Senate Bill 73 holds websites liable for users who mask their location.
  • ChaosMaterialist [he/him, they/them]@hexbear.netEnglish
    20·
    19 hours ago

    Friendly reminder that China has thoroughly hacked the telecom system through the Police Wiretapping systems in the biggest this-will-have-consequences and :i-told-you-dog: in recent history. Any surveillance system built here is, effectively, the US government building out China’s US spying capabilities without them lifting a finger. xinternet :sit-back-and-enjoy:

    Is China in the room with us right now?

    The US government sure is, and through expert hacking and intelligence infiltration so are the Chinese. So maybe?

    Despite sanctions and public exposure, Salt Typhoon continues operating. Recorded Future documented new breaches of five additional telecom firms between December 2024 and January 2025. By August 2025, the FBI confirmed Salt Typhoon had hacked at least 200 companies across 80 countries.

    And just to cement this, here’s Congress saying the same thing

    “They exploited the wiretapping system that our law enforcement agencies rely on under the Communications Assistance for Law Enforcement Act — known as CALEA. These systems became an open door for Chinese intelligence. Salt Typhoon allowed the Chinese operation to track millions of Americans’ locations in real time, record phone calls at will and read our text messages.”

    “So how did this happen?” she continued. “Senior national security officials said the breach occurred in large part because telecommunications companies failed to implement rudimentary – rudimentary! — cybersecurity measures. Investigators found legacy equipment not updated in years, router vulnerabilities with patches available for seven years — seven years! — that were never applied, and hackers acquiring credentials through weak passwords.”

    More info about the hack.

    The trusted transport layer is dead. Salt Typhoon, a Chinese MSS operation active since 2019, compromised nine major U.S. telecom carriers by exploiting fundamental identity failures. One administrator credential controlled 100,000 routers. Patches available since 2018 remained unapplied for years.

    The attackers accessed CALEA lawful intercept systems. They surveilled over one million Americans in real time. They intercepted calls and texts of approximately 100 senior government officials.

    This is an Identity Failure Layer collapse. The breach required no sophisticated zero-days. It required one over-privileged account, absent MFA, and years of ignored patches. CISOs are misdiagnosing this as telecom-specific. It is not. Every enterprise routes sensitive traffic through compromised networks. The transport layer your organization trusts is hostile terrain. Assume unencrypted communications are intercepted. Assume metadata is logged.

    The mandated backdoor built for law enforcement became the adversary’s front door.

    fell-for-it-again

  • SootySootySoot [any]@hexbear.netEnglish
    19·
    20 hours ago

    How would this work? If they could work out you were masking your location, then… VPNs wouldn’t be a thing.

    Isn’t this the equivalent of making it a crime to lie about you doing crime? What does it possibly achieve?

    • red_giant [comrade/them, he/him]@hexbear.netEnglish
      9·
      17 hours ago

      IPv8 proposals end up making anonymity pretty difficult.

      And there are under-development systems to provide a method of your carrier disclosing information about you, so like your network packets would get some kind of tag added to them that can be used to query your rough location, age, and potentially other stuff like payment processing. Right now it’s opt-in, eg “do you want to verify you’re 18?”, but that will change as soon as it’s widespread.

        • red_giant [comrade/them, he/him]@hexbear.netEnglish
          10·
          15 hours ago

          It’s still an early draft.

          You can view it as the proposed successor to IPv6, but really it’s more of an extension to IPv4.

          Put simply, IPv6 is beginning to be seen as a failure, so IPv8 looks at why IPv6 adoption is still so poor and proposes something else.

          IPv8 is backwards compatible with IPv4 (IPv4 becomes a subset of IPv8) which should help adoption since there’s no grand switch-over day like IPv6 requires.

          But it also includes a bunch of other stuff, including the idea that every single network element has an identity. So, like, your router can identify itself in a verifiable manner to your ISP by using a JWT.

          This allows some good things, for example right now it’s a flaw in the internet that you often have to simply trust an IP address for important data. Like a router can advertise routes and currently your home network trusts your ISP for routes because somewhere in your router there is a static IP assigned and your home router will just trust that IP…. Stuff like this which leaves a lot of infra open to attack such as spoofing or man in the middle stuff.

          In IPv8 your router can now verify the identity of who is actually talking to it. This is good, but the downside is that it makes it much more difficult to be anonymous since traffic is now deeply identifiable.

          It also allows for every single network element to be uniquely addressable. Under IPv4, typically there is port mapping so the public internet sees “you” as your ISP, but under IPv8 it’s proposed to make every single network element directly addressable by IP, identity, and DNS8. This also enables cool things like potentially you could have asynchronous communication without needing to keep a socket open and dealing with port exhaustion but it also means you’re much less anonymous than under IPv4.

          It’s probably moot anyway since these days your ISP and every server / router in the middle is maintaining detailed access logs anyway so your anonymity is already gone, but it makes it much simpler to deanonymize and potentially even undermines stuff like using a VPN by creating many more vectors by which a VPN can leak identity.