My mum’s iPhone face ID stopped recognising her. Just didn’t want to know her. We spent an hour resetting things, rebooting the phone, following all steps. In the end it turned out that the screen protector had moved a bit and smudged the front camera so it couldn’t see her. Pushing it back into place and cleaning up the glue sorted that out. Sometimes it’s a simple fix.
Anyway, this week’s news.
Smoke alarm, certain conditions apply
Flock’s CEO says its microphones detect gunshots. Only gunshots. Its website says gunshots, fireworks, car crashes and sideshows, plus a “continually expanding detection library”.
That’s a smoke alarm sold as toast-proof, with a product page listing toast, crumpets, bagels and “other browning events”. The library is continually expanding. The CEO’s definition apparently isn’t.
Source: TechCrunch
Passkeys: the sequel nobody asked for
A viral post called passkeys a Trojan Horse built by tech giants and intelligence agencies. Scott Helme pulled it apart: synced passkeys don’t attest, attestation doesn’t check your OS, and the TOTP codes it prefers still fall to phishing. The post also recommends YubiKeys, which are the thing that actually attests.
It’s like warning everyone that lifts are a surveillance device and suggesting the stairs, which have a camera on every landing. The panic travelled much faster than the fact-check, which is the one truly reliable feature of the internet.
The original panic
The rebuttal
The heist crew that left the blueprints on the bus
CyberXero ran 51 AI agents to harvest 628,000 Ukrainian records. Properly impressive orchestration, in the way a Michelin-starred kitchen is impressive right up until you find out they’ve been using the neighbour’s gas meter. One open directory exposed the whole operation.
Meanwhile, a 19-year-old stealing pizza order data forgot his VPN, left credentials on GitHub, and is now under house arrest. At least he’s in for the evening, and the pizza will come to him.
The tiger did not “go rogue”
Frontier labs keep describing incidents as “rogue AI”. Security folk look at the same incidents and see decades-old containment practices that nobody bothered to implement. When a tiger gets out, you don’t call it a rebellion. You check who left the gate open.
The supply chain piece makes the same point from the other side. We keep lecturing the model about what it should refuse, while ignoring everything it can actually reach. A very polite tiger is still a tiger with a key.
Leaflets outside the casino
New KnowBe4 research on youth cybercrime lands on something I’ve suspected for a while. Telling young people that cybercrime is illegal is like handing out gambling leaflets outside a casino. Nobody recruits with “come and commit a crime”. They offer flexible hours and “just a small task”.
Fear is a weak job offer. If prevention wants to win, it has to out-recruit the people on the other side, and so far they have much better onboarding.
Until next week
That’s your lot. If you disagree with anything above, reply to this email. If you agree, tell a friend. If you’re a vendor and think I’m wrong, my inbox has a spam filter and I’m not afraid to use it.
You can also find me on Bluesky, where I’m told the algorithm is entirely under my control. I’ll let you know how that goes.
Javvad