After analyzing 275,699,516 passwords leaked during 2020 data breaches, NordPass and partners found that the most common passwords are incredibly easy to guess -- and it could take less than a second or two for attackers to break into accounts using these credentials. Only 44% of those recorded were considered "unique." ZDNet reports: On Wednesday, the password manager solutions provider published its annual report on the state of password security, finding that the most popular options were "123456," "123456789," "picture1," "password," and "12345678." With the exception of "picture1," which would take approximately three hours to decipher using a brute-force attack, each password would take seconds using either dictionary scripts -- which compile common phrases and numerical combinations to try -- or simple, human guesswork.

As one of the entrants on the 200-strong list describes the state of affairs when it comes to password security, "whatever," it seems many of us are still reluctant to use strong, difficult-to-crack passwords -- and instead, we are going for options including "football," "iloveyou," "letmein," and "pokemon." When selecting a password, you should avoid patterns or repetitions, such as letters or numbers that are next to each other on a keyboard. Adding a capital letter, symbols, and numbers in unexpected places can help, too -- and in all cases, you should not use personal information as a password, such as birthdates or names.

An anonymous reader quotes a report from Are Technica: The Federal Communications Commission today voted to add 45MHz of spectrum to Wi-Fi in a slightly controversial decision that takes the spectrum away from a little-used automobile-safety technology. The spectrum from 5.850GHz to 5.925GHz has, for about 20 years, been set aside for Dedicated Short Range Communications (DSRC), a vehicle-to-vehicle and vehicle-to-infrastructure communications service that's supposed to warn drivers of dangers on the road. But as FCC Chairman Ajit Pai today said, "99.9943 percent of the 274 million registered vehicles on the road in the United States still don't have DSRC on-board units." Only 15,506 vehicles have been equipped with the technology, he said.

In today's decision, the FCC split the spectrum band and reallocated part of it to Wi-Fi and part of it to a newer vehicle technology. The lower 45MHz from 5.850GHz to 5.895GHz will be allocated to Wi-Fi and other unlicensed services. "This spectrum's impact will be further amplified by the fact that it is adjacent to an existing Wi-Fi band which, when combined with the 45MHz made available today, will support cutting-edge broadband applications," the FCC said. "These high-throughput channels -- up to 160 megahertz wide -- will enable gigabit Wi-Fi connectivity for schools, hospitals, small businesses, and other consumers." "Full-power indoor unlicensed operations" are authorized immediately, while "outdoor unlicensed use" will be allowed "on a coordinated basis under certain circumstances," the FCC said. The FCC ordered DSRC services to vacate the lower 45MHz within one year.

The other 30MHz currently allocated to DSRC is being set aside for a newer vehicle-safety technology called Cellular Vehicle-to-Everything (C-V2X). "Today's action therefore begins the transition away from DSRC services -- which are incompatible with C-V2X -- to hasten the actual deployment of ITS [Intelligent Transportation Systems] services that will improve automotive safety," the FCC said. The FCC still has to finalize technical rules for outdoor unlicensed operations on the lower 45MHz and for how to transition the upper 30MHz from DSRC to C-V2X. Freeing up 45MHz "will supersize Wi-Fi, a technology so many of us are relying on like never before," said FCC Democrat Jessica Rosenworcel. Meanwhile, FCC Democrat Geoffrey Starks called the spectrum reassignment an important step toward reducing congestion "and ensuring that we realize the full potential of our broadband connections."

In addition to improving home Wi-Fi, the extra 45MHz will benefit public Wi-Fi networks that are relied upon by many people without good Internet access at home, he said.

Google said today it plans to add a new section on the Chrome Web Store where extension developers will disclose what user data they're collecting from users and what they plan to do with the information. From a report: The new section is set to go into effect on January 18, 2021, and will appear as a "Privacy practices" button on each extension's Web Store listing. To aid the process, Google has added a new section today in the Web Store dashboard where extension developers will be able to disclose what data they collect from their users and for what purposes.

Hmmmmmm shares a report: U.S. Federal Aviation Administration (FAA) chief Steve Dickson is "100% confident" in the safety of the Boeing 737 MAX but says the airplane maker has more to do as it works to improve its safety culture. Dickson on Wednesday signed an order to allow the best-selling plane to resume flights after it was grounded worldwide in March 2019 following two crashes that killed 346 people and led to Boeing's biggest crisis in decades. The order will end the longest grounding in commercial aviation history and paves the way for Boeing to resume U.S. deliveries and commercial flights by the end of the year. "We've done everything humanly possible to make sure" these types of crashes do not happen again," FAA Administrator Dickson told Reuters in a 30-minute telephone interview, adding the design changes "have eliminated what caused these particular accidents." The FAA is requiring new training to deal with a key safety system called MCAS that is faulted for the two fatal crashes as well as significant new safeguards and other software changes. "I feel 100% confident," said Dickson, a former airline and military pilot, who took over as FAA administration in August 2019 and took the controls for a 737 MAX test flight in September. In a video message released on Wednesday, he said that the 20-month review was "long and grueling, but we said from the start that we would take the time necessary to get this right." Dickson said he emphasized to Boeing the importance of safety. "I understand they have a business to run but they don't have anything if they don't have a safe product," Dickson said. Dickson suggested Boeing has more to do to improve safety.

New submitter dskoll shares a report from CBC.ca: New privacy legislation has been submitted to the Canadian parliament that could fine companies up to 5% of global revenue or $25 million, whichever is greater, for violating Canada's privacy laws. According to Innovation Minister Navdeep Bains, The Digital Charter Implementation Act provides for the heaviest fines among the G7 nations' privacy laws. "The fines are there to provide accountability," Bains said.

The legislation also would give the federal privacy commissioner order-making powers, including the ability to force an organization to comply and to order a company to stop collecting data or using personal information. "Bains said the commissioner also would be able to recommend fines to a new Personal Information and Data Protection Tribunal, which would levy administrative monetary penalties and hear appeals of orders issued under the new law," adds CBC.ca. "According to the wording of a government press release, the legislation also would give Canadians the option of demanding that their personal online information be 'destroyed.'"

phalse phace shares a report from NPR: Christopher Krebs, the Department of Homeland Security director who had spearheaded a campaign to counter rumors about voter fraud, has been fired, President Trump tweeted on Tuesday. Trump, in two misleading tweets about the security of the U.S. election, said Krebs' termination was "effective immediately."

The CISA campaign, led by Krebs, was originally intended to target foreign interference. However, as the president continued to repeat dangerously misleading information about the security of the election, the agency's focus turned to rebutting many of the rumors and baseless allegations of widespread voter fraud that Trump had promoted from the White House. In response, Krebs tweeted, "Honored to serve. We did it right. Defend Today, Secure [Tomorrow]." As NPR points out, Krebs' firing came after his agency, the Cybersecurity and Infrastructure Security Agency (CISA), last week released a statement calling the 2020 election "the most secure in American history."

Trump's full tweet reads: "The recent statement by Chris Krebs on the security of the 2020 Election was highly inaccurate, in that there were massive improprieties and fraud -- including dead people voting, Poll Watchers not allowed into polling locations, 'glitches' in the voting machines which changed votes from Trump to Biden, late voting, and many more. Therefore, effective immediately, Chris Krebs has been terminated as Director of the Cybersecurity and Infrastructure Security Agency."

An anonymous reader shares a report: Google was sued last week for allegedly stealing Android users' cellular data allowances through unapproved, undisclosed transmissions to the web giant's servers. The lawsuit, Taylor et al v. Google, was filed in a US federal district court in San Jose on behalf of four plaintiffs based in Illinois, Iowa, and Wisconsin in the hope the case will be certified by a judge as a class action. The complaint contends that Google is using Android users' limited cellular data allowances without permission to transmit information about those individuals that's unrelated to their use of Google services. Data sent over Wi-Fi is not at issue, nor is data sent over a cellular connection in the absence of Wi-Fi when an Android user has chosen to use a network-connected application. What concerns the plaintiffs is data sent to Google's servers that isn't the result of deliberate interaction with a mobile device -- we're talking passive or background data transfers via cell network, here. "Google designed and implemented its Android operating system and apps to extract and transmit large volumes of information between Plaintiffs' cellular devices and Google using Plaintiffs' cellular data allowances," the complaint claims. "Google's misappropriation of Plaintiffs' cellular data allowances through passive transfers occurs in the background, does not result from Plaintiffs' direct engagement with Google's apps and properties on their devices, and happens without Plaintiffs' consent." The allegation: "The device, stationary, with all apps closed, transferred data to Google about 16 times an hour, or about 389 times in 24 hours. Assuming even half of that data is outgoing, Google would receive about 4.4MB per day or 130MB per month in this manner per device subject to the same test conditions."

Micropayments company Coil has emailed users its new privacy policy but placed hundreds of their addresses in the "To:" field and therefore breached their privacy. From a report: The mail had the Subject line "Updates to Coil's Terms and Privacy Policy" and offered links to the document. The Register has read it and can report that while it reveals that Coil seeks permission to share users' details with service providers, partners, and "related entities." We cannot find a clause that resembles: "We reserve the right to expose your email address to countless other Coil users in the 'To:' field of an email."

An Austrian privacy advocacy group drew a strongly critical response from Apple on Monday after it said an online tracking tool used in its devices breached European law. From a report: The group, led by campaigner Max Schrems, filed complaints with data protection watchdogs in Germany and Spain alleging that the tracking tool illegally enabled the $2 trillion U.S. tech giant to store users' data without their consent. Apple directly rebutted the claims filed by Noyb, the digital rights group founded by Schrems, saying they were "factually inaccurate and we look forward to making that clear to privacy regulators should they examine the complaint." Schrems is a prominent figure in Europe's digital rights movement that has resisted intrusive data-gathering by Silicon Valley's tech platforms. He has fought two cases against Facebook, winning landmark judgments that forced the social network to change how it handles user data. Noyb's complaints were brought against Apple's use of a tracking code, known as the Identifier for Advertisers (IDFA), that is automatically generated on every iPhone when it is set up.

An anonymous reader quotes a report from The New York Times: The Trump administration on Monday announced that it would begin the formal process of selling leases to oil companies in a last-minute push to achieve its long-sought goal of allowing oil and gas drilling in the Arctic National Wildlife Refuge in Alaska. That sets up a potential sale of leases just before Jan. 20, Inauguration Day, leaving the new administration of Joseph R. Biden Jr., who has opposed drilling in the refuge, to try to reverse them after the fact.

The Arctic refuge is one of the last vast expanses of wilderness in the United States, 19 million acres that for the most part are untouched by people, home instead to wandering herds of caribou, polar bears and migrating waterfowl. It has long been prized, and protected, by environmentalists, but President Trump has boasted that opening part of it to oil development was among the most significant of his efforts to expand domestic fossil fuel production. The Federal Register on Monday posted a "call for nominations" from the Bureau of Land Management, to be officially published Tuesday, relating to lease sales in about 1.5 million acres of the refuge along the coast of the Arctic Ocean. A call for nominations is essentially a request to oil companies to specify which tracts of land they would be interested in exploring and potentially drilling for oil and gas.

The administration's announcement establishes a tight timeline for lease sales, with the earliest they could occur being on or about Jan. 17. The call for nominations will allow for comments until Dec. 17, after which the bureau, part of the Interior Department, could issue a final notice of sales to occur as soon as 30 days later. Normally the bureau would take time to review the comments and determine which tracts to sell before issuing the final notice of sale, a process that can take several months. In this case, however, the bureau could decide to make the entire coastal plain available and issue the notice immediately. Any sales would be subject to review by agencies in the Biden administration, including the bureau and the Justice Department, a process that could take a month or two. That could allow the Biden White House to refuse to issue the leases, perhaps by claiming that the scientific underpinnings of the plan to allow drilling in the refuge were flawed, as environmental groups have claimed.

"[I]n the coming weeks," Google will show a new blanket setting to "turn off smart features" which will disable features like Smart Compose, Smart Reply, in apps like Gmail; the second half of the same prompt will disable whether additional Google products -- like Maps or Assistant, for example -- are allowed to be personalized based on data from Gmail, Meet, and Chat. Gizmodo reports: Google writes in its blog post about the new-ish settings that humans are not looking at your emails to enable smart features, and Google ads are "not based on your personal data in Gmail," something CEO Sundar Pichai has likewise said time and again. Google claims to have stopped that practice in 2017, although the following year the Wall Street Journal reported that third-party app developers had freely perused inboxes with little oversight. (When asked whether this is still a problem, the spokesperson pointed us to Google's 2018 effort to tighten security.)

A Google spokesperson emphasized that the company only uses email contents for security purposes like filtering spam and phishing attempts. These personalization changes aren't so much about tightening security as they are another informed consent defense which Google can use to repel the current regulatory siege being waged against it by lawmakers. [...] Inquiries in the U.S. and EU have found that Google's privacy settings have historically presented the appearance of privacy, rather than privacy itself. [...] So this is nice, and also Google's announcement reads as a letter to regulators. "This new setting is designed to reduce the work of understanding and managing [a choice over how data is processed], in view of what we've learned from user experience research and regulators' emphasis on comprehensible, actionable user choices over data."

GitHub has reinstated today the youtube-dl open-source project, a Python library that lets users download the source audio and video files behind YouTube videos. From a report: GitHub, a code-hosting repository, had previously removed the library from its portal after it received a controversial DMCA takedown request from the Recording Industry Association of America (RIAA) on October 23. In a DMCA takedown letter, RIAA argued that the library was being used to "circumvent the technological protection measures used by authorized streaming services such as YouTube" and to allow users to "reproduce and distribute music videos and sound recordings [...] without authorization." RIAA also noted that the project's source code "expressly suggests its use to copy and/or distribute the following copyrighted works." More specifically, RIAA used Section 1201 of the Digital Millennium Copyright Act (DMCA) to claim that the youtube-dl library was breaking copyright by providing a tool to circumvent copyrighted material -- even if the youtube-dl library didn't contain copyright-infringing code itself.

But in a blog post today, GitHub said the library did not actually break Section 1201 of the DMCA, citing a letter it received from Electronic Frontier Foundation lawyers, who to take up the youtube-dl project's case. In the letter, the EFF team explained that Google does not have any technical measures in place to prevent the download of its videos -- all of which need to be made freely available to all kinds of apps, browsers, smart TVs, and more. Hence, EFF lawyers argued that the library could never be taken down under Section 1201 of the DMCA since the library doesn't actually circumvent any sort of copyright protection system in the first place.

Joseph Cox, reporting for Motherboard at Vice: The U.S. military is buying the granular movement data of people around the world, harvested from innocuous-seeming apps, Motherboard has learned. The most popular app among a group Motherboard analyzed connected to this sort of data sale is a Muslim prayer and Quran app that has more than 98 million downloads worldwide. Others include a Muslim dating app, a popular Craigslist app, an app for following storms, and a "level" app that can be used to help, for example, install shelves in a bedroom. Through public records, interviews with developers, and technical analysis, Motherboard uncovered two separate, parallel data streams that the U.S. military uses, or has used, to obtain location data. One relies on a company called Babel Street, which creates a product called Locate X. U.S. Special Operations Command (USSOCOM), a branch of the military tasked with counterterrorism, counterinsurgency, and special reconnaissance, bought access to Locate X to assist on overseas special forces operations. The other stream is through a company called X-Mode, which obtains location data directly from apps, then sells that data to contractors, and by extension, the military.

The news highlights the opaque location data industry and the fact that the U.S. military, which has infamously used other location data to target drone strikes, is purchasing access to sensitive data. Many of the users of apps involved in the data supply chain are Muslim, which is notable considering that the United States has waged a decades-long war on predominantly Muslim terror groups in the Middle East, and has killed hundreds of thousands of civilians during its military operations in Pakistan, Afghanistan, and Iraq. Motherboard does not know of any specific operations in which this type of app-based location data has been used by the U.S. military. The apps sending data to X-Mode include Muslim Pro, an app that reminds users when to pray and what direction Mecca is in relation to the user's current location. The app has been downloaded over 50 million times on Android according to the Google Play Store, and over 98 million in total across other platforms including iOS, according to Muslim Pro's website.

Apple has updated a documentation page detailing the company's next steps to prevent last week's Gatekeeper bug from happening again. The company plans to implement the fixes over the next year. From a report: Apple had a difficult launch day last week. The company released macOS Big Sur, a major update for macOS. Apple then suffered from server-side issues. Third-party apps failed to launch as your Mac couldn't check the developer certificate of the app. That feature, called Gatekeeper, makes sure that you didn't download a malware app that disguises itself as a legit app. If the certificate doesn't match, macOS prevents the app launch. Many have been concerned about the privacy implications of the security feature. Does Apple log every app you launch on your Mac to gain competitive insights on app usage? It turns out it's easy to answer that question as the server doesn't mandate encryption. Jacopo Jannone intercepted an unencrypted network request and found out that Apple is not secretly spying on you. Gatekeeper really does what it says it does. "We have never combined data from these checks with information about Apple users or their devices. We do not use data from these checks to learn what individual users are launching or running on their devices," the company wrote.

$2 million worth of Dai was stolen Thursday from the cryptocurrency borrowing/lending service Akropolis, reports ZDNet — after which the service's admins paused all transactions. These attacks have been growing in numbers since early February this year, and one of the biggest flash loan attacks took place last month, in October, when hackers stole $24 million worth of cryptocurrency assets from decentralized finance service Harvest Finance.

The good news is that Akropolis says it has already identified the attacker's Ethereum account, which would allow it to track funds as they move around the blockchain. The DeFi platform says it already notified major cryptocurrency exchanges about the hack and the attacker's wallet in an attempt to have funds frozen and prevent the attacker from laundering funds into other forms of cryptocurrencies, lose the investigators' tracks, and cash out the funds.

Akropolis said it is currently exploring ways to reimburse users for the loss.

"Fifteen Asia-Pacific economies formed the world's largest free trade bloc on Sunday," reports CNBC, "a China-backed deal that excludes the United States, which had left a rival Asia-Pacific grouping under President Donald Trump." Amid questions over Washington's engagement in Asia, the Regional Comprehensive Economic Partnership (RCEP) may cement China's position more firmly as an economic partner with Southeast Asia, Japan and Korea, putting the world's second-biggest economy in a better position to shape the region's trade rules...

RCEP could help Beijing cut its dependence on overseas markets and technology, a shift accelerated by a deepening rift with Washington, said Iris Pang, ING chief economist for Greater China. RCEP groups the 10-member Association of Southeast Asian Nations (ASEAN), China, Japan, South Korea, Australia and New Zealand. It aims in coming years to progressively lower tariffs across many areas... RCEP will account for 30% of the global economy, 30% of the global population and reach 2.2 billion consumers, Vietnam said...

"For the first time, China and Japan reached a bilateral tariff reduction arrangement, achieving a historic breakthrough," China's finance ministry said in a statement, without giving further details. The deal marks the first time rival East Asian powers China, Japan and South Korea have been in a single free trade agreement.

New webcam-based anti-cheating monitoring is so stressful, it's made some students cry, the Washington Post reports: "Online proctoring" companies saw in coronavirus shutdowns a chance to capitalize on a major reshaping of education, selling schools a high-tech blend of webcam-watching workers and eye-tracking software designed to catch students cheating on their exams. They've taken in millions of dollars, some of it public money, from thousands of colleges in recent months. But they've also sparked a nationwide school-surveillance revolt, with students staging protests and adopting creative tactics to push campus administrators to reconsider the deals. Students argue that the testing systems have made them afraid to click too much or rest their eyes for fear they'll be branded as cheats...

One system, Proctorio, uses gaze-detection, face-detection and computer-monitoring software to flag students for any "abnormal" head movement, mouse movement, eye wandering, computer window resizing, tab opening, scrolling, clicking, typing, and copies and pastes. A student can be flagged for finishing the test too quickly, or too slowly, clicking too much, or not enough. If the camera sees someone else in the background, a student can be flagged for having "multiple faces detected." If someone else takes the test on the same network — say, in a dorm building — it's potential "exam collusion." Room too noisy, Internet too spotty, camera on the fritz? Flag, flag, flag.

As an unusually disrupted fall semester churns toward finals, this student rebellion has erupted into online war, with lawsuits, takedowns and viral brawls further shaking the anxiety-inducing backdrop of college exams. Some students have even tried to take the software down from the inside, digging through the code for details on how it monitors millions of high-stakes exams... Some students said the experience of having strangers and algorithms silently judge their movements was deeply unnerving, and many worried that even being accused of cheating could endanger their chances at good grades, scholarships, internships and post-graduation careers. Several students said they had hoped for freeing, friend-filled college years but were now resigned to hours of monitored video exams in their childhood bedrooms, with no clear end in sight....

[T]he systems' technical demands have made just taking the tests almost comically complicated. One student at Wilfrid Laurier University in Ontario shared the instructions for his online Introduction to Linear Algebra midterm: five pages, totaling more than 2,000 words, requiring students to use a special activity-monitoring Web browser and keep their face, hands and desk in view of their camera at all times...

Students who break the rules or face technical difficulties can be investigated for academic misconduct. "The instructions," the student said, "are giving me more anxiety than the test itself."
Company executives "say a semester without proctors would turn online testing into a lawless wasteland" according to the article. But one long-time teacher counters that "the most clear value conveyed to students is 'We don't trust you.'"

Yet the education tech nonprofit Educause reported that 54% of higher education institutions they'd surveyed "are currently using online or remote proctoring services.

"And another 23% are planning or considering using them."

Saturday saw 2020's virtual observation of the annual Aaron Swartz Day and International Hackathon, which the EFF describes as "a day dedicated to celebrating the continuing legacy of activist, programmer, and entrepreneur Aaron Swartz."

Its official web site notes the wide-ranging event includes "projects and ideas that are still bearing fruit to this day, such as SecureDrop, Open Library, and the Aaron Swartz Day Police Surveillance Project." The event even included a virtual session for the Atlas of Surveillance project which involved documenting instances of law enforcement using surveillance technologies like social media monitoring, automated license plate readers, and body-worn cameras. And EFF special advisor Cory Doctorow, director of strategy Danny O'Brien, and senior activist Elliot Harmon also spoke "about Aaron's legacy and how his work lives on today," according to the EFF's announcement: Aaron Swartz was a brilliant champion of digital rights, dedicated to ensuring the Internet remained a thriving ecosystem for open knowledge. EFF was proud to call him a close friend and collaborator. His life was cut short in 2013, after he was charged under the notoriously draconian Computer Fraud and Abuse Act for systematically downloading academic journal articles from the online database JSTOR.

Federal prosecutors stretch this law beyond its original purpose of stopping malicious computer break-ins, reserving the right to push for heavy penalties for any behavior they don't like that happens to involve a computer. This was the case for Aaron, who was charged with eleven counts under the CFAA. Facing decades in prison, Aaron died by suicide at the age of 26. He would have turned 34 this year, on November 8.

In addition to EFF projects, the hackathon will focus on projects including SecureDrop, Open Library, and the Aaron Swartz Day Police Surveillance Project. The full lineup of speakers includes Aaron Swartz Day co-founder Lisa Rein, SecureDrop lead Mickael E., researcher Mia Celine, Lucy Parsons Lab founder Freddy Martinez, and Brewster Kahle — co-founder of Aaron Swartz Day and the Internet Archive.
All of the presentations are now online.

"A widely used hotel reservation platform has exposed 10 million files related to guests at various hotels around the world, thanks to a misconfigured Amazon Web Services S3 bucket," reports Threatpost.

"The records include sensitive data, including credit-card details." Prestige Software's "Cloud Hospitality" is used by hotels to integrate their reservation systems with online booking websites like Expedia and Booking.com. The incident has affected 24.4 GB worth of data in total, according to the security team at Website Planet, which uncovered the bucket.

Many of the records contain data for multiple hotel guests that were grouped together on a single reservation; thus, the number of people exposed is likely well over the 10 million, researchers said. Some of the records go back to 2013, the team determined — but the bucket was still "live" and in use when it was discovered this month. "The company was storing years of credit-card data from hotel guests and travel agents without any protection in place, putting millions of people at risk of fraud and online attacks," according to the firm, in a recent notice on the issue. "The S3 bucket contained over 180,000 records from August 2020 alone...."

The records contain a raft of information, Website Planet said, including full names, email addresses, national ID numbers and phone numbers of hotel guests; card numbers, cardholder names, CVVs and expiration dates; and reservation details, such as the total cost of hotel reservations, reservation number, dates of a stay, special requests made by guests, number of people, guest names and more. The exposure affects a wide number of platforms, with data related to reservations made through Amadeus, Booking.com, Expedia, Hotels.com, Hotelbeds, Omnibees, Sabre and more....

A too-large percentage of cloud databases containing highly sensitive information are publicly available, an analysis in September found. The study from Comparitch showed that 6 percent of all Google Cloud buckets are misconfigured and left open to the public internet, for anyone to access their contents.

"EFF is launching How to Fix the Internet, a new podcast mini-series to examine potential solutions to six ills facing the modern digital landscape," announces EFF.org: Over the course of 6 episodes, we'll consider how current tech policy isn't working well for users and invite experts to join us in imagining a better future... It's easy to see all the things wrong with the modern Internet, and how the reality of most peoples' experience online doesn't align with the dreams of its early creators. How did we go astray and what should we do now? And what would our world look like if we got it right...?

In each episode, we are joined by a guest to examine how the current system is failing, consider different possibilities for solutions, and imagine a better future. After all, we can't build a better world unless we can imagine it.

We are launching the podcast with two episodes: The Secret Court Approving Secret Surveillance, featuring the Cato Institute's specialist in surveillance legal policy Julian Sanchez; and Why Does My Internet Suck?, featuring Gigi Sohn, one of the nation's leading advocates for open, affordable, and democratic communications networks. Future episodes will be released on Tuesdays.
Other topics to be covered by the podcast mini-series:

• The third-party doctrine [which asserts "no reasonable expectation of privacy"]
• Barriers to interoperable technology
• Law enforcement's use of face recognition technology
• Digital first sale and the resale of intellectual property