Xavier de Carné

Assistant Professor @ Radboud University. Research on infosec. Dad. My own tweets, in 🇬🇧 and 🇫🇷.

[Xavier de Carné @xavier2dc]

I have joined @Radboud_Uni in the Digital Security group! These years exploring the Canadian and Hongkongese systems have been enriching. Now is time to bring this experience back to Europe.

[Xavier de Carné @xavier2dc]

Our new paper "Leaked in Translation: Measuring and Mitigating Sensitive Data Exposure to Third-Party Services via Browser-Based Translation" with Tianlang Xie has been accepted at the Workshop on Privacy in the Electronic Society (WPES '26). More to come in November.

[Xavier de Carné @xavier2dc]

"Ce que l'on conçoit bien s'énonce clairement, et les mots pour le dire arrivent aisément." Boileau.

Every time I grade an exam, I think about this.

[Xavier de Carné @xavier2dc]

@CNIL https://t.co/NGwEUrTDgV

https://t.co/bI72enLesu

[Xavier de Carné @xavier2dc]

@CNIL En 2026 d'après la CNIL, il est encore recommandé de calculer une entropie d'un mot de passe choisi par l'utilisateur avec des règles simplistes et désuètes, c'est fantastique. Avec mon "Soleil123+++" ça y est déjà 80 bits, trop fort le mot de passe !

[Xavier de Carné @xavier2dc]

Avec ne serait-ce que zxcvbn comme évaluateur, ce mot de passe n'a plus que log2(10^8.19739) ou 27.23 bits d'entropie, c'est pas pareil. Il faudrait peut-être s'adapter @CNIL ?

[Xavier de Carné @xavier2dc]

Parce que vous êtes incompétent pour vous préoccuper d'enfants.

Parce que comme ça vous pourrez savoir qui dit quoi sur les réseaux sociaux encore plus facilement.

On vous demande plutôt de vous occuper "en accéléré" de la sécurité des français et de leur propriété.

[Xavier de Carné @xavier2dc]

Parce que l'État ferait mieux de rester à sa place.

Parce que les rêves de mes enfants n'ont pas à être pilotés ni par des algorithmes ni par un Président.

Parce que les parents feraient mieux de s'occuper de leurs enfants qui accèdent à Internet.

[Emmanuel Macron @EmmanuelMacron]

Interdire les réseaux sociaux aux moins de 15 ans : c’est ce que préconisent les scientifiques, c’est ce que demandent massivement les Français.

Après un travail fructueux avec le Gouvernement, l’Assemblée nationale vient de dire oui.

C’est une étape majeure.

Au Sénat maintenant de poursuivre ce travail constructif.

Pour que cette interdiction soit effective dès la rentrée prochaine, j’ai demandé au Gouvernement d’activer la procédure accélérée.

Parce que le cerveau de nos enfants n’est pas à vendre. Ni aux plateformes américaines, ni aux réseaux chinois.

Parce que leurs rêves ne sauraient être dictés par les algorithmes.

Parce que nous ne voulons pas de la génération anxieuse mais d’une génération qui croit en la France, la République et ses valeurs.

La France, pionnière depuis 2018 de la régulation des plateformes, continue aujourd’hui de l’être en devenant le premier pays d’Europe à s’engager dans cette voie.

Au 1er septembre, nos enfants et adolescents seront enfin protégés. J’y veillerai.

[Xavier de Carné @xavier2dc]

Parce que ces plateformes n'ont pas à connaître l'identité des utilisateurs ni à manipuler des pièces d'identité.

Parce qu'il n'y a pas de moyen simple à l'heure actuelle pour vérifier l'âge sans donner sa pièce d'identité.

[CNIL @CNIL]

ℹ️🔴 La CNIL sanctionne la société FREE MOBILE d'une amende de 27 millions d’euros et la société FREE d'une amende de 15 millions d'euros, compte tenu du caractère inadapté des mesures prises pour assurer la sécurité des données de leurs abonnés 👉 https://t.co/giY6q8LOU6

[Xavier de Carné @xavier2dc]

I receive a recall on my vitamin D: "too high level". Oh, the centration is higher than expected? No, European bureaucrats simply tell you the labelled 4000 or 5000IU supplements "exceed the daily limit for adults" (hahaha). I guess they haven't found out about 10,000+ versions.

[The Spectator @spectator]

'The cancellation of New Year’s Eve on the Champs Élysées is confirmation that Paris is no longer is in control of its public space'

✍️ James Tidmarsh

https://t.co/0Tre3UOgVk

[Xavier de Carné @xavier2dc]

Editor be like: better send that paper to revs who like vaccines.
Rev1: This study is important, uses X,Y,Z, demonstrates causality.
Rev2: I'm concerned about some of the conclusions.
Rev3: Good study, minor feedback: grammar on line 345 is ambiguous.
Editor: Accept, min.revision

[Xavier de Carné @xavier2dc]

This new French study on COVID-19 vaccines, lazily shown to vaccine-hesitant people to "prove" them wrong and even call them criminals, tries to correlate the almighty vaccines to a reduction in risk of dying of cancer and congenital diseases. Hahahaha.

[Xavier de Carné @xavier2dc]

Authors literally write "Vaccinated individuals had a lower risk of death compared with unvaccinated individuals regardless of the cause of death." which sounds like a huge bias, but then they turn it into a conclusion. This stuff is better than Lourdes 😂 YOLO with statistics.

[Xavier de Carné @xavier2dc]

Still an unpopular opinion but actually damn critical for a whole range of reasons.

[Elon Musk @elonmusk]

Dissolve the EU and return power to the people

[GrapheneOS @GrapheneOS]

We no longer have any active servers in France and are continuing the process of leaving OVH. We'll be rotating our TLS keys and Let's Encrypt account keys pinned via accounturi. DNSSEC keys may also be rotated. Our backups are encrypted and can remain on OVH for now.

Our App Store verifies the app store metadata with a cryptographic signature and downgrade protection along with verification of the packages. Android's package manager also has another layer of signature verification and downgrade protection.

Our System Updater verifies updates with a cryptographic signature and downgrade protection along with another layer of both in update_engine and a third layer of both via verified boot. Signing channel release channel names is planned too.

Our update mirrors are currently hosted on sponsored servers from ReliableSite (Los Angeles, Miami) and Tempest (London). London is a temporary location due to an emergency move from a provider which left the dedicated server business and will move. More sponsored update mirrors are coming.

Our ns1 anycast network is on Vultr and our ns2 anycast network is on BuyVM since both support BGP for announcing our own IP space. We're moving our main website/network servers used for default OS connections to a mix of Vultr+BuyVM locations.

We have 5 servers in Canada with OVH with more than static content and basic network services: email, Matrix, discussion forum, Mastodon and attestation. Our plan is to move these to Netcup root servers or a similar provider short term and then colocated servers in Toronto long term.

France isn't a safe country for open source privacy projects. They expect backdoors in encryption and for device access too. Secure devices and services are not going to be allowed. We don't feel safe using OVH for even a static website with servers in Canada/US via their Canada/US subsidiaries.

We were likely going to be able to release experimental Pixel 10 support very soon and it's getting disrupted. The attacks on our team with ongoing libel and harassment have escalated, raids on our chat rooms have escalated and more. It's rough right now and support is appreciated.

[International Cyber Digest @IntCyberDigest]

❗ The Dutch General Intelligence and Security Service (AIVD) opposes the EU's chat control proposal. It advises against it due to very high risks to digital resilience.

The AIVD warned the cabinet that installing a scanning app on every mobile phone, along with the required management infrastructure, would create an extremely large and complex system with access to vast numbers of devices and their personal data, posing major risks to digital resilience.

This is ironic because in 2022, the same agency established a technical capability to intercept internet communications via major cable operators, enabling taps “across the whole of the Netherlands” to catch enemies of the state — which is effective, but technically constitutes mass surveillance with enormous implications.

[Xavier de Carné @xavier2dc]

"publishing the data risked damaging the well-being and mental health of the families and friends of people who died."

https://t.co/7tkAqIcnxj

[Xavier de Carné @xavier2dc]

You normally need to pay grid management costs (456€ lol), delivery costs (108€ ??), Thanks to your socialist gvt, you get a 635€ deduction b/c we love you (yay). Otherwise, you would need to pay 1365€ total. Or are you, maybe? Guess where the free money comes from... Madness

[Xavier de Carné @xavier2dc]

The scam of the energy bill here in the NL (and elsewhere too): Your electricity costs 0.15246€/kWh. If you consume about 2900kWh a year you would expect to pay 450€. OK. In reality, you pay 730€ because you pay a 80% tax on your consumption WTF! But it gets worse...