Telecomix support, كشرى addict, IT, collaborate with Journalists & activists, co-founder @N0thing2hide
France
Joined February 2010
- Tweets109K
- Following5.9K
- Followers5.2K
- Likes17.8K
fo0 retweeted
Attac suggère de ne plus verser d'aides publiques aux entreprises qui pratiquent l'évasion fiscale.
Budget : Le président du Medef suggère de ne plus rembourser les petits arrêts maladie dlvr.it/TVbG1G
fo0 retweeted
L'IA, menace pour les métiers de la presse écrite. Son déploiement sert de prétexte pour supprimer des postes dans un secteur déjà fragilisé par le numérique. Correction, vérification, mise en page, mais aussi dans les rédactions. mediapart.fr/journal/culture…
fo0 retweeted
Je ne m’en lasse pas!!
En plus venant d’une Russe, cela va en faire suer plus d’un au RN!!
La vidéo que JordÂne refuse de visionner…🤭🤭🤭🤭
fo0 retweeted
Oui. D’ailleurs, @PoliceNationale , n’hésitez pas à vous pencher sur le dossier des milliers de messages de mort, de viol et autres que je reçois et je ne suis pas la seule depuis des mois à cause de pages comme celle-ci qui alimente la haine et en fait son buisness, où aucune modération n’est faite, simplement parce que j’ai osé dire que le racisme est un délit . Voici l'echange qu'on a eu en juillet qu'il ne semble absolument pas respecter.
fo0 retweeted
There's a reason the privacy community doesn't recommend NordVPN. Here's why.
NordVPN markets "Panama jurisdiction" for privacy. The documented reality is more complicated.
Corporate structure: Co-founders Tomas Okmanas and Eimantas Sabaliauskas also founded Tesonet, a Lithuanian startup accelerator. Court documents from Luminati v. Tesonet explicitly identified "Tesonet's VPN service called NordVPN." Operations center on Vilnius, Lithuania (EU jurisdiction). Parent company Nord Security is Netherlands-registered. Panama holds the trademark.
Tesonet's portfolio includes Oxylabs, a major proxy and web scraping service. Data extraction business under the same roof as a privacy VPN.
2018 breach: Server in Finland compromised via exposed iLO remote management. Attacker got root access, TLS keys, OpenVPN CA key. Disclosed October 2019 only after @hexdefined forced it on Twitter. 19-month delay. They knew for over a year and said nothing while millions of users routed traffic through a compromised server.
Kenn White (Open Crypto Audit Project): "The Nord VPN not-a-hacker had full remote admin on their Finland node LXC containers. That's God Mode folks. And they didn't log and didn't detect it."
From their own privacy policy: A/B price testing data collection admitted. Billing data retained 10 years. AppsFlyer for marketing/analytics. Device identifiers for "marketing or analytics purposes."
Regulatory pressure: UK ASA ruled ads misleading twice (2019, 2023). First for exaggerating WiFi threats, second for "switch off malware" claim. Multiple US class actions allege deceptive auto-renewal and charging 14 days early.
Affiliate ecosystem: When every "unbiased" review ranks them #1, follow the money. Nord offers 100% commission on first-month signups, 40% on longer plans. You're reading ads, not reviews.
fo0 retweeted
‼️A German hacker known as "Martha Root" dressed as a pink Power Ranger and deleted a white supremacist dating website live onstage
This happened during the recent CCC conference.
Martha had infiltrated the site, ran her own AI chatbot to extract as much information from users as possible, and downloaded every profile. She also uncovered the owner of the site. She has published all of the data.
fo0 retweeted
Geek tip from the Tuta Team: How NOT to see AI images.
Use this HUGE AI BLOCKLIST for uBlock Origin: github.com/laylavish/uBlockO…
Enjoy your holidays. 🎉
fo0 retweeted
🚨 ALERTE FUITE DE DONNÉES – ACCÈS LIVE BDD MONDIAL RELAY
Un accès direct (LIVE ACCESS) à la base de données Mondial Relay a été proposé à la vente en ligne.
Les captures montrent un accès fonctionnel aux interfaces internes de suivi logistique, sans anonymisation. (décembre 2025)
👉 Il ne s’agit pas d’un simple leak statique, mais d’un accès actif à des systèmes internes.
📂 Données exposées via l’accès
• Identités complètes des destinataires (nom, prénom)
• Adresses postales précises
• Numéros de téléphone
• Adresses e-mail
• Numéros d’expédition et de commandes
• Statuts de livraison détaillés (dates, heures, lieux, points relais)
• Historique logistique complet par colis
• Interfaces internes de gestion et de recherche avancée
⚠️ Risques majeurs
➡️ Atteinte grave à la vie privée des clients
➡️ Phishing et arnaques ultra-ciblées (SMS / e-mail / faux avis de livraison)
➡️ Fraudes à la livraison et détournement de colis
➡️ Repérage physique des destinataires et points relais
➡️ Exploitation industrielle des données (scraping massif)
🧩 Cause probable
➡️ Mauvaise sécurisation d’un accès interne
➡️ Identifiants compromis ou absence de contrôle d’accès renforcé
➡️ Manque de segmentation et de journalisation des accès
🔒 Un incident critique, impliquant un accès non autorisé à des données personnelles à grande échelle, soulevant de lourdes questions de sécurité des systèmes, gouvernance IT et conformité RGPD.
fo0 retweeted
🚨 On vient de nettoyer plusieurs VPS compromis via l'exploit Next.js RCE.
On a donc recensé tout ce qui était compromis, installé sur les machines, et nettoyé l'intégralité de celles-ci
Voici EXACTEMENT ce que les hackers installent sur vos serveurs et comment vous protéger 👇
fo0 retweeted
Polish police detained three Ukrainians with professional hacking equipment: FLIPPER, spy detector, antennas, laptops, SIM cards. Charges include attempted damage to IT data critical for national security. Suspects couldn't explain equipment's purpose (when asked, they suddenly "forgot" how to communicate in english language). The likely goal was close-access cyber operations.
fo0 retweeted
Pour les amateurs de Pixels qui n'ont pas encore switch sur @GrapheneOS ⬇️
cert.ssi.gouv.fr/avis/CERTFR…
fo0 retweeted
Holy shit… the exploitation of CVE-2025-55182 has reached a new level. There’s now a publicly available Chrome extension on GitHub that automatically scans for and exploits vulnerable sites as you browse. Absolutely wild. 🤦♂️
fo0 retweeted
What I Found Extracting My Own Twitter Logs
Let me show you something most people have no idea is even possible but it actually is.
During a forensic extraction I performed on my own device, something interesting happened again:
every single application log was pulled out including X(Twitter).
But today, let’s focus on just X(Twitter), because what I found is wild.
Inside the analyzed folder of the Twitter logs, the extraction revealed numerous posts I made on X(Twitter) that contained images or videos specifically those created on the same device being examined.
I’m not talking about just seeing the media.
I’m talking about pulling out the full file itself plus every tiny detail attached to it:
•The exact image/video file
•File name
•Original file path
•Size of the media
•Date created
•Date modified
•Date accessed
•Width & height of the media
•File format
But here’s the part that stood out the most…
I checked the Date Created of few of the extracted files, then opened my Twitter profile to compare.
The date and time the file was created in the report matched the exact date and time I posted it on Twitter.
That means:
•Even if you delete the original file
•Even if you clear your gallery
•Even if you wipe your Twitter drafts
The logs still quietly store traces that link your posts to the exact moment and media used to create them.
This is huge for digital forensic investigators.
Why?
Because:
•It verifies whether a post was genuinely made by the device owner
•It shows exact timestamps without relying on what’s visible on Twitter
•It retrieves original media details, even when the user thinks they deleted them
•It helps confirm device ownership, intent, and timeline reconstruction
And remember, this was pulled only from application logs, and not device media folders because I delete these media as soon as I make these posts to save space.
I added screenshots and a video screen recording showing:
1️⃣ The extracted media file with its original creation timestamp
2️⃣ My Twitter profile showing the post date both matching perfectly.
People really underestimate how much their apps silently record.
If your device ever finds itself in a forensic lab, your digital footprints will speak louder than you think.
Follow @elormkdaniel for more
fo0 retweeted
Privacy nightmare in the making:
India's 🇮🇳 DoT just ordered Apple to pre-install an undeletable 'state security app' (Sanchar Saathi) on all new iPhones sold there, plus push it to existing ones via updates.
Officially for tracking lost/stolen phones, but it's basically gov't surveillance baked in.
This follows a recent directive that requires messengers to link accounts to SIM cards. People will not be able to run messengers without the SIM card with which they registered.
fo0 retweeted
Pour des pommes de terres et du fromage mdrrrrrrr
Sans intention de vous manquer de respect 🙏, il devient indispensable de se demander où notre société française 🇫🇷 a échoué pour en arriver à une situation où des millions de Français issus de l’immigration maghrébine, comme vous, affichent pareillement des revendications aussi clivantes. Le poids du nombre a sans doute fini par donner à beaucoup d’entre vous la conviction d’être dans le vrai, parfois même d’être dans une position majoritaire, et qu’il n’était alors plus nécessaire de s’assimiler à une autre culture ou d’embrasser les valeurs fondatrices du pays où vous vivez aujourd’hui 🤔. Cet environnement socioculturel, autant familial qu’urbain, vous a souvent encouragés dans ce non‑choix, que ce soit à travers le soutien d’acteurs politiques comme LFI ✊, ou même par la complicité ou la passivité des partis dits du « bloc central » 🏛️, devenus experts en renoncements.
Les médias « mainstream » 🗞️ ont aussi joué un rôle prépondérant : ils ont contribué à forger une image de vous comme des Français systématiquement défavorisés par le système, persuadant une bonne partie de l’opinion que chaque difficulté rencontrée devait être lue à travers le prisme d’un soi-disant « racisme systémique ». Cela a largement facilité l’appropriation généralisée du discours victimaire 😔, parfois au détriment d’une réflexion individuelle sur la capacité à s’émanciper et à se saisir de son destin ⚙️. Plutôt que d’ouvrir les yeux sur l’opportunité immense d’être français 🇫🇷 et d’y voir une richesse, vous choisissez, consciemment ou non, de « halaliser » la France 🕌, d’enclaver votre trajectoire dans des marqueurs identitaires dépassant le seul cadre religieux mais qui radicalisent le débat.
Ce combat est une impasse ⚔️, il détourne du vrai enjeu. Même face aux « fachos » qui vous répondent sous ce tweet, il faudrait voir parfois des mains tendues 🤝 : il y a des appels au dialogue qui ne sont jamais entendus, et un dialogue qui ne se fait plus. Or, le plus inquiétant, c’est que vous êtes très nombreux à raisonner ainsi 😞, et qu’en continuant dans cette voie – en s’obstinant dans ce repli idéologique et dans cet endoctrinement religieux – vous êtes en train de faire resurgir un racisme réel et décomplexé dans toute la société française 🔥.
Notre message, au fond, se veut aussi une alerte et un vœu : sauvez-vous, ne restez pas prisonniers d’un déterminisme victimaire ni d’une logique communautaire excluante. Devenez enfin pleinement FRANÇAISES 💙🤍❤️, non pas pour effacer qui vous êtes, mais pour élargir la seule identité qui puisse vraiment rassembler tous ceux qui aiment la France.
fo0 retweeted
Je ne suis pas toujours impressionné par ce que fait la SNCF.
Et parfois, ils arrivent à casser grep,
sur du windows,
sur un afficheur en gare,
avec un message d'erreur.
Et là je suis, wow
fo0 retweeted
Here's another French journalist participating in fearmongering about GrapheneOS. That article is not measured. It provided a platform to make both unsubstantiated and provably false claims about GrapheneOS while providing no opportunity to see and respond to those claims.
bsky.app/profile/gabrielthie…
The claims the article platforms are conflating closed source products from European companies infringing on our copyright and trademarks with GrapheneOS. GrapheneOS doesn't have the features they claim it does, isn't distributed in the ways they claim and they don't understand open source software.
GrapheneOS is obtained from grapheneos.org/install/web and grapheneos.org/releases. There are a bunch of legitimate companies in Europe selling devices with real GrapheneOS including NitroKey. We aren't partnered with those companies and don't get funding from it but there's nothing shady about it.
Products using operating systems partially based on our code are not GrapheneOS. There's no such thing as a fake Snapchat app wiping the device in GrapheneOS. It has no remote management or remote wiping built into it. It does not have a subscription fee / licensing system built into it either.
Vast majority of the code for those products comes from elsewhere: Android Open Source Project, Linux kernel, Chromium, LLVM and other projects. Of course the non-profit open source project writing a small portion of the code being used by those companies being targeted rather than IBM, Google, etc.
Both Android and iOS try to defend users from the same attack vectors we do. We developed far better protections against exploits which we release as open source code. Open source means anyone can freely use it for any purpose, exactly like the Android Open Source Project used by GrapheneOS itself.
Open source is why we can build GrapheneOS based on the Android Open Source Project. It doesn't make Linus Torvalds, IBM, Google, etc. responsible for what we do. Similarly, others can make their own software based on GrapheneOS. A fork of GrapheneOS contains a small portion of code written by us.
France supposedly has a right to reply which we intend to exercise to respond at length to these articles containing libel from the French state.
We're going to be ending the small amount of operations we have in France as we don't feel the country is safe for open source privacy projects anymore.
GrapheneOS doesn't host services storing sensitive user data. We have signature verification and downgrade protection for updates to the OS, apps and app store metadata. We're going move our website and discussion server away from OVH. Our update mirrors and authoritative DNS are already elsewhere.
Our discussion forum, Matrix, Mastodon, etc. in OVH Bearharnois can be moved to local or colocated servers in Toronto instead. We can use Netcup (owned by Anexia, both German) as one of the main providers for website/network service instances. The majority of our servers are already not on OVH.
We won't travel to France including avoiding conferences and will avoid having people working in the country too. A simple heuristic for the EU is avoiding countries supporting Chat Control. We genuinely believe we cannot safely operate in France anymore as an open source project privacy project.
Our pinned post on this platform shows a great example of why they're actually upset with us:
xitter.cf/GrapheneOS/status/1887…
It almost makes us willing to contribute to AOSP again to try to wipe out their ability to exploit a subset of unon-GrapheneOS Android devices too. Google is welcome to reach out.
In April 2024, Pixels shipped a partial implementation of our January 2024 proposal for firmware-based reset attack protection. Fastboot mode now zeroes RAM before enabling USB. This successfully wiped out the After First Unlock state exploit capabilities of two commercial exploit tools.
Several other improvements were made based on our January 2024 vulnerability reports and proposals including an implementation of wiping data before rebooting when a wipe is triggered. We shipped an improved version of this for our duress PIN/password feature before the feature shipped for Android.
We made massive improvements in GrapheneOS to defend against these attacks since January 2024.
For ARMv9 devices, we greatly improved our hardware memory tagging implementation in hardened_malloc, deployed it for the Linux kernel allocators and greatly expanded the use of PAC and BTI across the OS.
We replaced our decade old feature for blocking new USB peripherals while locked with a greatly expanded and far more secure feature. The new approach blocks USB-C connections and USB-C data at a hardware level with expanded software-based blocking as a fallback (grapheneos.org/features#usb-…).
We started deploying RANDSTRUCT for the kernel, which will eventually be used to have multiple possible struct memory layouts for each device model chosen randomly at boot. Our work on reducing kernel attack surface also continued. We plan to focus more on Linux kernel security going forward.
Our locked device auto-reboot feature from 2021 was replaced with a more secure approach preventing bypasses via crashes (grapheneos.org/features#auto…). It also avoids chain reboots without introducing a security weakness which makes low timer values such as the minimum 10 minutes far more usable.
We shipped our 2-factor fingerprint unlock feature planned since 2015 (grapheneos.org/features#Two-…). It allows people to avoid reliance on secure element security with a strong passphrase while keeping convenience. Fingerprint + scrambled PIN also defends well against being recorded unlocking.
Several more major improvements specifically against the physical data extraction attack vector are planned. Our next release adds an implementation of zeroing RAM at boot in the kernel to match what fastboot mode does. We also plan to add a toggle for essentially toggling off Device Encrypted data.
fo0 retweeted
GrapheneOS qualifié de "botte secrète des narcotrafiquants" dans un article à charge qui mélange tout afin de faire du titre et du buzz, de même qu'Internet est un repaire de pédonazis. GrapheneOS est, en fait, simplement un Android dé-googlisé et sécurisé, et ça semble déplaire.
Et après, on s'étonne de la perte de crédibilité des médias : grapheneos.social/@GrapheneO…
@LeParisien_75