wendythehacker

Cline seems to be having some security vulnerabilities that aren't addressed, e.g. https://embracethered.com/blog/posts/2025/cline-vulnerable-t...

Begs the question of long-term support, etc...

This blog post explains it in detail, including the POC prompt injection hosted on the website: https://embracethered.com/blog/posts/2024/chatgpt-macos-app-...

Note that such a payload can come from anywhere, like a pdf document the user analyzes, an image, a spreadsheet, etc...

Interestingly, I had the exact same reaction when trying to figure out how to enable/disable WiFi. Why Apple, why? I wonder what telemetry tells them about this icon - wouldn't it be one of the most used ones? Or is there maybe an incentive for Apple to make sure users have WiFi on that I don't understand.

my bank used 2FA (auth codes or so called "transaction codes" send in physical mail to approve transactions) in the late 90s early 2000s. so 2fa isn't some new invention, funny how it took basically 2.5 decades until it become quite mainstream... now that i think of it, it's actually quite concerning that 2fa didn't have widespread adoption earlier - as soon as smart phones became common.

It seems there are a lot of opportunities for privacy testing here....

-) Is is possible to re-identify webpages a user visits based on Cohort ID?

-) E.g. can a website be built to show your "profile" and "interests" based on the Cohort, rather than just the FLoC ID? Google and others who (I assume) will share their back-end data will be able to build such a website.

-) Can a "rainbow table of FLoCs" be pre-calcuated? This would allow to re-identify certain browsing habits of users

-) In fact what if someone creates a Chrome extension that publishes visited domain names and their resulting FLoC ID - Imagine many people download and use it for fun! This would sort of decentralize the previous mentioned de-identification attacks and render FLoC useless for all other privacy concerned users.

-) How much easier is it now to track a user with just IP address + FLoC ID now?

BUT, what I'm missing entirely at this point is how will the web server (Google and other ad companies) actually *use/share* the Cohort information? That is not being described at all by Google - and seems rather critical to me.

More details and testing ideas in this article: https://embracethered.com/blog/posts/2021/red-teaming-floc-c...

What's even worse is that ML frameworks (also newer ones) don't have or support built in authenticity/integrity checking when loading model and model architecture. Developers have to build their own solutions, like checking a hash or signature themselves - very few do.

This threat model of an ML system is quite interesting also, it highlights the various security challenges a typical ML system faces: https://embracethered.com/blog/posts/2020/husky-ai-threat-mo...