The Revolut leak is not a random dump, and the attackers were happy to explain why. A hacked email account on a real Italian government domain, a fake law enforcement request, and Revolut's Lithuanian bank handed over identity documents, KYC selfies, bank statements and transaction histories for at least 680 customers. Then they ran blockchain analysis and picked the accounts with significant crypto holdings. 6,000 XMR demanded, roughly three million dollars, inside twenty four hours. The deadline passed on 17 September and samples are already circulating on Telegram. You cannot warn anybody, because nobody gets told they are on the list.

Ungovernable

Breach Season Continues

A weekly news show informing you on the latest in Bitcoin, privacy and open source tech, hosted by Ungovernables, Max and Q. AOB Q: short weekend t...

"That is what I trained for and did professionally for a long time, and it's better than me and faster than me." Systems administration. Site reliability. Cybersecurity engineering. That was the career. Max asks whether it pisses him off. It does not, because he got bored of doing it years ago and would rather have the thing that makes Cake Wallet more reliable. Then the part that will land badly for a lot of people listening. "If you're a site reliability engineer or an IT engineer right now, you should be worried. Because I can do the vast majority of that simply while I'm also doing a thousand other things." @Seth For Privacy

Ungovernable

Is AI Freedom Tech? Part II

A weekly live show covering all things Freedom Tech with Max, Q and Seth. In this episode, Max chats with Seth for a wide-ranging catch-up on the s...

Prepping for Fallout / The Walking Dead? That’s not what’s coming. @Jon lays out two likely paths: • Slow decline • Digital ID, Flock cameras, 15-min cities, shock troops Prepare accordingly.

Ungovernable

RESILIENCE IS A VERB

A weekly live show covering all things Freedom Tech with Max, Q and Seth. TO DONATE TO ROMAN

Mix To is the feature more people should know about. You add a watch only wallet to Ashigaru Desktop with an xpub or an output descriptor, in this case a Passport Prime, and set a minimum number of mixes. Say five. Once a coin has been through that many, the coinjoin output goes straight to a fresh address on the hardware wallet instead of landing back in your post mix account. @Foundation No manual send, no address copied by hand, no remembering to do it later. @Foundation

Ungovernable

Ashigaru Desktop with Jordan

A weekly live show covering all things Freedom Tech with Max, Q and Seth. Thanks to Jordan for joining us to walk through Ashigaru Desktop live on ...

The reason it feels like every week now is that it is every week now. If you run a software project or a hardware project or anything that handles Bitcoin, people are attacking your shit right now. Not eventually. Right now. Think about it from their side. Steal personal information and you still have to find a buyer. Steal from the software that holds the money and you are done. It is a no brainer. Bitcoin is taking that pain first, and it comes out the other side harder for it. Expect at least another six months of this. @QnA

Ungovernable

The AI-Pocalypse Continues

A weekly news show informing you on the latest in Bitcoin, privacy and open source tech, hosted by Ungovernables, Max and Q. AOB We are now a weekl...

On 9 September, customers of Trezor, BitBox and CoinTracking received emails warning of an STM32 entropy vulnerability and asking them to take action on their hardware wallet. The emails came from those companies' real domains. SPF passed. DKIM passed. Every check your mail provider runs to prove a message came from where it claims to have come from, passed, because it genuinely had. Attackers had access to Brevo, the email marketing platform those companies send through, and created API keys inside their accounts. The weak point was never the wallet maker. It was the vendor they trusted to send their post. No wallet company will ever email you asking for your seed words, telling you to connect your device urgently, or asking you to verify your wallet. Ever.

Ungovernable

KYC: KILL YOUR CUSTOMER

A weekly news show informing you on the latest in Bitcoin, privacy and open source tech, hosted by Ungovernables, Max and Q. AOB Max: spent a full ...

KYC: kill your customer. This is where the name of the episode came from. An attacker now holds your personal information and your Bitcoin withdrawal history in the same file. They do not have to guess whether you are worth robbing, and they do not have to guess where you live. He lives down the road from me. I am going to go and get a very big wrench. None of this was a choice anybody made. The data existed because a regulator required it to be collected, from people who had no way to opt out, in the name of protecting them.

Ungovernable

KYC: KILL YOUR CUSTOMER

A weekly news show informing you on the latest in Bitcoin, privacy and open source tech, hosted by Ungovernables, Max and Q. AOB Max: spent a full ...

"So what I actually like about this application: there's no spend functionality in the wallet. You can only receive in here, and you can't spend." That is a design decision, not a missing feature. Ashigaru Desktop receives and it mixes. Spending is done on Ashigaru mobile, or you open the same wallet file in Sparrow, which reads it and the labels without complaint. Stay in your lane and there is less of you to attack. @npub16djx...khtp

Ungovernable

Ashigaru Desktop with Jordan

A weekly live show covering all things Freedom Tech with Max, Q and Seth. Thanks to Jordan for joining us to walk through Ashigaru Desktop live on ...

Max, on the Revolut leak: I guarantee you, people will die from this. Q's answer was that it sounds hyperbolic, and he is not wrong. Nobody gets a list. Revolut is not going to write to an individual customer and tell them that a file saying they own this much Bitcoin is now sitting with criminals. You cannot even warn a friend, because you have no way of knowing whether they are on it. What you get instead is people outside on the security camera with knives. Or a phone that rings every day. Or nothing at all, for years, until it is not nothing. We are treated like criminals for trying to protect ourselves and our families. We are not wrong. @MaxUM

Ungovernable

KYC: KILL YOUR CUSTOMER

A weekly news show informing you on the latest in Bitcoin, privacy and open source tech, hosted by Ungovernables, Max and Q. AOB Max: spent a full ...

Mix To is the feature more people should know about. You add a watch only wallet to Ashigaru Desktop with an xpub or an output descriptor, in this case a Passport Prime, and set a minimum number of mixes. Say five. Once a coin has been through that many, the coinjoin output goes straight to a fresh address on the hardware wallet instead of landing back in your post mix account. No manual send, no address copied by hand, no remembering to do it later. @Foundation

Ungovernable

Ashigaru Desktop with Jordan

A weekly live show covering all things Freedom Tech with Max, Q and Seth. Thanks to Jordan for joining us to walk through Ashigaru Desktop live on ...

"Anything that I've used to try and gain privacy will get flagged, will get seized, and getting it back is a fucking nightmare because you've gotta show provenance." Break the links with tools that actually work, then try to walk back into the regulated side, and you are the one proving where every coin came from. Where did you get them, proof of income, source of funds. @MaxUM

Ungovernable

Ashigaru Desktop with Jordan

A weekly live show covering all things Freedom Tech with Max, Q and Seth. Thanks to Jordan for joining us to walk through Ashigaru Desktop live on ...

The advice, after all the war stories. "You have two different ways of interacting with Bitcoin. You have proper Bitcoin that's more private, and you use that peer to peer. And then you have the whitelisted, KYC version if you're gonna interact with KYC services." "Keep these two things separate." Not because the regulation is right. Max is clear that it is not, and that it gets people kidnapped and worse. It is still the reality you have to route around. @MaxUM

Ungovernable

Ashigaru Desktop with Jordan

A weekly live show covering all things Freedom Tech with Max, Q and Seth. Thanks to Jordan for joining us to walk through Ashigaru Desktop live on ...