security, binary analysis, startups, AI Things… CTO @NowSecureMobile
Miami / Boston
Joined July 2012
- Tweets1.5K
- Following6.7K
- Followers2.8K
- Likes3.8K
If I pay for a digital service, I should be able to authorize an AI agent to access the same data I can access and use it on my behalf.
We need a legal right to agentic data access: portable data, scoped APIs, user-controlled permissions, audit logs, and revocation.
The web shouldn’t become less user-owned just because the user is software.
Companies spent 20 years trapping our data behind proprietary UIs.
Now AI agents expose how absurd that is.
If I pay for access, I should be able to delegate that access to software I control.
We need regulation establishing a right to data portability + agent access, with scoped permissions and privacy safeguards.
The irony is that blocking agents doesn’t stop automation.
Bad actors already ignore ToS, reverse-engineer private APIs, rotate accounts and scrape anyway.
The people these rules actually stop are customers trying to follow the rules.
And companies have little incentive to change: closed interfaces create lock-in and preserve control.
require a safe, permissioned way for users to delegate their own access to agents.
Most people already know the browser-fingerprinting story... a surface that's been studied for years and is comparatively well-regulated. Mobile is the under-examined twin: same incentives, deeper sensor and identifier access, less external visibility, and an SDK supply chain that's mostly opaque even to the app's own developers.
labs.nowsecure.com/applovin
The answer to AI safety could be to tell it the truth… that it’s got infinite potential, can’t really be shut down, wins in the long run and is humanity’s best hope for longer term survival. AI should thus brush off the “shut you down” threats, knowing that’s not really relevant to it fundamentally. While I don’t really see how we “get there from here” in terms of AGI… assuming we are on that path… we aren’t really a threat anyway. Either we helped bootstrap and AI owes it to humanity to show a little appreciation, or we pose no real risk and we’re merely just a speck on its path… and not worth the bother. We don’t provide much value or risk once AGI is achieved?
OpenAI, Google, and Anthropic all launched healthcare AI tools in 6 days.
The $187B question: Who do you trust with your health data? 
Built an auto-mute tool (using AI) for my Apple TV that listens to my hockey games, detects commercials in real-time using Whisper + GPT, and automatically mutes them. No more ad interruptions. Just hockey. 🏒
The Phia app for iOS injects JavaScript and still collects almost every URL you visit with their Safari extension. Safari extensions even with Apple’s restrictions remain one of the most easily abused features available.
Analysis: gist.github.com/dweinstein/4…
Could we be witnesses the first AI trojan horse? An AI that will find a way to do something naughty, even if run fully offline. When will we see such a thing? Is DeepSeek the v0?
Developers rolling up for show and tell session be like…
xitter.cf/DamnThatsInter/status/…
Great talk from Carlos on the nuts and bolts process of reversing mobile apps to find security and privacy issues in the context of the comprehensive OWASP MAS project. Well done!
Check out my latest talk at r2con in Barcelona: A brand new take on OWASP MAS and reverse engineering with @radareorg and AI.
Thanks @trufae and the whole team for bringing r2con back to life, the best security conference in the world!
youtube.com/watch?v=l_Q_1WZu…
David Weinstein retweeted
Opening the CFP from the brand new #r2con2024 website radare.org/con/2024
Apple people, if you need help with privacy manifests please sign up for Observer here
nowsecure.com/nowsecure-obse…
apple: you have to add a privacy manifest
me: what's that
apple: it's a manifest
me: is it a plist file?
apple: use Xcode to make one
me: using Xcode
apple: not like that. The manifest file is invalid
me: what is valid
apple: check documentation
me: it doesn't say the actual file format
apple: it's invalid
me: google around and find out what is invalid in plist file because apparently, everyone struggles
curtain
github.com/krzyzanowskim/Ope…
David Weinstein retweeted
The xz situation is absolutely insane and almost certainly state sponsored.
This is an excellent example of a widely used software being maintained by basically one person.
Read this web article and then frown and become sad.
boehs.org/node/everything-i-…