privacy issues Archives

Winsage

August 7, 2026

Exclusive: Turbo VPN releases emergency Windows update after TechRadar uncovers persistent IP leaks

Turbo VPN's Windows client has faced significant privacy issues, including active IP leaks and misconfigured protocols. Owned by Innovative Connecting Pte. Limited in Singapore, it has over 500 million downloads on Android. Initial testing revealed that version 3.6.0.0 did not resolve IPv6 address leaks, despite IPv4 addresses being masked. A subsequent update, version 3.7.0.0, successfully blocked unencrypted IPv6 traffic while maintaining IPv4 masking. Testing showed that the proprietary protocol Lepus functions differently from standard VPNs, routing non-browser data through a local proxy without encryption. Turbo VPN's response indicated that the observed issues were limited to specific network configurations, and they have since implemented improvements in the latest version. However, detailed information about their proprietary protocols remains unavailable.

AppWizard

August 5, 2026

Developers: Beware of Ad Libraries that Betray Your Users’ Location

Advertising companies provide software development kits (SDKs) for mobile app monetization, which often automatically transmit users' location data to ad systems and location data brokers, raising privacy concerns. Many developers and users may be unaware of this data sharing. When developers allow SDKs to collect location data, it poses risks beyond targeted ads, including potential misuse by agencies like ICE and global surveillance. Location data brokers harvest precise movements of individuals, often without their consent, through mobile applications. Some apps directly collaborate with data brokers, while others leak data through advertising SDKs during real-time bidding (RTB) auctions. An incident in 2025 revealed that many apps unknowingly contributed to a location data broker's database. Developers must understand their SDKs' location-sharing practices to mitigate risks. Advertising SDKs can collect location data automatically once users grant permission, without specific permissions for the SDKs themselves. Precise location data can be collected when apps have location permissions, leading to potential privacy violations. Several SDKs have been identified as collecting location data by default, increasing the risk of unintentional data leaks. The Electronic Frontier Foundation (EFF) found that four advertising SDKs collect users' location data by default when location permissions are granted. InMobi encourages location sharing for higher revenue, while BidMachine updated its documentation after EFF's inquiry, confirming precise location data collection. Verve's SDK also collects location data by default but presents a cautious narrative in its Play Store guidance. Huawei's SDK recommends obtaining location permissions to enhance revenue, with default location sharing occurring if permissions are granted. Location data can be shared without users' knowledge or meaningful consent, complicating informed consent issues. The focus on four SDKs does not imply that others adequately protect location data, as many have faced criticism for similar practices. Studies indicate that SDKs often encourage increased data collection through design and documentation, leading to minimal control for developers over data transmission. The EFF's analysis highlights that advertising SDKs incentivize location data sharing through default settings and unclear documentation. Developers should assess third-party SDKs and disable unnecessary data collection. Regulators must hold developers accountable for unlawful data sharing, while legislators should enact laws to protect location privacy and address online behavioral advertising, which drives data tracking.

AppWizard

August 4, 2026

Android app developers may be unwittingly sharing their users’ location data with advertisers

Mobile apps often require precise location data for functionality, but there are concerns about the unintentional sharing of this sensitive information with third parties, such as advertisers and data brokers. The Electronic Frontier Foundation (EFF) found that third-party code in apps may collect location data without users' explicit consent due to default settings in software development kits (SDKs). Unless developers disable this feature, SDKs inherit app permissions, leading to the collection of users' location data. This raises privacy issues, as users' location histories can be sold to data brokers and potentially accessed by military and intelligence agencies. The EFF identified that certain Android apps, downloaded over 60 million times, were sharing location data without user awareness. Currently, there are no SDK-specific location permissions, meaning that consent to share location data with an app also extends to advertisers. The EFF calls for a change in industry standards to prevent default data sharing by advertising SDKs.

Winsage

July 30, 2026

Microsoft Quietly Adds New Windows App That Wants to Scan Your Face

Microsoft has started rolling out a new application called OneDrive Photos to select Windows 11 PCs, which automatically indexes local photo libraries and enhances user experience with AI-driven search capabilities and optional facial grouping features. The app can identify and showcase images stored locally, even without a Microsoft account, and provides AI-powered search functionality for locating photos through natural-language queries and optical character recognition. It includes a People feature that groups similar faces while ensuring privacy, with the option to disable it. OneDrive Photos is integrated with the existing OneDrive client and cannot be uninstalled independently; users must uninstall OneDrive entirely to remove the app. Microsoft has not commented on the rollout.

Winsage

July 21, 2026

LG monitors criticized for silently installing McAfee ads via Windows Update

LG monitors have been reported to automatically install an application promoting paid subscriptions to McAfee antivirus software when connected to Windows PCs. This occurs via the LG Monitor App Installer, which is delivered through Windows Update without user approval. The app installs itself seamlessly upon connection and has been noted to present McAfee promotional offers on 31 out of 32 system boots. It operates with "runFullTrust" permissions, allowing it to launch at startup and display ads after system reboots. Reports of this behavior date back to at least 2024, affecting even older LG monitors. Users can remove the app through Windows Settings and disable startup entries, while Windows Pro and Enterprise users can implement a policy to block automatic downloads of applications linked to device metadata.

Tech Optimizer

July 10, 2026

Gen Digital stock holds steady as cybersecurity demand supports long term growth

Gen Digital is a publicly traded company focused on cybersecurity and digital privacy solutions, primarily targeting consumers and small businesses. The company generates revenue through recurring subscriptions for its security and identity protection services, which include antivirus software, VPN services, and identity monitoring. Gen Digital's business model relies on bundling multiple security features into comprehensive offerings, providing predictable revenue and stability in cash flows. The company emphasizes continuous updates to its services to protect against evolving cybersecurity threats. Its growth prospects are linked to trends in cybersecurity spending and the increasing adoption of subscription-based solutions. Gen Digital differentiates itself from competitors by focusing on individual devices and home networks rather than large enterprises. The company also benefits from distribution partnerships that help expand its customer base. Long-term demand for its products is driven by digitalization, cyber risks, and growing consumer awareness of privacy issues. Gen Digital's stock performance is influenced by both company-specific factors and broader market trends in technology and cybersecurity.

Winsage

June 5, 2026

Microsoft dropped Copilot+ PC branding for Windows 11’s most powerful AI laptop, and nobody complained

In May 2024, Microsoft launched Copilot+ PCs featuring local AI acceleration and Qualcomm's Snapdragon X Elite chips. However, during the introduction of the Surface Laptop Ultra, powered by NVIDIA’s RTX Spark platform, Microsoft did not mention the Copilot+ branding. The Surface Laptop Ultra is described as the most powerful AI-centric Windows laptop, yet it lacks the Copilot+ label, raising questions about the branding strategy. Initially, Copilot+ PCs were marketed as the fastest and most intelligent Windows PCs, requiring specific hardware specifications. The Recall feature, intended as a "photographic memory," faced privacy issues, leading to its retraction and redesign. In 2025, Microsoft integrated Copilot into various Windows applications, resulting in user backlash and a decline in the brand's perception. The Surface Laptop Ultra is confirmed as a Copilot+ PC internally, but Microsoft chose not to use the branding publicly, likely due to NVIDIA's branding interests. Additionally, inconsistencies in hardware requirements for Copilot+ PCs have created confusion among consumers. Microsoft may need to consider a rebranding of Windows as it focuses on local AI development and improving performance.

AppWizard

May 28, 2026

This secure email service just gave me a real reason to ditch Gmail

Proton Mail now allows users to import Gmail emails directly into the app, enabling them to send emails from their Gmail address within Proton Mail. This feature removes trackers and ads from emails, enhancing user privacy. Users can link their Gmail accounts through the Easy Switch section in Proton Mail settings, and Proton assures that this connection does not give Google access to their Proton Mail inbox. Emails exchanged between linked Gmail accounts using Proton Mail can achieve end-to-end encryption, preventing Google from using email interactions for advertising profiling. However, Google can still access emails that remain in Gmail inboxes. The rollout of this feature is currently underway for Proton Mail users.

AppWizard

May 27, 2026

Why were Motorola phones hijacking the Amazon app? Here’s what the company says.

Motorola phones experienced an issue where launching the Amazon shopping app caused a browser window to briefly open with a dubious URL before redirecting to an Amazon affiliate link. This behavior was linked to the preloaded Smart Feed app, which was sending requests to devicenative.com, associated with Motorola’s advertising. Motorola confirmed that this behavior was unintended and has since corrected the routing configuration, ensuring that apps now launch directly as intended. The company emphasized its commitment to user experience, privacy, and platform integrity.

Winsage

April 20, 2026

“The vault is solid, the delivery truck is not” — strong key storage, shaky transfer: why this Windows Recall feature raises new security questions

Windows Recall, an AI-driven tool by Microsoft designed to capture and analyze users' screen content, was initially unveiled in 2024 but faced a delayed rollout due to significant security concerns. It launched in April 2025 with enhanced security features, including isolation within a "VBS Enclave" to protect against third-party access and filtering out sensitive information. However, security researcher Alexander Hagenah identified a flaw where data is transmitted to a less secure process, d AIXHost.exe, allowing tools like TotalRecall Reloaded to access sensitive data without administrative privileges. Despite reporting this vulnerability, Microsoft deemed it "not a vulnerability" and has not planned significant fixes. In response to user backlash, Microsoft is reassessing its AI initiatives, including Windows Recall, while privacy-focused organizations have introduced features to block the tool. Experts are calling for improved security protocols and user opt-out options.