Serge Egelman

@v0max.bsky.social

1858 Followers 920 Following

Scientist. Dir. of Usable Security & Privacy at the International Computer Science Institute (icsi.berkeley.edu). Founder, AppCensus (appcensus.io). All opinions are those of his employer(s), and not his own. https://www.guanotronic.com/~serge/

Senator Mike Gabbard and Carol Gabbard released this statement: "Our oldest son Bhakti has had mental issues in the past but has been doing well for the last 10 years. Several days ago, he started acting erratically, as a result of smoking pot. His wife kicked him out of the house, so he’s been sleeping on the streets. He gave away his car to a homeless person; lost his ID and phone and has no money. He’s renamed himself, Batarti, and also Jim Morrison Jr., as he’s having delusions of being a rock star. "This afternoon, a family member took him to Queen’s Hospital ER to have a psychological evaluation. Bhakti told the doctor they would find cocaine, ice and pot in his blood tests. And this evening, he was admitted for a 72-hour hold at Queen's, while they continue to monitor him and decide next steps." Mike and Carol's children also includes Tulsi Gabbard, who served as the director of national intelligence for the Trump administration.
IAB15 Science IAB15-1 Astrology IAB15-2 Biology IAB15-3 Chemistry IAB15-4 Geology IAB15-5 Paranormal Phenomena IAB15-6 Physics IAB15-7 Space/Astronomy IAB15-8 Geography IAB15-9 Botany IAB15-10 Weather
View of Lake Alpine between the pines from the campsite.
US and Turkiye gigantic flags at the beginning of the match
In addition to Fun Kid Racing, the tests showed one other Android app sending precise location data to other companies: Masha and the Bear: Free Animal Games for Kids, an animated game app with millions of downloads. The iOS version sent advertising ID codes to a company that generally prohibits children’s apps from using its network. In an email, Indigo Kids, the Cyprus-based maker of the Masha app, said it was not responsible for harvesting children’s information because third-party companies collected the data. “We, as a company, do not collect or store any data of our users,” the company said.
Bibendum butter dish, in which he is sitting atop a porcelain tire that holds the butter.
Stained glass of Bibendum kicking at the viewer.
“GPT-5.5 SAYS COMPUTER SECURITY AND PRIVACY RESEARCHER KNOWN FOR WORK ON USABLE SECURITY, PRIVACY, AND MOBILE APP DATA PRACTICES.”
Today’s scores: Spain/Cabo Verde: 0-0 Belgium/Egypt: 1-1 Saudi Arabia/Uruguay: 1-1 Iran/New Zealand: 2-2
Giant flags on the pitch at the beginning of the Belgium-Egypt match.
“Seattle Stadium” with “Lumen” redacted.
Selfie with the pitch in the background.
Sofi Stadium sign with Sofi redacted, because they did not bribe FIFA.
Abstract: While legal scholars have cited decades of computer science research that demonstrates why anonymity is hard (and that datasets should not be labelled as “anonymous” cavalierly), industry and legal practitioners have not heeded those warnings: many organizations trafficking in consumer data continue to assert to customers, courts, and regulators, that their data is anonymous or “deidentified.” We acquired datasets from multiple data brokers to demonstrate empirically why this is false. Using publicly available email addresses found in data breaches posted on the Internet, we trivially reidentified 88% of the hashed email addresses that we obtained; using modern password-cracking techniques, we were able to reidentify 97% of the 6 million email addresses that we collected. Reidentifying hashed email addresses need not rely on illicit data or specialized hardware: by constructing rainbow tables with synthetic data representative of typical email addresses, we reidentified most of the hashed email addresses. In all cases, the hashed email addresses were linked to other device-based identifiers (e.g.,... 1/2
Fake Marlboro ad in The Onion: “the easiest way to quit vaping”
Two signs at an intersection: one is a stop sign, the other indicates a roundabout, thereby making the stop sign redundant.
A list of accepted papers from: https://weis2026.econinfosec.org/accepted-papers/
Headline from The Guardian: “US millionaire big-game hunter dies after being crushed by elephants”
The Boss at Chase Center
Excerpt from https://www.merriam-webster.com/i/privacy-policy “We also may rely on third-party service providers to do things like: take user-level information, anonymize it through hashing (a hashed email address might look something like this: e820bb4aba5ad74c5a6ff1aca16641f6) and match it against other anonymized, people-based identifiers – doing this helps us serve you personalized, relevant advertisements.”
Picture of Little Kings tiny tiny beer bottles.
Highlighted section from Idi Amin’s Wikipedia entry: His full self-bestowed title ultimately became: "His Excellency, President for Life, Field Marshal Al Hadji Doctor Idi Amin Dada, VC, DSO, MC, CBE, Lord of All the Beasts of the Earth and Fishes of the Seas and Conqueror of the British Empire in Africa in General and Uganda in Particular”
Bowl of pappardelle with a cream fraiche sauce with lox, salmon roe, and parsley.
An entire iberico de bellota, patatas con aioli, chorizo, bacalau croquettes, cheeses, and asparagus with eggs.
A handsome pathivier, straight out of the oven on a baking sheet.
“On April 5, 1987, seven-year-old Michele Snow was killed when a dart thrown by her brother's playmate penetrated her skull and caused fatal brain trauma.[8] The darts were purchased as part of a set of various lawn games and had never been played before the incident occurred.[8] Snow's father David began to advocate for a ban on lawn darts, claiming that there was no way to keep children from accessing lawn darts short of a full ban.[8][9] As a partial result of Snow's lobbying, in 1988 the U.S. Consumer Product Safety Commission introduced an outright ban on lawn darts in the U.S.”
Article from law360
Fake ad in The Onion for Adobe: “Experience the magic…of buying new software, every month, forever.”
"My proposed PhD research centers on Privacy and security, mobile computing, particularly exploring how Mobile computing can be strengthened through Usable Security Studies, Privacy Interface Design, Mobile App Auditing. I was especially drawn to your publication on ...And No One Can Hack It: The Uses and Abuses of Cybersecurity Folk Theory, which aligns closely with my current efforts in IT Security, Cybersecurity, AI-assisted threat intelligence, Core Infrastructure, and predictive defense models for enterprise environments."
A photo of a small bloodless nick on my thumb, with the saw blade firmly embedded in the brake in the background.
Screenshot of a website from 15-20 years ago with a Netflix popup ad.
Amazon recommendations showing similar dangerously-designed "baby loungers" from different brands.
A plate with a tower of shrimp, crab, dill, and roe upon a flattened brioche sandwich (Mt. Tam and truffle honey).
A wooden cup filled with stewed bear meat.
Helsinki cathedral wrapped in material.
A tray on a cafe table with a bottle of Coke Zero, a bottle of water, and two glasses.
Me in a silly hat and gown.
New walnut desk installed in my office with monitor, laptop, and knickknacks upon it.
A handsome walnut desk top sitting in a workshop. It has three drawers and leather-bound panels on the main surface.
Yosemite as seen from the top of Lembert Dome.
Brisket sitting on my smoker about to be turned into pastrami.
Wordle score showing 800 played, 100% win rate.
Photo of the Roman baths in Bath, with the cathedral in the background.
Me standing in front of a tiny Stonehenge.
Hotel room numbers on the wall in a font straight out of the 70s, just like the check-in counter signs at Dulles.
While legal scholars have cited decades of computer sci-ence research that demonstrates why anonymity is hard (and that datasets should not be labelled as “anonymous” cavalier-ly), industry and legal practitioners have not heeded those warnings: many organizations trafficking in consumer data con-tinue to make assertions to customers, courts, and regulators, that their data is anonymous or “deidentified.” We acquired datasets from multiple data brokers to demonstrate empirically why these assertions are false. Using publicly-available email addresses found in data breaches posted on the Internet, we trivially reidentified 88% of the hashed email addresses that we obtained; using modern password-cracking techniques, we were able to reidentify 97% of the 6 million email addresses that we collected. Reidentifying hashed email addresses need not rely on illicit data: by constructing rainbow tables with syn-thetic data representative of typical email addresses, we reidentified a majority of the hashed email addresses. In all cases, the hashed email addresses were linked to other device-based identifiers (e.g., mobile data advertising IDs, IPs, etc.), demonstrating why device-based identifiers have long been considered personally-identifiable information. Relatedly, organizations trafficking in this data make anoth-er assertion, that this data was collected from consumers with their consent. To evaluate this claim, we performed a survey (n=369), in which we emailed a subset of the reidentified indi-viduals in our datasets to recruit them to participate. This sur-vey asked participants about their recollections of having pro-vided consent (99% had no recollection) and their feelings about the sale of their information (94% were opposed, while 77% said they planned to submit deletion requests). Overall, our study shows that hashed email addresses and device identi-fiers do not come close to meeting commonly-understood defi-nitions of “anonymous” or...
The same stained glass dome taken at the Palace Hotel in Madrid.
Simpsons “don’t make me tap the sign meme”: “paying for airplane WiFi is no guarantee of receiving airplane WiFi”
Bors cartoon about neonazi claiming to be forced to be a neonazi due to criticism.
Despite the need for usable policy-authoring interfaces, there is evidence that today’s widely-used policy-authoring interfaces are prone to serious errors. The “Memogate” scandal, in which staffers from one political party on the United States Senate Judiciary Committee stole the opposing party’s confidential memos from a file server that the two parties shared, was caused in part by an inexperienced system administrator’s error using the Windows NT interface for setting file permissions [132]. "
Handsome eucalyptus and walnut console table in situ (in my office against a wall).
An upside down table being finished.
A chalice filled with La Fin du Monde, from the Unibroue brewery in Quebec.
Graph showing TSLA shares down 8.5% today
CNN headline: “Trump acknowledged that the massive loan balance was a complicating factor in his effort to shutter the agency”
Paper acknowledgements section that reads: "We thank Chris Hoofnagle for the invaluable feedback he provided on this paper. We also thank Chris Harjadi for helping with our qualitative coding of the survey data. This work was made possible by the U.S. National Science Foundation under grants CNS-2247951 and CCF-2217771, as well as Refjohürs Lykkewe."
Herring sandwich with onions.
“When people think of Hunter Thompson, they don’t necessarily think of the talented journalist with a very clear political mindset that speaks to us today and that helped bring about change at the time.”
Landscape in Saarland around the Dagstuhl conference center.
Yours truly on a rail platform wearing a bowler.