Member of the Lockdown Systems Collective making @cyd@infosec.exchange — writing at https://micahflee.com — author of HACKS, LEAKS, AND REVELATIONS https://hacksandleaks.com
Posts
Cyd for Bluesky is here! I’ve been working on this for months, and also using it on my own account for months. Here are my settings:
- Delete posts older than 30 days unless they have at least 20 likes or 20 reposts
- Delete reposts older than 30 days
- Delete likes older than 30 days
- Delete chat messages older than 21 days
At some point I want to add Mastodon support too, but it’s slow going
You all should read Privacy's Defender: My Thirty-Year Fight Against Digital Surveillance by Cindy Cohn, @eff@mastodon.social 's Executive Director. Here's my fav part https://micahflee.com/read-cindy-cohns-new-book-privacys-defender-my-thirty-year-fight-against-digital-surveillance/
Eight password reset emails in a row that I didn’t trigger from Instagram. From my dormant, locked account that uses an anonymized email address. Nothing to be suspicious about right?
We're getting ready to release Facebook support for @cyd@infosec.exchange ! Want to beta test it? Read this and fill out the form by this weekend if you're interested https://nextcloud.lockdown.systems/apps/forms/s/qpMYtoeGKBedbfYk2iX5jQ9o
DHS's Office of Industry Partnership was hacked by a group called "Department of Peace" and info about ICE contracts with over 6,000 companies is now published on @ddosecrets.org!
I wrote about how to use Signal nicknames so that you don't have to be confused about who everyone is in all of your Signal groups https://micahflee.com/are-your-signal-groups-full-of-people-name-things-like-l-or-sinicknames/
👀 A New Anonymous Phone Carrier Lets You Sign Up With Nothing but a Zip Code https://www.wired.com/story/new-anonymous-phone-carrier-sign-up-with-nothing-but-a-zip-code/
How to easily dig through the Epstein files yourself https://micahflee.com/how-to-easily-dig-through-the-epstein-files-yourself/
I made a little project called Claudito (little Claude, in a sandbox) that runs Claude Code in a docker container, isolating it from your filesystem, your SSH keys, etc. Check it out: https://github.com/micahflee/claudito
Watch my BSidesPDX keynote where I spoke honestly and frankly about the terrifying reality that Americans are facing under Trump's fascist regime, alongside practical advise for communities to defend themselves https://micahflee.com/practical-defenses-against-technofascism/
I was interviewed on the Kill Switch podcast about ICEBlock app, the mutual aid group NorCal Resist, and the insane situation we’re in where Apple and Google are collaborating with Trump to censor apps at will https://podcasts.apple.com/us/podcast/kill-switch/id1449757372?i=1000732939606
In war-torn Portland? Watch me speak at BSidesPDX! https://micahflee.com/in-war-torn-portland-watch-me-speak-at-bsidespdx/
Proton Mail suspended the account of a journalist writing for the hacker zine Phrack at the request of a cybersecurity agency, only reinstating the account after public outcry https://theintercept.com/2025/09/12/proton-mail-journalist-accounts-suspended/
I told Joshua Aaron, developer of ICEBlock, that he was running a vulnerable version of Apache on his server. He ignored my vulnerability report and blocked me, and his service is still vulnerable today https://micahflee.com/iceblock-handled-my-vulnerability-report-in-the-worst-possible-way/
Italian dockworkers threaten Israel cargo ban if Gaza flotilla blocked https://www.politico.eu/article/italian-dockworkers-threaten-israel-cargo-ban-gaza-flotilla-departs-genova/
I wrote about the ICEBlock app, the developer's infuriating HOPE talk, and how it's unfortunately basically activism theater https://micahflee.com/unfortunately-the-iceblock-app-is-activism-theater/
My DEFCON talk "We are currently clean on OPSEC" now has over 30k views on YouTube, so now more people watched my talk than attended DEFCON itself. If you haven't seen it, please do! The Trump admin's incompetence is mindbogglingly BONKERS https://www.youtube.com/watch?v=KFYyfrTIPQY
Lockdown Systems spoke at HOPE (me, @redshiftzero@mastodon.social and @yaelwrites@mastodon.social)! Watch it here: Claw Back Your Data With @cyd@infosec.exchange https://www.youtube.com/watch?v=qnbwTlT-DP0
I just added a copy of my slides for my "We are currently clean on OPSEC" DEFCON talk here, in case you're interested https://micahflee.com/we-are-currently-clean-on-opsec-the-signalgate-saga/
Check out my #DEFCON33 talk about the Signalgate, full of unbelievable incompetence from the highest levels of the Trump administration https://www.youtube.com/watch?v=KFYyfrTIPQY
I wrote about how to turn in-person meetings into Signal groups, how to manage large semi-public Signal groups while vetting new members, and how to use announcement-only Signal groups, perfect for rapidly responding to ICE raids https://micahflee.com/using-signal-groups-for-activism/
Here's how the TM SGNL server, which had access to plaintext chat logs from people like Mike Waltz, got hacked in about 20 minutes https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/ (my first article in WIRED!)
If you have a New Year's resolution to finally ditch X/Twitter/Elon, here is a step-by-step guide for how to do it while still keeping your username, and letting your followers where to find you next https://cyd.social/want-to-quit-x-in-2025-heres-how-to-do-it-the-right-way-with-cyd/ using @cyd@infosec.exchange
"Apple has agreed to pay $95 million to settle a lawsuit alleging that its voice assistant Siri routinely recorded private conversations that were then sold to third parties for targeted ads." https://arstechnica.com/tech-policy/2025/01/apple-agrees-to-pay-95m-delete-private-conversations-siri-recorded/
Support for federation in Bluesky just dropped https://bsky.social/about/blog/02-22-2024-open-social-web
You ever really want to open a sketchy document to see what’s in it, but you also don’t want to get hacked? Dangerzone @dangerzone@fosstodon.org is what you need. It takes potentially dangerous PDFs, office documents, or images and convert them to safe PDFs using sandboxes https://dangerzone.rocks/
I just did my first Capture the Flag with the help of OpenAI's GPT-4 and it kind of blew my mind. Here's a detailed writeup of three challenges, including one that GPT-4 just straight up solved for me https://micahflee.com/2023/04/capturing-the-flag-with-gpt-4/