Sign in

Mysk 🇨🇦🇩🇪

@mysk.bsky.social
433 followers 106 following 252 posts

We're two #iOS developers and occasional #security researchers on two continents. #CyberSecurity 🎬 youtube.com/@mysk 📝 mysk.blog

PostsRepliesMedia
Mysk 🇨🇦🇩🇪 @mysk.bsky.social · 25/08/2026
📝 New Blog Post: Thoughts on Responsible Disclosure We recently disclosed issues in WebKit that affected Psylo and iCloud Private Relay. This has sparked some debate, so we want to explain our reasoning and share some thoughts on responsible disclosure mysk.blog/2026/08/25/r...
mysk.blog
Thoughts on Responsible Disclosure
We recently disclosed three WebKit issues that can leak a user’s DNS traffic or reveal their real IP address, even when the browser is configured to route traffic through a proxy. The issues affected ...
031
Mysk 🇨🇦🇩🇪 @mysk.bsky.social · 11/08/2026
Codes for a free monthly subscription: F4T4Y43LKEXK36YEKJ HRKREKLA7RYJRREAHN YE74AEMKLL34R6W4K8 YPX6WXTAP8YPJ8LFNL JWMHA6NYAFPJNFKA6R
020
Mysk 🇨🇦🇩🇪 @mysk.bsky.social · 05/08/2026
IP and DNS Leaks in WebKit Affecting Proxy Browsers and Apple iCloud Private Relay mysk.blog/2026/08/04/w...
mysk.blog
IP and DNS Leaks in WebKit Affecting Proxy Browsers and Apple iCloud Private Relay
WebKit-based browsers on iOS and macOS can be configured to route all web traffic through proxy servers, which is how Tor browsers on iOS and our own Psylo work. We found three WebKit features — DNS p...
0101
Reposted by Mysk 🇨🇦🇩🇪
Yael Grauer @yaelwrites.com · 26/07/2026
Super quick BADBOOL update: I added instructions for opting out of Unite4 Heritage and OpenDataUSA (which has political donations), and to remove the now-defunct Neighbor Report. github.com/yaelwrites/B...
github.com
GitHub - yaelwrites/Big-Ass-Data-Broker-Opt-Out-List
Contribute to yaelwrites/Big-Ass-Data-Broker-Opt-Out-List development by creating an account on GitHub.
11511
Mysk 🇨🇦🇩🇪 @mysk.bsky.social · 26/07/2026
Many of you have asked for a way to support the Loupe project. We want to keep Loupe free of in-app purchases, so instead we’ve created a Buy Me a Coffee page for anyone who’d like to show their appreciation. ☕ buymeacoffee.com/mysk
buymeacoffee.com
Mysk
We are an independent cybersecurity and privacy research team focused on iOS and macOS.Our work explores security and privacy topics within the Apple ecosystem — including threat research, privacy inv
020
Mysk 🇨🇦🇩🇪 @mysk.bsky.social · 26/07/2026
🚨 PSA: Uninstalling Google Chrome on macOS doesn't remove Chrome's background updater. It keeps running until you remove: ~/Library/Application Support/Google/GoogleUpdater ~/Library/LaunchAgents/com.google.GoogleUpdater.wake.plist Then, restart.
0101
Mysk 🇨🇦🇩🇪 @mysk.bsky.social · 24/07/2026
Google Chrome on macOS installs a background app called GoogleUpdater that starts automatically after a restart. Due to a macOS bug, its executable can be silently replaced with any code. No password. No warning. The user is completely unaware. Hers's a demo (clipboard spy) youtu.be/lLJkxWR71B0
youtu.be
🚨📋 macOS Security: Replacing a Background Executable to Spy on the Clipboard (Google Chrome Demo)
YouTube video by Mysk
072
Mysk 🇨🇦🇩🇪 @mysk.bsky.social · 23/07/2026
🚨 We're disclosing a macOS security bug that Apple says is not an issue. Using a simple archive-and-restore trick, an attacker can silently replace the main executable of virtually any application downloaded from the web, no password or warning is required. mysk.blog/2026/07/23/m...
mysk.blog
Silent Replacement of Trusted macOS App Executables
A vulnerability in macOS allows an attacker to silently replace the main executable of any application downloaded from the web without requiring elevated privileges. As a result, trusted applications ...
152
Mysk 🇨🇦🇩🇪 @mysk.bsky.social · 09/07/2026
Apparently Apple has fixed the clipboard counter in iOS 27 beta 3 thanks to Loupe. ✌️ Now the counter resets after a restart. Hey Apple, a little shoutout to the Loupe project would have been nice! Loupe is free and open source. You can download Loupe here: apps.apple.com/us/app/loupe...
061
Mysk 🇨🇦🇩🇪 @mysk.bsky.social · 03/07/2026
For new users who need more time to explore Psylo unique privacy features, use this code to get a free monthly subscription: HAPPYFRIDAY27 Or use this link 👇️ apps.apple.com/redeem?ctx=o... The code is valid through the weekend
apps.apple.com
040
Mysk 🇨🇦🇩🇪 @mysk.bsky.social · 12/06/2026
Privacy tip: If you hide an app on iOS, other apps cannot detect it and won't know if you have it installed. This is confirmed by Loupe and you can test it✌️
160
Mysk 🇨🇦🇩🇪 @mysk.bsky.social · 12/06/2026
Loupe 1.0.1 is out! We added Polish, Italian, Korean, and Vietnamese localisation, along with fixes to existing localisation such as Arabic
040
Reposted by Mysk 🇨🇦🇩🇪
Ian Campbell @neurovagrant.bsky.social · 10/06/2026
oh how did i miss this? excited to jump into it, mysk gives us the best iOS toys.
043
Mysk 🇨🇦🇩🇪 @mysk.bsky.social · 09/06/2026
Thanks a million for everyone who shared, downloaded, or rated Loupe. We have great plans for Loupe in the future. This huge reception is very encouraging. Privacy shall prevail. Thank you 🙏
010
Reposted by Mysk 🇨🇦🇩🇪
Thomas @biblio.bsky.social · 09/06/2026
@mysk.bsky.social a développé Loupe, une espèce d'ExodusPrivacy pour iOS. L'appli permet de détecter les informations collectées par les applis installées sur un iPhone. www.it-connect.fr/vie-privee-l...
it-connect.fr
Vie privée : l'appli open source Loupe révèle le fingerprinting sur iPhone
Loupe, l'application gratuite et open source pour iOS et iPadOS, révèle comment les apps tierces créent une empreinte numérique unique grâce aux API publiques.
011
Reposted by Mysk 🇨🇦🇩🇪
Noah 🚎 @noahsbwilliams.com · 08/06/2026
Mysk has done the public a profound service by releasing this app for free. I was astonished at the accuracy of the profile it provided. Great way to get a sense of your iOS device's personal data exposure!
062
Mysk 🇨🇦🇩🇪 @mysk.bsky.social · 08/06/2026
Happy to report that iOS 27 preserves your clipboard paste count 🙌
040
Reposted by Mysk 🇨🇦🇩🇪
Pelle Wessman @voxpelli.com · 08/06/2026
Very well done and scarily eye opening!
122
Mysk 🇨🇦🇩🇪 @mysk.bsky.social · 08/06/2026
If Loupe can see it, any app can see it.
010
Reposted by Mysk 🇨🇦🇩🇪
Lucas ✦ @lucas.love · 06/06/2026
Today is about Loupe by @mysk.bsky.social and a surprising fingerprinting identifier that's used against you.
211
Mysk 🇨🇦🇩🇪 @mysk.bsky.social · 06/06/2026
Loupe is now the #1 downloaded app in the Developer Tools category of the German App Store 🎉
130
Reposted by Mysk 🇨🇦🇩🇪
Threema @threema.ch · 06/06/2026
Even without you giving them any permissions, mobile apps can learn a whole lot about (and potentially identify) you. 👤📲
02710
Mysk 🇨🇦🇩🇪 @mysk.bsky.social · 06/06/2026
Introducing Loupe, our latest privacy app for iOS. Discover what apps can learn about you just by reading data your iPhone already exposes, such as your languages, installed apps, device sensors, and much much more. Loupe is free, private, and open source. Try it👇 apps.apple.com/app/id676615...
2288
Mysk 🇨🇦🇩🇪 @mysk.bsky.social · 28/01/2026
The Privacy Labels for the new apps in the Creator Studio bundle indicate they collect significantly more data than their one-time purchase versions. For instance, look at Final Cut Pro: #privacy #Apple
040
Mysk 🇨🇦🇩🇪 @mysk.bsky.social · 29/11/2025
Black Friday Sale! Download Psylo and enter the code BLACKFRIDAY25 to grab your annual subscription for only $29.99, that's 50% off the regular price of $69.99! Existing customers can take advantage of this offer too. 🎊 Valid until Monday! apps.apple.com/redeem?ctx=o... #Privacy
000
Mysk 🇨🇦🇩🇪 @mysk.bsky.social · 28/11/2025
Black Friday Sale! Download Psylo and enter the code BLACKFRIDAY25 to grab your annual subscription for only $29.99, that's 50% off the regular price of $69.99! Existing customers can take advantage of this offer too. 🎊 Valid until Monday! apps.apple.com/redeem?ctx=o... #Privacy
001
Mysk 🇨🇦🇩🇪 @mysk.bsky.social · 13/11/2025
Oh, 1Password stores user profile pictures on their servers without authentication. Anyone who has the long URL, which also contains the account identifier, can access the picture. It's not a big deal, but a password manager should definitely be more careful. #privacy
120
Mysk 🇨🇦🇩🇪 @mysk.bsky.social · 03/11/2025
Great news. Apple collects exhaustive analytics when you view apps in the App Store app. The detailed analytics is linked to your identity and there is no way to turn the massive data collection off. Now iPhone users can view apps anonymously in a browser www.macrumors.com/2025/11/03/a...
macrumors.com
Apple Launches App Store for the Web
Apple launched a new App Store on the web today, allowing users to browse through and search for apps across all of its platforms. The updated...
100
Mysk 🇨🇦🇩🇪 @mysk.bsky.social · 12/10/2025
Holy smoke 🤯 This bug has led us to gain access to any app's Keychain entries on macOS. 🤯🤯🤯🤯🤯🤯 Still, no time to report it to Apple yet
220
Mysk 🇨🇦🇩🇪 @mysk.bsky.social · 03/10/2025
Is it just me, or does the Mail app on iOS 26 in the year 2025 A.D. does not have the option to set the “Reply To” field in an email?
020
Mysk 🇨🇦🇩🇪 @mysk.bsky.social · 01/10/2025
Psylo 1.0.6 with Liquid Glass is out now!
000
Mysk 🇨🇦🇩🇪 @mysk.bsky.social · 28/09/2025
🏜️🎁 We accidentally found a security flaw in macOS Tahoe and earlier An attacker can trick a user into performing a simple yet common action that breaks the sandbox protection of any file (e.g iMessage database and Safari browsing data) giving any application permanent access to the target file
150
Mysk 🇨🇦🇩🇪 @mysk.bsky.social · 24/09/2025
The first hit from Wikipedia has the correct answer, but Gemini's wrong answer has to be shown first and occupy most of the screen because AI is cool
screenshot of searching for the term "latest macos" in Google. Gemini generative result is shown first occupying most of the screen. Gemini says it is Version 15 whereas the first hit from Wikipedia is shown far away. It holds the correct answer: Version 26
020
Mysk 🇨🇦🇩🇪 @mysk.bsky.social · 22/09/2025
🚨 iMessages in iOS 26 leaks the sender's keyboard language when sending reactions to devices with iOS 17 or older, and Android phones via RCS! 😱 #privacy #Apple #iOS26
000
Mysk 🇨🇦🇩🇪 @mysk.bsky.social · 17/09/2025
Why do all browsers in iOS 26 communicate with this Google service? Has Apple changed how safe websites are downloaded? Psylo tunnels all connections via our proxy servers to prevent IP leaks. How are these calls made? Does Google see the real IP? #Privacy #Apple #iOS26
120
Mysk 🇨🇦🇩🇪 @mysk.bsky.social · 15/09/2025
iOS 26, about 15 hours remaining 🐌
010
Mysk 🇨🇦🇩🇪 @mysk.bsky.social · 14/09/2025
This happens when the #security team doesn't sync with the #UI team. 😅 The code that Instagram sent was alphabetical, but the UI in the app showed a numpad and only allowed numeric input.
030
Mysk 🇨🇦🇩🇪 @mysk.bsky.social · 11/09/2025
Live Translation with AirPods is not going to be available in the EU. This means that it doesn't use on-device AI model and the microphones forward everything to remote servers 🤯 #Apple #privacy
Apple Intelligence: Live Translation with AirPods
Live Translation with AirPods is not available if you are in the EU and your Apple Account Country or
Region is also in the EU
English (United Kingdom)
English (United States)
French (France) - not available in the EU
German (Germany) - not available in the EU
Portuguese (Brazil)
Spanish (Spain) - not available in the EU
110
Reposted by Mysk 🇨🇦🇩🇪
Psylo: Privacy Browser & Proxy @psylo.app · 10/09/2025
Ready for iOS 26 with Liquid Glass? Doing our best to be ready for next week September 15 Here’s a sneak peek at our current progress 💦🔎 #iOS26 #LiquidGlass
011
Mysk 🇨🇦🇩🇪 @mysk.bsky.social · 10/09/2025
As Psylo is the only #iOS browser that opens App Store links anonymously in the web, the review link below will open in the web view. Copy the link and paste it in another browser. It should take you to the App Store to rate Psylo 🙏
000
Reposted by Mysk 🇨🇦🇩🇪
Psylo: Privacy Browser & Proxy @psylo.app · 10/09/2025
🚨Psylo is impacted by Proton VPN technical difficulties. We have disabled Proton VPN in the Mysk Private Proxy Network at the moment. Psylo proxies can work without Proton VPN exit nodes. status.proton.me
status.proton.me
Proton Services Status
Welcome to Proton Services's home for real-time and historical data on system performance.
101
Reposted by Mysk 🇨🇦🇩🇪
Zack Whittaker @zackwhittaker.com · 09/09/2025
I asked Plex a bunch of questions about its data breach of user account information, but the company wouldn't say why it hasn't force-reset its users' passwords and is instead asking users to do it. The company also hasn't explained how (and to what extent) it scrambled those passwords.
techcrunch.com
Plex urges users to change passwords after data breach | TechCrunch
Plex said that it was aware of a security incident involving the theft of Plex customer account information, including user names, email addresses, scrambled passwords, and unspecified authentication ...
073
Reposted by Mysk 🇨🇦🇩🇪
Psylo: Privacy Browser & Proxy @psylo.app · 09/09/2025
No thanks, I won’t get the app. Native apps can track and fingerprint you more easily. Use the web version in a privacy-protecting browser that obfuscates common fingerprinting markers, and completely isolates it from other websites. If only there was such a browser… 🤔
031
Reposted by Mysk 🇨🇦🇩🇪
Psylo: Privacy Browser & Proxy @psylo.app · 09/09/2025
iPhone 17 Pro’s website doesn’t have the option to compare against iPhone 16 So they’re not catering to people who upgrade their iPhone every year 😬
131
Reposted by Mysk 🇨🇦🇩🇪
Psylo: Privacy Browser & Proxy @psylo.app · 09/09/2025
Psylo is the only browser or app that lets you open websites from different countries at the same time without having to switch connections. #privacy
031
Mysk 🇨🇦🇩🇪 @mysk.bsky.social · 09/09/2025
What a productive day! I accidentally time-traveled to the year 2076, created an Excel sheet, and returned. But that's not the puzzling part. I still can't believe that an Excel file can be so backward compatible.
Screenshot of MS Excel

Document Recovery
Excel has recovered the following files.
Version created last time the user saved the file
29/11/2076 10:54
010
Mysk 🇨🇦🇩🇪 @mysk.bsky.social · 09/09/2025
Nothing new. Facebook is begging for pics on Threads to train their AI model on.
facebook on Threads:
Here's to profile pics of years past - some classic, some cringe, 100% you.
000
Reposted by Mysk 🇨🇦🇩🇪
Psylo: Privacy Browser & Proxy @psylo.app · 08/09/2025
Psylo network doesn't have obfuscated servers, making it easy to block. To overcome this, use Psylo with a VPN that offers obfuscation, such as Proton or Mullvad. This allows you to connect to Psylo's proxy servers through the VPN, making silos work as expected. #privacy
Screenshot of adding a new silo in Psylo. The proxy country is set to the US
021
Mysk 🇨🇦🇩🇪 @mysk.bsky.social · 08/09/2025
Follow this account for detailed content about our private browser Psylo: @psylo.app
010
Mysk 🇨🇦🇩🇪 @mysk.bsky.social · 06/09/2025
Psylo beats Safari's Advanced Fingerprinting Protecting that is going to launch in iOS and iPadOS 26. Safari setup: - iCloud Private Relay is on - Private Browsing is on Psylo setup: - Ephemeral option is on Watch Safari vs Psylo: #privacy #cybersecurity #tracking #iOS26
130