iiinova — where your digital self keeps evolving

For more details on our lab's research (reported on in @ashleybelanger.bsky.social fantastic article): bsky.app/profile/did:...

001

For context, the privacy concerns we found, as well as the compliance, and spill over effects directly contravene the logic in the recent Thomas's FSC v Paxton Supreme Court decision.

030

3. Yoti, the dominant provider in the US, collects significant private information. Data is sent to 3rd, 4th, or even 5th parties, including (in at least one case) the original site the user came from. 4. Yoti's security claims are... interesting

140

TL;DR: 1. Compliance is low: for sites that admit to age verification, roughly 15% deploy age verification in covered states 2. There's a spill-over effect: quite a few sites require verification in NY, despite there being no law there.

120

(also with the fantastic @harryoppy.bsky.social and @pearce.bsky.social) We performed the first large-scale analysis of age verification providers on the web. We scanned the top 1m sites from states with age verification laws (GA & TX) and one without (NY), and then RE'd the top provider.

130

Michael A. Specter 👻 @mikespecter.com · 03/03/2026

Excited that my grad student @shreyasminocha.me's work on Age Verification has been accepted to IEEE S&P! You can read about it in Ars Technica: arstechnica.com/tech-policy/... Preprint: mikespecter.com/assets/pdf/A...

2128

And thanks for the kind words, it means a lot!

000

Michael A. Specter 👻 @mikespecter.com · 03/03/2026

Stay tuned, this is 1/4 papers on crowdsourced location tracking that we have in various stages of completeness. BTW, happy to announce that this was accepted to Usenix Security '26.

220

Reposted by Michael A. Specter 👻

evacide @evacide.bsky.social · 02/03/2026

When we talk about the problems with Bluetooth-enabled physical trackers, we usually talk about AirTags, but let us save some rage for Tile, powered by this paper discussing Tile's privacy, security, and accountability problems: arxiv.org/abs/2510.003...

arxiv.org

Security and Privacy Analysis of Tile's Location Tracking Protocol

We conduct the first comprehensive security analysis of Tile, the second most popular crowd-sourced location-tracking service behind Apple's AirTags. We identify several exploitable vulnerabilities an...

59132

Michael A. Specter 👻 @mikespecter.com · 03/03/2026

I'm the last author on the work, thanks for the boost! Happy to answer any questions folks have. Also, don't miss Akshaya (lead author's) presentation at Real World Crypto!

120

Michael A. Specter 👻 @mikespecter.com · 22/02/2026

To the lawyers that came up with compliance training: I hope you step on a lego. Once a day, for all eternity.

111

Reposted by Michael A. Specter 👻

Linde Center for Science, Society, & Policy at Caltech @caltechlcssp.bsky.social · 29/01/2026

Watch today's episode of #ElectionScienceOfficeHours with Host @rmichaelalvarez.bsky.social - Beyond the Hype: A Research Driven Look at Claims About New Voting - with guests Georgia Tech's @mikespecter.com & Delaney Gomen - on the @caltechlcssp.bsky.social's YouTube channel: youtu.be/tbL1dlFT0NM.

052

Reposted by Michael A. Specter 👻

Michelle M. Shafer @michelleshafer.bsky.social · 23/01/2026

#ElectionGeeks: This will be a really interesting conversation on voting system usability and accessibility between @caltechlcssp.bsky.social Co-Director @rmichaelalvarez.bsky.social & Georgia Tech's @mikespecter.com, including discussion on Professor Specter's latest research.

042

Reposted by Michael A. Specter 👻

Real World Crypto Symposium @rwc.iacr.org · 19/12/2025

The accepted talks for Real World Crypto 2026 are now online: rwc.iacr.org/2026/accepte... Thanks to everyone who submitted, and we look forward to the discussions at the symposium.

rwc.iacr.org

RWC 2026 accepted papers

Real World Crypto Symposium

0239

I’m begging here: elections officials should be proactively asking for help from security researchers in calls like this. Analysis should be done, and the system should be public before announcing adoption. Doing it this way forces bad press that I don’t want to give. It’s bad for democracy.

001

In any case this system should have been published before a launch was announced. If I take a look and find vulnerabilities, will Alaska stop the deployment? Can they? Or would doing so cause too much harm and reputational risk?

110

Second, for elections, an attacker’s goal might be different than just causing a secret change in outcome Perhaps it’s stopping a certain population from voting. Or the goal may be causing chaos and weakening trust. E.g. What would happen if the system were just knocked offline on Election Day?

110

The article also quotes, unchallenged, Estonia’s election director: “can you compromise it in such a way that the monitoring you’ve got in place wouldn’t detect it” First, vulns often would not have been detectable. Whatever this system is, it’s likely got flaws. Most deployed systems do.

110

I am aware of no advances in “cloud technology” that fix inherent problems in internet voting. “Paper backups” also fail to fix much of anything—a malicious or broken into system can ignore the voter’s selections and print whatever it wants.

100

Time and again, Internet voting in practice has been shown to introduce significant vulnerabilities in elections. To my count, there have been five systems piloted in real world elections. Once researchers examined them, all have had significant flaws that would overturn the election.

100

“Security experts say that while nothing on the internet can be completely impenetrable from hacking, advances in cloud-based technology, as well as linking mobile voting to a paper backup system, could help alleviate some of the concerns” This is incorrect, and no security expert was quoted.

111

Will People Trust Voting by Phone? Alaska Is Going to Find Out.

The NYT just published an article largely hyping internet voting in Alaska. I do not agree, and argue that the article has significant problems. Let’s look at a few of them 🧵 www.nytimes.com/2025/11/13/u...

nytimes.com

174

Reposted by Michael A. Specter 👻

Signal @signal.org · 03/10/2025

We are alarmed by reports that Germany is on the verge of a catastrophic about-face, reversing its longstanding and principled opposition to the EU’s Chat Control proposal which, if passed, could spell the end of the right to privacy in Europe. signal.org/blog/pdfs/ge...

signal.org

4039252365

Michael A. Specter 👻 @mikespecter.com · 02/10/2025

“We use the UK form “factorise” here in place of the US variants “factorize” or “factor” in order to avoid the 40% tariff on the US term.”

100

Michael A. Specter 👻 @mikespecter.com · 02/10/2025

“...We refer to an abacus as “an abacus” rather than a digital computer, despite the fact that it relies on digital manipulation to effect its computations. Finally, we refer to a dog as “a dog” because even the most strenuous mental gymnastics can’t really make it sound like it’s a computer.”

100

Michael A. Specter 👻 @mikespecter.com · 02/10/2025

Probably the best troll paper of the year: “Replication of Quantum Factorisation Records with an 8-bit Home Computer, an Abacus, and a Dog” eprint.iacr.org/2025/1237.pdf

eprint.iacr.org

130

Michael A. Specter 👻 @mikespecter.com · 01/10/2025

I will never forgive these AI companies for making em-dashes impossible to use without being accused of using AI. I miss the em-dash.

120

Michael A. Specter 👻 @mikespecter.com · 30/09/2025

Hey all! This research is from my group at Georgia Tech, our paper with technical details is here: mikespecter.com/assets/pdf/t...

mikespecter.com

050

WIRED @wired.com · 29/09/2025

Here’s a link to the full paper! mikespecter.com/assets/pdf/t...

mikespecter.com

000

Reposted by Michael A. Specter 👻

A team of researchers found that, by not encrypting the data broadcast by Tile tags, users could be vulnerable to having their location information exposed to malicious actors. www.wired.com/story/tile-t...

wired.com

Tile Tracking Tags Can Be Exploited by Tech-Savvy Stalkers, Researchers Say

A team of researchers found that, by not encrypting the data broadcast by Tile tags, users could be vulnerable to having their location information exposed to malicious actors.

19830

BTW, the lead author is Akshaya Kumar, a fantastic PhD student at GT: akumar805.github.io

akumar805.github.io

Akshaya Kumar

130

Excellent article! Also, for those interested in the nerdy details, check out the paper here: bsky.app/profile/did:...

031

- Tile's servers can track all users at all times, acting as a mass surveillance network - Tile's anti-theft mode turns off stalking alerts, which is itself easily circumvented - Tile's design makes it possible for RF adversaries to stalk users Full paper: mikespecter.com/assets/pdf/t...

mikespecter.com

271