote. Yes, Solana has been the talk of the crypto world in the last month or so, along with the surge of NFTs, and probably directly related to that surge. it's all about the volume of transactions Solana can do per second, which is way more than Ethereum and for way less cost. As an example, I sold another one of my first podcast episode NFTs last week

for about $150 worth of crypto, but after I completed the transaction with all the fees, I ended up with $110 worth of crypto. So I lost money selling my NFT. You know, eliminating those sorts of fees is what has everybody excited about Solana. But also, I'm bringing this up because, well, hold on a second. I mentioned Solana for the first time on this show on June 9th of this year, when they raised $314 million in new funding led by Andreson Horowitz and Polly Chain. I thought the whole thing sounded interesting, so I went ahead and bought a thousand bucks worth of Solana coins for myself on June 18th. As I said, this is the year I got the investment fever again. So, it's not like my thousand dollars is worth me doing some sort of financial disclosure or something

about Solana, even though it is about to 5x, my investment. I have a piece of Solana, but you know, it's such an infinitesimally small part of the project. So no big deal, right? But that does bring up a point some of you brought up to me over the weekend. Brian, this ride home rolling fund, if you invest in startups and they become newsworthy, what will you do then? Well, we'll cross that bridge when we come to it. But even if the fund, is wildly successful and we invest in, say, the new Uber, it would be years before that company would be important enough for us to talk about on this show. And even when we did, I guess I'd just be upfront about it and be like, hey, remember the Ride Home Fund was an investor in this company's

Series A or something like that. But again, if that were to ever come to pass, it would be half a decade or more, most likely before we'd even have to think about that. If you didn't listen to Sunday's announcement episode about the Ride Home Fund and how maybe you too could invest in it. Please do listen to that because I explain all this in greater detail. It's the second episode before this one. But one point I want to underline this fund is a side gig only. Like maybe I'll do episodes about it if you all are interested in behind the scenes of how a fund works, how it launches. Maybe I'll share quarterly fund memos if people find that interesting. But it's not going to take over the show. Like if you want to invest along with me, great. If not, for the vast majority of you,

this might be the last time you ever hear of the fund. Side gig, folks. So no worries. This show is always about the news first and foremost, and I just started investing again because doing the news every day for three years kept giving me access and early info on so many things like Solana that I just couldn't help myself. But it's a side show. The main show here will always be the news and delivering it to you as neutrally as I can.

Talk to you tomorrow. Thank you.