A share link keeps working until you delete it, so a file you sent once can still be opened by anyone who has the URL.

Dropbox (web)

1. Log in at dropbox.com and click Shared in the left sidebar (it's under More if you don't see it).
2. Click ... next to an item, then Share.
3. Click the settings gear, pick Link for viewing or Link for editing, then Delete link and Delete.

OneDrive (web)

1. On onedrive.com, click Shared in the left pane.
2. Select an item, open Details, then Manage access.
3. Click Stop sharing, or remove a single link from the Links tab.

Proton Drive (web)

1. Open the Shared tab at drive.proton.me/shared-urls.
2. Select an item and click Stop sharing. That kills the public link and email invites too.

It's about 5 minutes unless you share a lot. To check, open an old link in a private window. Dropbox says a deleted link just shows an error.

On OneDrive you need to be the file owner. On Dropbox, you can only delete links you didn't create if you have edit access. Deleting a link only changes who can open it from now on. The file still sits on your provider's servers, and anyone who already downloaded it keeps their copy.

Sources

• Dropbox Help: unshare files and folders: Dropbox steps, deleted links stop working, edit access rule
• Microsoft Support: manage sharing in OneDrive: OneDrive steps, owners can stop sharing
• Proton Support: Proton Drive for web: Shared tab, Stop sharing
• Proton Support: managing access to shared files: Stop sharing removes link and invites, Editor default, password and expiry

It comes down to who you're worried about. Big tech inboxes are free and work with everything, but your mail sits with a company whose business isn't privacy. With Proton and Tuta, you're trusting their apps and their jurisdiction instead. Smaller paid providers sit in between. Self-hosting cuts out the middleman, and deliverability and outages become your problem.

Vote for what you use today, then explain your pick in the comments. Ad tracking and a court order aren't the same problem, so say which one you're planning around.

View Poll

On Tuesday, September 29, EU negotiators held their sixth trilogue on the Child Sexual Abuse Regulation, the permanent law everyone calls Chat Control 2.0. There's still no full deal. They tentatively agreed on rules for scanning publicly accessible content, but orders for private content are still unresolved.

The public part only stands if the whole law gets agreed. Technical talks on private detection run through October, and Patrick Breyer, who campaigns against the law, expects the next trilogue in November.

Public detection orders won't need a court. Administrative authorities could order any hosting provider, whatever its size, to scan all public uploads for known abuse material. That's social media and cloud services too. The planned EU Centre would search public content itself and pass what providers report on to authorities. That's how Javier Zarzalejos, the Parliament's lead lawmaker on the file, described the tasks agreed on Tuesday.

Chat Control 1.0 stays in force until April 2028. Under it, messaging and webmail providers can choose to scan messages, but end-to-end encrypted chats are excluded. Wire points out that Telegram's default cloud chats aren't end-to-end encrypted, so they can be scanned.

For you, nothing about private messages changes today. What you post publicly, public cloud links included, is what the new orders would cover. For private chats on a service that can read them, an app with end-to-end encryption on by default keeps them out of 1.0's scope. It only works if the other person uses the same app, and afterwards the content is readable on your device and theirs, not on the server. The Council has also said that exemption is no promise for 2.0.

Both sides have a real case. The Commission says reports of new abuse material are over 200 times higher than three years ago, mostly because of AI. Breyer points to German police data: more than half of investigations under the voluntary system target minors themselves, and 75% of flagged chats aren't actionable.

The Parliament wants private chat scanning limited to people already linked to abuse. The Council proposed letting providers scan under a search plan that goes ahead unless an authority vetoes it. If there's a deal in November, which of those two should it be built on?

Sources

1. MLex: talks advance on public content searches: tentative deal on public content, private orders unresolved
2. Patrick Breyer: trilogue update: public order rules and what each side wants
3. MLex: Zarzalejos on the EU Centre: what the EU Centre will do
4. Wire: Chat Control in 2026: Chat Control 1.0 scope and the Commission's numbers

On September 28, 2026, California's governor vetoed state legislation that would've banned companies and data brokers from selling sensitive personal data. The blocked bill targeted precise geolocation records and sensitive tracking details collected across mobile applications. It's a major regulatory decision that keeps commercial data markets operating under existing rules.

Here's three concrete facts showing what this decision means in practice.

First, Consumer Reports actively supported model legislation like the State Location Privacy Act to halt the commercial trade of precise GPS coordinates. They argued that users shouldn't have their physical movements bought and sold without strict statutory prohibitions.

Second, without a statutory ban, third-party data brokers can keep buying raw movement logs from mobile app developers and reselling them. These datasets aren't restricted to broad neighborhood zones, so commercial buyers can easily reconstruct detailed daily routines.

Third, regulatory oversight remains anchored to the California Consumer Privacy Act. That framework doesn't stop data transfers upfront, meaning companies can legally monetize sensitive files until an individual manually submits a formal opt-out request.

For everyday readers, it's clear your physical location stays available to commercial aggregators by default. If you don't actively adjust your device settings, SDKs embedded inside common mobile apps can harvest your daily coordinates and feed them into data marketplaces. Taking back control on your own hardware isn't instant, but it lowers your exposure significantly. You can review your phone's privacy settings right now and revoke background location permissions for every app that doesn't require live navigation.

You can also use state data broker registries to submit opt-out requests directly to primary brokers. That stops secondary reselling across advertising networks, but it doesn't change what primary collectors collect. Your cellular carrier and app publishers can still see your location whenever you're active online.

If opt-out mechanisms leave the primary burden of protection on individual users, it isn't clear whether market self-regulation can protect personal safety. Should governments enact total statutory bans on trading sensitive location data, or is an opt-out model the proper standard for digital commerce?

Every "Sign in with Google" click or OAuth authorization gives a third-party app a standing token to your account. These tokens stay valid until you revoke them, and if that app's backend gets breached, your access token goes with it. Most people have dozens from apps they tried once and forgot.

Google

1. Go to myaccount.google.com/connections
2. Review every app listed, especially ones with Gmail or Drive access
3. Remove anything you don't recognize or haven't used in months

GitHub

1. Settings → Applications
2. Check both the "Authorized OAuth Apps" and "Authorized GitHub Apps" tabs
3. Revoke anything stale, prioritizing apps with repo write access

Discord

1. User Settings → Authorized Apps
2. Deauthorize bots and games you no longer use

Reddit

1. Go to reddit.com/prefs/apps
2. Under "authorized applications", revoke old third-party clients and tools
3. "Reddit on mobile web" can't be revoked. It's first-party and listed on every account, so leave it.

Rule of thumb: if you don't remember what it is or why it needs access, revoke it. Worst case, you re-authorize it the next time you actually use it.

What's the oldest or weirdest app you found still connected?

Each 2FA method protects against a different failure. SMS codes fall to SIM swapping and number porting. TOTP stops credential stuffing, whether it lives in a standalone app or a password manager, but a proxy page can still phish it in real time by relaying the code. FIDO2 keys and passkeys are bound to the site's origin, so a lookalike domain gets nothing. The weak point moves to recovery instead: a lost key with no backup, or a passkey locked to a single device or sync provider.

The recurring argument is about keeping TOTP inside the password manager. That gives you one vault and fewer moving parts. Keeping it separate gives you two factors that survive a vault compromise independently. Neither choice is wrong. It depends on whether your realistic threat is a breached vault, a phishing page, or losing your phone. Vote for the method you use on your most important account, which is usually email. Then say in the comments which threat that choice is built around, and what your recovery plan is if the factor disappears.

View Poll

If you still give your real email address to every shop, newsletter and "free trial" out there, this one's for you.

Email aliases are probably the best effort-to-payoff privacy upgrade you can make. Every site gets its own address. When one starts getting spam, or shows up in a breach, you switch it off and move on. Your real inbox never leaks.

The two open-source names that come up in every thread are SimpleLogin and addy.io (formerly AnonAddy). At the top tier they cost almost exactly the same. They're still built for pretty different people, so here's how they actually compare.

SimpleLogin

Proton bought SimpleLogin in 2022, and that shapes almost everything below.

Where it shines

• The free plan lets you reply from an alias and has unlimited bandwidth. That sounds minor. It isn't, because addy.io's free tier can't reply at all.
• Premium now includes Proton Pass premium features: vault sharing, a built-in 2FA authenticator and dark web monitoring. If you were going to pay for a password manager anyway, the value is a bit ridiculous.
• If you cancel, the aliases you already created keep sending and receiving normally. You just can't create new ones past the free limit. This matters more than people realize.

Where it gets annoying

• The free plan caps you at 10 aliases. If you take aliasing seriously, you'll hit that within a week.
• PGP encryption of forwarded mail is on the Premium list.
• There's no family plan. They offer a 30% discount on additional subscriptions if you contact support.
• You're putting one more egg in the Proton basket. For some people that's the whole appeal. For others it's a single point of failure.

It's run by Will Browning, a UK web developer. It has no venture capital, so it runs on subscriptions, not ads or data sales.

Where it shines

• The Lite plan is $1/month, billed yearly, and includes a custom domain, 5 recipients and 50 replies/sends per day. Nothing cheaper gets you your own domain.
• Even the free plan gives you unlimited standard aliases.
• You can add your own GPG/OpenPGP key per recipient, which encrypts every forwarded message. You can even hide the subject line. This is great if your real inbox is Gmail or Outlook and you'd rather Google didn't read your receipts.
• It's new this month: on Lite and Pro, addy.io strips known tracking pixels from forwarded emails, so senders can't tell when you opened them. It's on by default.
• Duo and Family plans launched in August. One person pays and everyone gets full Pro on their own account.

Where it gets annoying

• Replying and sending from aliases aren't included in the free plan. The free 10MB monthly bandwidth works out to roughly 140 emails.
• "Standard" aliases all look like anything@yourname.addy.io. If you don't want anyone linking your aliases together, you need random aliases on shared domains, or you can split them across extra usernames. Shared-domain aliases are limited on Free and Lite.
• Cancelling hurts more here. Custom domains and extra usernames get deactivated, and so does any shared-domain alias past 10. Resubscribing within 90 days reverts all of that automatically.
• Bus factor. It's one person. He says someone is in place to keep the servers and domains running if he's gone. That's more than most indie projects offer, but it's still one person.

Jurisdictional security

One caveat first, because most comparison posts skip it. An alias service is a middleman by design. Mail comes in, gets spam-filtered and gets forwarded. Unless you use PGP, the provider can technically see the content. That means jurisdiction matters more here than people assume.

SimpleLogin: It moved its legal domicile to Switzerland in January 2024. Switzerland's privacy-haven image has taken some hits, though. A proposed revision of the OSCPT surveillance ordinance would require services with 5,000+ users to identify users and keep that data for six months, and to decrypt communications on request where they hold the keys. In response, Proton said it's moving most of its physical infrastructure out of Switzerland, in phases. Worth keeping an eye on.

addy.io: The operator is in the UK, which isn't exactly known for restraint on surveillance. The data itself sits elsewhere, though. The main server is with Greenhost in Amsterdam, and the backup mail server is with UpCloud in Warsaw.

Both are open source and self-hostable. If jurisdiction is your top concern, self-hosting is the real answer.

Pricing (as of September 2026)

• SimpleLogin: Free, or Premium at $36/year or $4 billed monthly. Premium gets you unlimited aliases, unlimited custom domains, catch-all and unlimited mailboxes.
• addy.io: Free, Lite at $1/month billed yearly, or Pro at $3/month billed yearly ($4 monthly). Pro adds 20 custom domains, unlimited shared-domain aliases and unlimited bandwidth.
• addy.io households: Duo is $4.50/month billed yearly for 2 people. Family is $7.50/month billed yearly for 5.

At the top tier they cost the same. Where they differ is the entry price and what happens when you stop paying.

So who is each one actually for?

Go SimpleLogin if you're already in the Proton ecosystem, you want to reply from aliases without paying, or you want your aliases to keep working if you ever cancel.

Go addy.io if you want the cheapest possible custom-domain setup, your main inbox is Gmail or Outlook and you want PGP on everything that lands there, or you're sorting out a whole household.

Go neither if you live fully in Apple land and just want zero friction. Hide My Email is already part of iCloud+. You get less control, but it takes no setup.

My take: for someone starting from scratch, addy.io Lite at $12/year is hard to beat. If you touch Proton at all, SimpleLogin Premium is basically a free password manager upgrade.

What are you running, and has either one ever silently eaten an email on you?

The Committee to Protect Journalists report shows a brutal reality for journalists: state actors do not need expensive spyware to burn confidential sources anymore. Commercial data brokers sell location feeds scraped directly from ordinary mobile apps. A Belgian newsroom proved this by grabbing a free broker sample and tracking a colleague's physical movements over two weeks. A German reporter found his own historical coordinates in a commercial dataset just because he enabled location on a weather app.

When a reporter meets a source in secret, their mobile advertising ID (MAID) broadcasts GPS coordinates through embedded SDKs and real-time bidding auctions. Foreign governments or local police buy these datasets legally off the shelf. They cross-reference the device pinging outside a whistleblower's home with the device pinging at a news office. The pseudonymous ad ID gets mapped to a real name in minutes.

The risks go way beyond simple leak hunting. In high-conflict zones or repressive regimes, this telemetry gives hostile agencies exact physical targets. An arrest or physical harassment of a source often starts with an automated location hit bought from a commercial broker. When state actors track a reporter's daily route, they can intercept them or threaten their families without ever hacking a phone.

Standard browser extensions do not stop mobile app background noise. If an app runs third-party ad SDKs, location data exits the device long before any banner renders. Zeroing out location permissions and resetting Advertising IDs at the OS level matter far more than browser tweaks. Combining that with network-wide DNS filtering like NextDNS is the minimum baseline.

Are newsrooms actually training reporters on mobile SDK telemetry, or are they still pretending a browser plugin solves this? 

Source: Committee to Protect Journalists, link in comments.

Tuta announced an official Nextcloud plugin at the conference in Berlin (link in comments). The setup lets you handle Tuta email directly inside your Nextcloud dashboard while Tuta manages the encrypted mail backend.

Combining external mail hosting with a self-hosted cloud hub is a logical compromise. You skip the endless hassle of maintaining IP reputation and mail queues, yet you still keep your daily workspace unified on hardware you control.

My concern is purely practical. Nextcloud integrations have a bad habit of adding unnecessary PHP overhead and lag for what usually ends up being a basic iframe or API wrapper. If you already run a standalone desktop client, putting another email tab inside your browser session feels completely redundant.

Has anyone here tested the early integration build yet? I want to know if it actually runs lean or if it slows down your instance during heavy syncing.

A US town just scrapped its Flock Safety contract over privacy complaints, which almost never happens. Once license plate readers go up, vendor lock-in usually keeps them running forever. The contract renews, the cameras multiply, and nobody revisits the decision.

And the scale is wild: 10 cameras, 2.2 million database hits in one year. That's not "catching stolen cars." That's a searchable log of everyone who drove past.

But pulling the hardware fixes less than you'd think.

Flock isn't a set of standalone cameras. It's a shared network. Neighboring agencies can search your town's scans, and every search is a chance for data to leave the system: exported into a case file, attached to a report, saved to someone's local drive. Flock's default retention is 30 days, but that only covers what's still sitting in Flock's cloud. Once a record gets pulled into another agency's systems, it follows their retention rules, not yours.

Then there's everything around the data. Backups. Audit logs of who searched what. Analytics and "insights" built on top of the raw scans. Does a canceled contract wipe all of that, or just the live database?

Anyone who's managed a SaaS contract knows how hard it is to get a real data wipe out of a vendor, and how much harder it is to prove it happened. You usually get a polite email saying "your data has been deleted" and that's it. No logs, no scope, no way to check. A small town with one IT person has no way to audit backups, exports, or search histories on someone else's servers.

So the cameras are gone. The data trail probably isn't.

If your town is looking at doing the same, the time to push is before the contract ends: demand a written deletion certificate that covers backups and derived data, and file a records request for the network search audit logs so you know which other agencies accessed your scans.

Has anyone gotten actual deletion confirmation from an ALPR vendor through a public records request? What did it look like, and did it cover more than the live database?

Source: The Philadelphia Inquirer, link in comments

The Revolut incident highlights a major technical vulnerability in mandatory KYC protocols. A fraudster gained control of a legitimate government email account, submitted a fake emergency request for information, and received sensitive customer records without triggering suspicion. Revolut handed over passports, verification selfies, IBAN details, and complete Bitcoin transaction histories.

There was no software breach or database intrusion here. A compliance worker simply checked a valid domain header and exported unencrypted raw files to an unverified recipient.

Checking SPF and DKIM signatures only confirms that an email originated from a specific server. It does not verify whether the sender holds actual judicial authority to request private financial records. A single compromised inbox inside a law enforcement agency turns an entire compliance department into an automated data exfiltration vector.

Centralized databases containing identity documents are always going to be vulnerable to this kind of social engineering. Regulators force platforms to collect massive amounts of personal data, which is then stored until someone presents a plausible email header. If you use centralized exchanges for crypto transactions, your complete transaction record sits in a database waiting for the next compromised government mailbox. Moving to self-custody wallets and minimizing KYC footprint remains the only real defense against this infrastructure flaw.

Source: CNA, link in comments

Seeing New Mexico refuse the $18 billion multi-state settlement to drag Meta into a courtroom over Cambridge Analytica is wild. We are nearly a decade past the original data harvest, and forty-eight states just signed off on a liability release buried on page 130 of a settlement agreement.

From an infrastructure perspective, litigating an API leak from 2015 in late 2026 is completely detached from operational reality. The Open Graph v1 endpoint that let third-party quiz apps scrape friend networks was deprecated years ago. But the fundamental issue was never just one leaky endpoint. It was storing unencrypted user graphs on centralized servers where access controls are enforced by policy instead of cryptography.

State prosecutors talk about five thousand dollar fines per statutory violation as if a cash penalty fixes broken data architecture. Meta views these payouts as standard operating expenses. If a company can harvest data, monetize it for ten years, and then litigate the cleanup across a decade of court dates, the math always favors the breach.

Courtrooms do not rewrite backend code. A state winning a cash payout in Santa Fe does zero to give users control over their own data stores. Until we move away from centralized platforms toward local client control, these trials are just state governments taking their cut of the pie.

Source: The Guardian, link in comments

CyberFOX signed a distribution agreement with Ingram Micro to push their password and privileged access management tools beyond MSPs into the broader IT channel. Ingram handles over 160,000 resellers, so this move is purely about scaling sales volume.

From a sysadmin perspective, watching credential vaults turn into distributor bundle items is frustrating. Channel partners rarely care about zero-knowledge encryption or keeping decryption keys on premises. They care about margins and billing efficiency.

When security tools get packaged this way, buying decisions shift to non-technical managers picking whatever SKU comes bundled with their software licenses. Nobody audits client-side key generation or asks where master keys actually live. They check a box on a quarterly invoice and move on.

MSPs already trade user privacy for multi-tenant management convenience. Pushing those exact software architectures into standard corporate IT through bulk distributors means hundreds of small businesses will hand root access management to vendor cloud consoles without realizing it.

If your password vault is managed through a reseller portal and you do not hold the master key on hardware you control, you do not have privacy. You have shared administrative access with a middleman.

Sources: Channel Dive and GlobeNewswire, links in comments

The Irish Criminal Assets Bureau recently reported that organised crime groups are renting commercial safe deposit vaults to store hardware wallets and seed phrases written on paper. It is a textbook example of flawed threat modeling.

If your setup leads you to pay a private company to keep a plain piece of paper in a metal locker, you have failed at basic operational security. You spend years moving away from custodial banks only to hand physical access to a vault operator who will surrender your box the second law enforcement arrives with a warrant. Or worse, the private facility gets raided directly during a broader criminal investigation.

True digital sovereignty relies on zero single points of failure. Storing plain text recovery credentials inside a commercial facility is lazy engineering. If you have keys worth protecting, you implement Shamir's Secret Sharing or a multi-location M-of-N multisig layout where no single physical spot holds the entire full key. Stamped steel plates hidden across independent locations cost less than yearly vault rent and do not come with a corporate landlord or a centralized customer database.

If you cannot protect a simple 12-word phrase without outsourcing physical access control to a commercial business, you do not actually hold your keys.

Sources: AML Intelligence and OneBullEx, links in comments

Proofpoint just published data showing half of New Zealand government agencies still haven't enforced p=reject on their DMARC policy, even after getting a full year deadline extension. They stay stuck on p=none or quarantine.

Publishing a DMARC reject record in DNS takes three minutes. IT departments stall on p=reject for years because nobody wants to audit shadow IT. The second you flip to p=reject, every rogue SaaS tool or ancient internal mailer sending email with the agency domain stops working if it lacks valid DKIM keys.

Instead of finding those unaligned senders, admins leave p=none active forever. That turns DMARC into a passive logging tool. It lets attackers spoof official government domain headers with zero pushback, while the IT team claims they checked the email security box.

If an agency cannot track which systems send mail on its behalf, they have bigger problems. Setting p=reject is basic hygiene. How many organizations in your sector actually enforce reject instead of hiding behind monitor mode?

Sources: proofpoint and SecurityBrief New Zealand, links in comments

This £2 billion class action landing in London tribunal courts hits the exact problem we have discussed for years. Apple pitched App Tracking Transparency (ATT) as a massive win for consumer privacy back in 2021. In reality, it was market capture wrapped in a clean UI.

The mechanics were clear from day one. ATT prompts users to block third-party tracking across apps, which crippled competitors relying on cross-site profiling. Meanwhile, Apple's own personalized ads system operated under a different set of prompt defaults and retained deep first-party telemetry across the device ecosystem. They didn't eliminate data harvesting. They just centralized the pipe inside Cupertino.

As someone managing network infrastructure, watching people treat an OS vendor as a privacy savior always hurt. Real privacy means the individual device owner controls their own local outbound traffic and packet filters. When the entity running the OS controls both the access rules and the internal audit log, you get zero transparency. You get a walled garden with an expensive ad network attached.

The lawsuit focuses on developer ad losses, but the real issue is hardware monopolies defining privacy on their own terms. Swapping Meta for Apple isn't a win, it's just swapping landlords. Interested to see if European competition regulators push this structural critique further.

Sources: Quartz, The Straits Times and The Hindu, links in comments

Anthropic announced their Enterprise Frontier Safeguards system this week. The pitch sounds great on paper for compliance officers: instead of Anthropic keeping Claude conversation logs on their servers, you store the monitoring data in your own AWS S3 or Azure Blob storage with keys you manage. Alerts generated by automated safety checks go straight to your internal team instead of Anthropic staff.

Look closer at the actual technical setup, though. Your prompts and context windows still sit in cleartext inside their GPU memory during inference. Their real-time classifiers still process the live text stream on their hardware before anything ever reaches your encrypted bucket.

What Anthropic actually built is an admin trick. They handed legal teams a zero-retention claim for slide decks, and they shifted the AWS storage bill and incident review overhead back to the customer. You manage the KMS keys and pay the infrastructure costs, but the vendor still processes the unencrypted data when it counts. It looks nice on a procurement checklist, but technically nothing fundamental changed. Is anyone here buying this as real data sovereignty?

Sources: Anthropic and Enterprise DNA, links in comments

I've been warning my users about this for a year. The FBI just put out a notice about OAuth consent phishing. Honestly, it was just a matter of time before this became the standard attack vector.

We spent the last decade beating users over the head with 2FA. Now everyone has an authenticator app or a hardware key. They feel invincible. So when they get an email asking them to authorize a random calendar plugin or PDF reader via their Google account, they just click "Allow".

They think they are safe because the attacker doesn't have their password. But the attacker doesn't need the password. You just handed over a persistent API token. They have full access to your inbox. Changing your password or cycling your 2FA does absolutely nothing to kick them out.

It's infuriating. Big tech built OAuth to make third-party integrations frictionless. That friction is exactly what we need.

If you haven't checked your account security dashboard lately to see what apps have active tokens, go do it right now. Revoke everything you don't actively use. I force the staff at my company to re-authorize apps every 30 days, and they complain about it constantly. Bref, at least their accounts aren't being scraped.

How are you guys managing token hygiene? Any scripts you actually trust?

Source: Gizmodo, link in comments.

Seeing OpenAI mandate hardware security keys and expand their Yubico partnership is a solid move. FIDO2 authentication eliminates man-in-the-middle phishing completely. App authenticators and SMS codes were always temporary fixes, and phishers bypass them easily now.

Having physical possession of your private key on a token gives you real cryptographic proof of identity. The FIDO2 standard itself is open, and getting everyday users comfortable with hardware tokens builds better security habits. I moved my own systems to physical keys a while back, and it solved a lot of credential headaches.

Are you picking up the discounted OpenAI bundle key set, or are your existing YubiKeys already doing the job?