Martin

Principal researcher at @freedomofpress. Learning from and supporting journalists with digital security.

Public Key

npub1ppsmfekcfgmuly6xfaep9af88qx3hefpepv0v2tq96h49kttamjq4m4m5a

NIP-05 Address

mshelton_at_mastodon.social@mostr.pub

Profile Code

nprofile1qqsqscd5umvy5d70jdry7usj75nnsrgmu5susk8k99szat6jm947aeqpz4mhxue69uhhyetvv9ujumt0wd68ytnsw43qz9thwden5te0v35hgar09ec82c30wfjkccte8kev90

Publishing to

relay.mostr.pub

ditto.pub/relay

Author Public Key

npub1ppsmfekcfgmuly6xfaep9af88qx3hefpepv0v2tq96h49kttamjq4m4m5a

Show more details

Last Notes

2024-07-22 14:33:46

Our digital security training intern Kevin Pham wrote a well-researched, and concise article on what to look out for in encrypted note taking apps. Check out the short list: https://freedom.press/training/blog/note-taking-security/

2024-07-18 22:47:39

Google kills again. https://developers.googleblog.com/en/google-url-shortener-links-will-no-longer-be-available/

2024-07-17 19:42:47

Police use Cellebrite's technology to unlock phones for forensic analysis, but it's not magic. A few highlights from this reporting:
- Device manufacturer matters. E.g., Samsung devices appear more crackable than Google.
- Downloading your updates requires Cellebrite to research/develop new techniques. They're always playing catch up.
- Older devices are more vulnerable.
- Encryption matters. They often have to work harder if your password-protected device is turned off.
https://www.404media.co/leaked-docs-show-what-phones-cellebrite-can-and-cant-unlock/

2024-07-15 16:13:21

AT&T suffered a breach that affects nearly all customers between May and October 2022. If you are a journalist who used AT&T at that time, you’re going to want to read this. https://freedom.press/training/blog/att-breach/

2024-07-12 19:20:19

If you're a journalist who used AT&T between May 1-October 31, 2022, you're going to want to revisit your call and text history from that time and see which of your sources you were communicating with. These records have been improperly secured by AT&T. https://www.usatoday.com/story/tech/2024/07/12/att-data-breach-who-affected-what-to-do/74379292007/

2024-05-29 04:38:11

"Your scientists were so preoccupied with whether or not they could, they didn't stop to think if they should." https://www.washington.edu/news/2024/05/23/ai-headphones-noise-cancelling-target-speech-hearing/

2024-05-09 18:36:56

I like how Elon's own community notes fact check him on @npub1qml…mdus.
https://files.mastodon.social/media_attachments/files/112/412/568/334/301/766/original/9255be7a3d029349.png

2024-05-01 22:48:19

Talk about narrativizing… Even for a ubiquitous bike lock brand (Kryptonite) this is probably one of the most recognizable consumer bike locks in larger cities like NYC, where bike theft is common. It's literally called the "New York Fahgettaboudit Chain." Amazing. https://www.404media.co/email/1cc25606-201a-4f10-87ce-aeefa8285c3f/

2024-04-22 22:39:36

Welp, here's some nightmare fuel. FISA 702 expansion is even worse than I thought.
"Legal experts—including a rare few attorneys who’ve argued cases before the FISA court in the past—say the new ECSP text ensnares owners of facilities housing equipment used to store and carry data, as well as commercial landlords and virtually anyone with access to communications equipment in those spaces." https://www.wired.com/story/section-702-reauthorization-expansion/

2024-04-03 17:00:18

brain: time to remember a gaffe from your childhood
me: stop it brain. Stop it or I'll *exercise* to make you stop
brain: you wouldn't dare

2024-03-13 22:27:16

Updated our Spanish language "Signal for beginners" and "locking down Signal" guides to include new changes to usernames. Check them out:
- https://freedom.press/training/signal-la-app-de-mensajeria-segura-guia-para-principiantes/
- https://freedom.press/training/proteccion-avanzada-para-signal/

2024-03-12 23:25:32

We're working a paper and will release more soon buuut… For some research I'm reviewing a ton of U.S.-based news tip pages.
A few preliminary observations (of about 100 so far… More to come):
- ~25% have a newsroom Signal account
- ~25% have an embed form
- ~15% so far have a PGP email. Of those, close to half use ProtonMail
- ~8% discontinued the use of WhatsApp over the past few years. They also happen to be some heavy hitters (NYT, WaPo, Reuters, AP and more)
- A few are leaking DNS/SNI 🫣

2024-02-22 22:03:42

In response to Signal's username updates, we've pushed some changes to our guide on taking private photos with Signal. https://freedom.press/training/taking-private-photos-signal/

2024-02-21 18:11:33

For @freedomofpress I wrote about why journalists should enable Signal usernames as soon as possible. https://freedom.press/training/blog/enable-signal-usernames/

2024-02-20 22:47:24

Digisec nerds everywhere shortly after @npub1qml…mdus announcements today
https://files.mastodon.social/media_attachments/files/111/966/236/093/051/345/original/e9a396c89bd526a7.png

2024-02-07 20:24:10

"While a story of a toothbrush DDoS botnet taking down a site is amusing (and almost definitely untrue), it’s still a good reminder that threat actors would target any Internet-exposed device. This includes routers, servers, programmable logic controllers (PLCs), printers, and web cameras."
Might add, the only winning move is not to play. When possible and practical, keep it offline. https://www.bleepingcomputer.com/news/security/no-3-million-electric-toothbrushes-were-not-used-in-a-ddos-attack/

2024-02-05 17:52:59

Reading through this report from Access Now and Citizen Lab concerning the use of mercenary spyware on Jordanian civil society and journalists. Interestingly, they also mention the use of Apple's "lockdown mode" for iPhones, "appears to have blocked some attempts to compromise Apple devices with Pegasus." https://www.accessnow.org/publication/between-a-hack-and-a-hard-place-how-pegasus-spyware-crushes-civic-space-in-jordan/

2024-02-01 19:13:32

Via @npub1lsl…9c2x: cybersecurity training and alleged "hack for hire" firm, Appin, has a history of attempting (sometimes successfully) to silence journalism about the firm with legal threats. It seems to be backfiring. https://www.techdirt.com/2024/02/01/sorry-appin-were-not-taking-down-our-article-about-your-attempts-to-silence-reporters/

2024-01-25 18:11:52

A fun news story going around: HP's CEO says using third-party ink cartridges brick your HP printer because of the risk of malicious cartridges. So they are gouging you for printer ink that costs more than human blood AND their CEO is saying their printers don't mitigate the most basic security risks.
So just get a Brother laser printer. End this once and for all. Reenact the Office Space printer scene with your HP. Settle your spiritual well-being. Brother laser printer https://www.theverge.com/23642073/best-printer-2023-brother-laser-wi-fi-its-fine

2024-01-08 18:36:32

Nice. @npub174k…97q2 at Wirecutter / @npub1je7…0rgu did a good writeup on recommended security keys. Spoiler: Yes, the top picks are USB Type-C and NFC-friendly YubiKeys. https://www.nytimes.com/wirecutter/reviews/best-security-keys/

2024-01-05 22:30:40

We're trying something new at @npub1l8d…rlx0: To better cut out third parties and talk directly to you, we are making it even easier to read our newsletters. Check out our newsletters here (and of course, subscribe to get them in your inbox!): https://freedom.press/newsletter/

2024-01-03 22:17:29

In a letter sent to 23andMe users suing the company, the company said “users negligently recycled and failed to update their passwords following these past security incidents, which are unrelated to 23andMe.”
Security is hard. But you control your infrastructure; your users don't control it. Companies should work to redress harms to users when they happen, not kick victims while they're down. https://techcrunch.com/2024/01/03/23andme-tells-victims-its-their-fault-that-their-data-was-breached/

2023-10-31 20:22:30

Hey, when you donate to @npub1l8d…rlx0 you're also making it possible for me to spend my days supporting journalists on their digital security needs through research, writing security resources, and organizing digital security trainings for the community instead of doing a capitalism. Support our work! https://freedom.press/donate/

2023-10-23 17:27:16

If you like our digital security digest newsletter (https://fpf.training/subscribe) but you want it to be *audio* we've got you covered: https://freedom.press/training/audio-every-season-is-spooky-season-with-metas-chatbot-ai/

2023-10-10 20:59:27

"If any of these bills pass, platforms may stop offering encryption altogether. That would make everyone — including journalists and their sources — less safe when they communicate online."
https://freedom.press/news/bills-threaten-encrypted-platforms-used-by-journalists/

2023-08-30 19:54:12

"A fake version of the private messaging app Signal has found a way onto Google Play and appears to be linked to a Chinese spy operation, researchers claimed on Wednesday." https://www.forbes.com/sites/thomasbrewster/2023/08/30/malicious-signal-app-planted-on-google-play-by-china-linked-cyber-spies/

2023-08-17 18:07:11

Signal is becoming one of the most popular ways for newsrooms to get tips. It's easy enough to set up on your personal device, but having an institutional tip account is another thing entirely.
Here's how to overcome challenges when setting up @npub1qml…mdus tiplines, based on a recent case study with @npub1zhz…v9zk and our @npub1l8d…rlx0 digital security training team's previous experience. https://freedom.press/training/blog/signal-tiplines/

2023-08-16 15:20:43

"I don't believe this is encrypted so I think we’re OK," a Marion, Kansas police officer said during a raid on the Marion County Record newsroom.
This event underscores the need for media orgs to protect devices and data, and how encryption can help. https://freedom.press/training/blog/marion-record-police-raid/

2023-08-10 18:50:10

New topics-based behavioral ads in Chrome just dropped, and it's enabled by default.
If you use Chrome and want to disable new ad settings click the three-dot menu at the top right corner > Settings > Privacy and Security > Ad privacy.
https://files.mastodon.social/media_attachments/files/110/866/803/322/056/812/original/1579aaa93505244c.png

2023-07-12 16:44:39

This is wild. The French Parliament overwhelmingly voted in favor of a police reform bill that would give the state invasive new powers.
"French police should be able to spy on suspects by remotely activating the camera, microphone and GPS of their phones and other devices, lawmakers agreed" https://www.lemonde.fr/en/france/article/2023/07/06/france-set-to-allow-police-to-spy-through-phones_6044269_7.html

2023-07-11 16:35:47

New from my team at @npub1l8d…rlx0: A selection of our most popular guides are now available in Spanish!
¡Una selección de nuestras guías más populares ahora están disponibles en español! https://freedom.press/training/guias-en-espanol/
#NAHJ2023
https://files.mastodon.social/media_attachments/files/110/696/396/211/045/839/original/cda7d54567aa8e1d.png

2023-06-05 22:47:09

Via @npub1lsl…9c2x: "Twitter’s filing is like a beat-by-beat debunking of the conspiracy theories pushed by the dude who owns Twitter. It’s really quite incredible." https://www.techdirt.com/2023/06/05/twitter-admits-in-court-filing-elon-musk-is-simply-wrong-about-government-interference-at-twitter/

2023-04-27 14:14:46

Welcoming signal boosts: Come work on my team!
We are hiring a Senior Digital Security Trainer. You'll work with journalists, media organizations, whistleblowers and other mission-aligned groups to develop their digital security hygiene.
Many of us have nontraditional backgrounds in security, so we intend to cast a wide net. Even if you don't think you fully match the job description, if you're excited about it we want to hear from you. Apply by 5/15! https://grnh.se/4bd2fe535us

2023-03-15 17:27:16

Everyone I know who works in security has seen Some Stuff. But I've never seen a website that told users you must remove two-factor authentication.
https://files.mastodon.social/media_attachments/files/110/028/460/670/576/578/original/9c592c3b702dd3fa.png