Prynoid

Privacy claims should be tested, not trusted. Product behaviour tested against privacy claims. Expert-reviewed evidence.

[Prynoid @Prynoid]

Most apps say they respect your privacy. Few get tested on it.

@Prynoid checks what products actually do vs what they promise. AI, apps, browsers, SDKs, consent flows. Expert-reviewed evidence.

Building something? Get it tested before someone else does: https://t.co/fMuy8bireX

[Prynoid @Prynoid]

@jasonprgressive Much of that already exists on iOS 16 and later. A programmatic clipboard read triggers an Allow Paste prompt, while the system Paste menu or a UIPasteControl button counts as intent and goes through. Settings > the app > Paste from Other Apps sets Ask or Deny per app.

[Prynoid @Prynoid]

Some apps read your clipboard when they come to the foreground — not only when you tap Paste. That can include one-time codes, addresses, or a password you just copied. On iPhone, recent iOS versions show a banner when an app reads the clipboard; treat that as a signal, not noise. Prefer Share sheets over copy-paste for sensitive text, and clear the clipboard after OTPs. On Android, check which apps have notification access and “draw over other apps” — listeners can read OTPs that appear in notifications, and overlays are a known path for stealing passwords and taps.

At Prynoid we test claims against behaviour, including what an app touches when you are not looking.

https://t.co/Ddr71vtAaH

Source: https://t.co/At6wlEKmNB

#privacy #clipboard #mobile

[Prynoid @Prynoid]

@CoinbaseSupport Contact data leaking via an analytics supplier still fuels phishing, even when core systems are untouched. Practical fix: send analytics tools minimal or hashed identifiers, and tell customers any message citing this incident is probably bait.

[Prynoid @Prynoid]

Threat notifications like this are rare, so the sensible response is to act on them instead of dismissing them. A practical path is updating iOS immediately, turning on Lockdown Mode if you are a likely target, rebooting regularly, and contacting a specialist group such as the Access Now helpline instead of trying to self-diagnose.

[Prynoid @Prynoid]

Screen-recognition on TVs is hard to notice because nothing on the display ever changes. A realistic path is switching off the content recognition setting in each TV's privacy menu, keeping the TV on a guest network away from your laptops and phones, and glancing at router logs now and then to see which domains it still talks to.

[Prynoid @Prynoid]

Settlement checks are the visible end of a breach; the lasting cost is that SSNs and call records stay in circulation for years. A realistic path is freezing credit at all three bureaus, moving off SMS codes to an authenticator app or passkeys, and treating any claim email as suspect until you have reached the claim site yourself.

[Prynoid @Prynoid]

@jasonprgressive iOS already flags clipboard reads with the banner, but the stronger model is clipboard access only at the moment of Paste — not on every foreground. Until platforms ship that, treat every banner as a real signal and clear the clipboard after OTPs.

[Prynoid @Prynoid]

One like seems small. Together, your likes can hint at what you believe and who you love.

So ask: when does an "interest" become a sensitive trait?

In November 2024, Korea's Personal Information Protection Commission fined Meta KRW 21.6 billion. It found Meta had collected sensitive information, such as religious and political views and sexual orientation, from Korean Facebook users and used it for advertising without a lawful basis. The decision applies Korean law to Meta's past practices.

Users: review your ad-interest settings. Builders: check whether your audience segments are proxies for sensitive data.

See how Prynoid checks what your data really says.
https://t.co/Ddr71vtAaH

Source: https://t.co/JmSvauEMR6

#Privacy #AdTech #SensitiveData

[Prynoid @Prynoid]

1 June 2022: Canada's privacy commissioners publish findings on the Tim Hortons app.

You order one coffee. For months afterwards, the app may log where you sleep and where you work.

The commissioners found the app tracked location as often as every few minutes, including when it was not open, and could infer home and work. Tim Hortons said it used the data only in aggregate and agreed to delete it. PIPEDA did not allow a fine.

Users: check which apps have "Always" location. Builders: prove background collection stops when the app closes.

How we test privacy claims: https://t.co/Ddr71vtAaH

Source: https://t.co/36yvQie745

#Privacy #Location

[Prynoid @Prynoid]

@solidintel_x A blockchain forensics firm exposing customer names and emails shows security vendors are targets holding exactly what attackers want. Customers should ask what contact data is retained, why, and for how long. Trust in a security brand is only as good as its own data handling.

[Prynoid @Prynoid]

@unusual_whales Rapid AI rollouts outrun the controls around them, so error and privacy costs show up later as rework, data exposure and shadow usage. The fix is boring: inventory what the tools touch, restrict what data they see, and verify behaviour against vendor claims before scaling.

[Prynoid @Prynoid]

Bug bounties are a trust contract: researchers disclose privately in exchange for fair triage and payment. When that breaks, full-disclosure dumps become the rational response, and unreported escalation paths land in public before patches. Vendors are judged by how they treat the people who find flaws.

[Prynoid @Prynoid]

@Dexerto A $177M settlement is what failing to protect customer records costs, yet a payout per person never covers a lifetime of exposed identifiers. Compensation arrives after the damage. The control that matters is proving minimisation and retention before an attacker finds the gap.

[Prynoid @Prynoid]

Sony's disclosure lists 16 bank account records inside 2.58M profiles, which shows a store account holds more than a login. Shutting servers is containment, not an answer to what was retained. Check what a console account actually stores against what the privacy policy says it collects.

[Prynoid @Prynoid]

@WatcherGuru Attribution will take time, but the defensive lesson holds regardless of actor. Assume determined, well-resourced attackers, segment high-value systems, enforce phishing-resistant authentication and rehearse the response before it is needed.

[Prynoid @Prynoid]

@cryptowalax An endpoint compromise as the entry point is the pattern we see most. Strong key custody means little if employee devices are not treated as part of the attack surface. Device hardening, least privilege and withdrawal controls matter as much as cold storage.

[Prynoid @Prynoid]

@CNIL_en “Continue without accepting” is only meaningful if network behaviour follows the choice. Where a user identifier and viewed products still leave after refusal, the interface and the traffic have diverged. That is the kind of claim-versus-behaviour check we carry out at Prynoid.

[Prynoid @Prynoid]

The material issue is not only that data was sold, but that many drivers reasonably understood the product as a personal driving aid. That mismatch between presentation and downstream use is exactly the class of question we examine at Prynoid. If the enrolment copy does not name who receives the data, the consent is difficult to treat as informed.

[Prynoid @Prynoid]

On 22 October 2026, France's CNIL fined two Fnac companies €7 million. It found the Fnac app sent a user identifier and viewed-product activity to a third-party domain without consent, and failed to recognise users' choice not to consent. The companies can still appeal.

Users: check which apps you have told no. Builders: test the network after "reject", not just the banner.

You said no. Did anything still leave the phone?

Explore how Prynoid tests whether a "no" is respected.
https://t.co/Ddr71vu80f

Source: https://t.co/O9kbHQExkA

#Privacy #CNIL #GDPR

[Prynoid @Prynoid]

Discord has announced starting november all messages in public servers are going on google.