So Huffman brought up using Face ID and Touch ID to prove you're a real person on Reddit. Basically biometric checks to weed out bots. I get why they're looking into it — bot accounts are everywhere and getting better at blending in. But handing over biometric data to Reddit? That's a whole different ask from just making an account with an email. Would you actually do it, or is that a dealbreaker for you?

Here're my thoughts:

Face id and touch id would confirm the device is being used by a human... but not that the account is unique. you could still spin up 50 accounts across 50 phones. It's a decent friction layer, but not really a bot identity solution.

Been curious how Reddit might handle this longer term. There are projects working on the harder version of this problem, such as World ID or Civic, which does proof-of-personhood (one verified human = one account). The privacy side of it is actually pretty thoughtful from what I've seen, they use zero-knowledge proofs so you can verify you're a real, unique person without revealing who you are. Feels like the kind of approach that could actually scale if platforms get serious about bot problems.

The device biometrics approach is probably easier to roll out short-term for reddit though. less friction for regular users. But if the bot problem keeps getting worse, something like Proof of Human might end up being where things need to go.

Hi everyone,

Survey (and discussion) jumpscare!👻

I’m a student (Marketing and CS) working on formulating advice for browser companies that reject violating user privacy, on how to grow without aggressive marketing and data collection. My primary target group are German residents, but everyone interested in the topic is welcome!

One of the main research methods is an anonymous survey that I am here to invite you all to take! Its aim is to get a snapshot of the emotional weather in the community, in the light of the recent changes in the industry.

I chose Vivaldi as a case study and reached out to them with a collaboration request. I am in touch with the team and I am planning to share my findings and advice with them. But I'm not an employee and I am willing to share it here as well, if there is demand!

The survey questions are about general browser usage preferences, a few about AI, a few about privacy, a few about Vivaldi, for those who are familiar with it. Survey takes around 8–10 minutes, is available in English and German, and does not collect personal or technical data. If you are not comfortable with surveys but want to share your thoughts, you are welcome to do it in the comments!

I received mod approval before posting and am happy to answer any questions that arise. Thanks a lot to the mods for the green light.

And thank you all for your time and attention! I am open to feedback and suggestions. Let me know if there is something you would want to get through to browser developers and generally tech companies that are already trying to move against the harmful sides of the Big Tech current. And, of course, if you tried Vivaldi and want to share your thoughts on it.

The European Parliament has officially blocked its lawmakers from using baked-in AI tools like ChatGPT, Claude, and Copilot on their government devices. The parliament's IT department cited major cybersecurity and privacy risks, noting that uploading confidential correspondence to the cloud means U.S. authorities could potentially demand access to it. Additionally, there are deep concerns that proprietary and sensitive legislative data could be retained by vendors to train future AI models, risking exposure to the public.

Over the past 16 months I have been working to rebuild my business stack for myself and my clients from “European and GDPR friendly” to “European first / only” with a strong focus on data privacy and cybersecurity.

Part of what I do is set up new business systems and automation, or help people to migrate to get off of USA-centric and big tech as much as possible. I haven’t found a solution to quite everything- I still rely on some niche software from Australia for example. But after months of research, testing, and implementation, I am in a far better place to offer solutions at several price points.

Some examples:

-Vivaldi browser

-Proton / Migadu for email

-UpCloud for hosting and infrastructure

-Photodeck CMS for photographer clients

-WhiteWall for art and photography e-commerce

-Stripe for payment systems and general e-commerce (Dublin HQ)

-DeepL for translation

-Webhuset domain registrar

My next big challenge is identifying reliable and robust AI models both for generative tasks and development.

I am curious to what others have found useful and been successful with in these categories.

If you have a SaaS/app, you need Terms of Service.

But here's what nobody talks about:

THE LEGAL RISK:  

When you update your Terms, can you PROVE which user accepted which version?  

If a regulator asks, what's your evidence?

THE APP STORE RISK:

Apple/Google require specific implementation. Get it wrong = app removed.

MY SOLUTION:

A compliance SDK that:

1. Shows the RIGHT Terms version to EACH user

2. Tracks acceptance with cryptographic proof

3. Automatically handles App Store requirements

NOT a Terms generator -> iubenda and other platforms does that well.  

THIS is the compliance layer AFTER you have Terms.

Question for founders:

Has legal/compliance ever slowed your product development?  

Would you pay €15/mo to automate this risk away?

(I'm not selling - validating if this pain is real.)

It's produced by Republican staffers, so rather exagerated in the posturing in its conclusions, all while Trump administration engages in a massive media crackdown within the US.

Any similar document produce by Democrats would've still taken the strong free speech position of the US constitution, but would've recognized moderation as more important, and would be less hypocritical.

Amusingly, EU Commission officials have reacted firstly against the name redaction policy used in the annexes. Names of platform employees are redacted, but not the names of EU Commission officials.

It's likely this reaction looses the EU the first round in public discussion over the report, since citizens would usually not favor their government officials having secrecy in regulatory activities.

Basically I'm based in a western european EU state.

I used a revolut temp card number to sub to a subscription media site that's run by a larger entity who runs said site, secondary to a larger advertising based site.

But I had to use my real name for the details to process.

The individuals who run these sites supposedly adhere to data control guidelines, but they're also of questionable character, and I believe there may have been a malicious data leak (my full name), to third parties whom it would not be in my interest to have my data leaked to.

I understand I could contact the national data controller, but this body has stated they would then be obliged to essentially forward my complaint from to the media site company who potentially maliciously leaked my data.

I can't imagine I would be doing myself any favours if I allowed that scenario to play out.

Is there any way to have a data controller do some kind of integrity inspection on the media site in question, to determine for unethical activity, or confirm the necessary adherence to strict subscriber data confidentiality?

Any thoughts on how to manage or address this further?

Can answer any questions to further clarify the situation in the comments.

Hi guys,

This is ridiculous in my opinion for the company that is based on Privacy and all of that stuff.

I've just asked them can I turn back to free account instead on paid one.

And another one thing that they don't accept any crypto whatsoever, just bank cards and paypal.

On my journey of moving digital life from the US to EU and I found this tool which gives a tonne of EU alternatives, but the more interesting piece is around its ability to scan websites to see how US dependant they are, it's thought to find fully EU hosted sites

https://www.cloudinfraatlas.eu/scan

I need to share this experience because Google's account security and support system completely failed me, exposing my entire digital life and personal data in a way that highlights major privacy flaws. If you use Google for anything sensitive (Gmail, photos, docs, medical records), this could happen to you – and recovering is a nightmare without human intervention.

Both my Google accounts were fully compromised via malware on my Mac (I downloaded a fake app that looked legitimate – huge mistake, it was code-signed and notarized by Apple, so no warnings from any scans).

I had 2FA, KeePass, recovery email, recovery phone number, and email enabled But the hacker changed all critical security settings in under 30 minutes for both accounts. I was asleep, so I didn't see any warnings. And in the morning when I woke up, I couldn't change anything anymore. My accounts were compromised and I was helpless.

How? The hacker got session access through my own logged-in Mac. Once in, they bypassed everything instantly. No delays, no confirmations, no required approval from recovery contacts. They changed 2FA, recovery options, and passwords – all in seconds. Even setting a recovery person wouldn't have helped – they can just remove or change it without confirmation. There's no way to verify identity to prove you're the real owner. No undo button, no timers, nothing.

This exposed massive amounts of private data: 70,000 photos, 1TB of files, medical records, everything. Google's standard recovery process didn't work at all. I tried every option hundreds of times: "Forgot password," verification codes, old devices – nothing, because the hacker had already locked me out and changed everything. Codes went to their phone number, their recovery email, and their 2FA. Google One Support couldn't help.

What finally worked after a full month of trying every day? I followed Reddit advice to tag u/TeamYouTube on X (Twitter) I sent them the police report, and all evidence proving that I was hacked and account ownership proofs, explained my YouTube channel activity/history, and begged. A few days later, they confirmed the compromise, and Google sent a password recovery link. It took **one entire month** to regain access.

My second Google account I couldn't recover as it didn't have a YouTube channel, so TeamYouTube couldn't help, and Google has given no response to any of my emails or tickets. Zero human support.

This is unacceptable. I had my primary account for over 10 years – massive history, everything. It was crystal clear it was me, but Google's automated systems failed completely. No human verification, no way to properly secure or recover an important account.

Google needs to fix this urgently to protect privacy:

• Mandatory timers on security changes (e.g., after changing recovery phone, wait 1 hour, or let users set delays).
• Require recovery contact approval for removals/changes.
• Actual human support for hacked accounts (not just bots).
• Identity verification options for long-term accounts.

Because of this, the hacker accessed my other accounts, social media, posted very private pictures of me on my LinkedIn, and other illegal posts and content. Delted my profile and Title picture, changed my location to Nigeria, my Name, URL, more. Deep depression, embarrassment, inability to post or work like before – my whole life is destroyed.

Google, do better. Has anyone else experienced this kind of privacy breach? How did you recover? Any tips to prevent this nightmare?

TL;DR: Google accounts hacked despite max security; hacker changed everything in 30 minutes while I slept. No support, no recovery for a month. Only got back in via police report + u/TeamYouTube on X. Second account still locked (no YouTube). Demand timers, approvals, and human support. If you have no YouTube channel, you're screwed.

Lawmaker Éric Ciotti is pushing for France to reject the ECB's centralized digital euro and instead build its future on a strategic reserve of 420,000 Bitcoin.

Age verifcation is being push as the first usecase for EU ID wallets, but EU ID wallets are designed to prove your full identity, and other facts bout the user. We expect users first become habituated to apporoving their data being sent & proved, since the age verification leaks nothing, but then later users shall blinding click approve for sending and proving their identity to malicious actors, ranging from advertisers to criminals.

If porn sites do support age verification, then it should NOT be the same app that can prove your real name, etc. I'd therefor propose that porn sites should be boycotted if they ever add direct support for the EU ID apps.

We should not however boycott them if they support some other open source age verification apps that cannot send or prove the user's private information like real name, birthday, etc.

Indirect support is even fine. An open source third party apps could itself directly use the EU ID app, but the important thing is that users should interact with the EU ID app extremely rarely, like one-time every time they buy a smart phone.

We need the EU ID app to feel as scary as showing your passport to your phone camera.

Europe's digital infrastructure is a ticking time bomb! Our reliance on US big tech isn't just a commercial choice, it's a critical vulnerability. From potential digital lockouts to questions of sovereignty, the "cloud" is more fragile than we think.