Serge Egelman
LightNews LightNews
banner
v0max.bsky.social
Serge Egelman
@v0max.bsky.social
1.7K followers 890 following 860 posts
Scientist. Dir. of Usable Security & Privacy at the International Computer Science Institute (icsi.berkeley.edu). Founder, AppCensus (appcensus.io). All opinions are those of his employer(s), and not his own.

https://www.guanotronic.com/~serge/
Posts Replies Media Videos
v0max.bsky.social
Someone just sent me the PDF this morning…
Article from law360 Article from law360 Article from law360
November 7, 2025 at 3:08 PM
v0max.bsky.social
At @theonion.com, they don’t miss.
Fake ad in The Onion for Adobe: “Experience the magic…of buying new software, every month, forever.”
October 30, 2025 at 11:59 PM
v0max.bsky.social
New first for me: email from a student saying how they want to do a PhD with me because they really liked my paper titled "XXX"...

...except I've never written a paper with that title. I was going to forward this jokingly to the authors ("I'm getting your email"), only to find no such paper exists.
"My proposed PhD research centers on Privacy and security, mobile computing, particularly exploring how Mobile computing can be strengthened through Usable Security Studies, Privacy Interface Design, Mobile App Auditing. I was especially drawn to your publication on ...And No One Can Hack It: The Uses and Abuses of Cybersecurity Folk Theory, which aligns closely with my current efforts in IT Security, Cybersecurity, AI-assisted threat intelligence, Core Infrastructure, and predictive defense models for enterprise environments."
October 23, 2025 at 3:15 PM
v0max.bsky.social
Discovered that my @sawstop.bsky.social works!
A photo of a small bloodless nick on my thumb, with the saw blade firmly embedded in the brake in the background.
October 1, 2025 at 6:04 PM
v0max.bsky.social
I haven’t looked, so please no one disabuse me of the notion that these are Netflix popups.
Screenshot of a website from 15-20 years ago with a Netflix popup ad.
October 1, 2025 at 1:32 AM
v0max.bsky.social
They appear to keep popping back up under different brand names. There are dozens of these under different names, while at the same time, the CPSC keeps posting new recall notices...going back years.

One even claims to be endorsed by the CPSC!
Amazon recommendations showing similar dangerously-designed "baby loungers" from different brands. Three CPSC recall notices for different brands, but the same design. Two more CPSC recall notices for different brands, but the same design. Amazon description with CPSC logo claiming the product CPSC labelled as dangerous is certified.
September 18, 2025 at 4:04 PM
v0max.bsky.social
After coming back from Scandinavia yesterday, I decided to try making shrimp skagen at home. #FoodSky
A plate with a tower of shrimp, crab, dill, and roe upon a flattened brioche sandwich (Mt. Tam and truffle honey).
September 13, 2025 at 8:18 PM
v0max.bsky.social
Sometimes you eat the bear, sometimes the bear eats you…

…last night, however, I ate the bear (braised).
A wooden cup filled with stewed bear meat.
September 7, 2025 at 11:51 AM
v0max.bsky.social
Check out this Christo knock-off…
Helsinki cathedral wrapped in material.
September 6, 2025 at 12:49 PM
v0max.bsky.social
(As I type this while sipping a Coke Zero from a cafe in Helsinki.)
A tray on a cafe table with a bottle of Coke Zero, a bottle of water, and two glasses.
September 6, 2025 at 12:01 PM
v0max.bsky.social
Second time wearing my regalia!

I’m currently in Helsinki for a thesis defense. In the Finnish system, I’m officially known as “The Opponent.”
Me in a silly hat and gown.
September 5, 2025 at 1:13 PM
v0max.bsky.social
In situ.
New walnut desk installed in my office with monitor, laptop, and knickknacks upon it.
August 28, 2025 at 12:13 AM
v0max.bsky.social
The new walnut top for my standing desk is almost ready! Just need to attach the drawer fronts today and attach it to the base!

…for those wondering what I’ve been doing instead of responding to emails over the past two weeks or so.
A handsome walnut desk top sitting in a workshop. It has three drawers and leather-bound panels on the main surface.
August 27, 2025 at 3:11 PM
v0max.bsky.social
Just got back from touching some grass!
Yosemite as seen from the top of Lembert Dome. Yours truly at the top of Lembert Dome in Yosemite. Yosemite as seen from the top of Lembert Dome. Deer in the woods.
August 7, 2025 at 8:42 PM
v0max.bsky.social
…and now with that behind me, it’s time to smoke some pastrami!
Brisket sitting on my smoker about to be turned into pastrami.
August 1, 2025 at 11:10 PM
v0max.bsky.social
After 800 games played, I’m finally back to 100% win rate based on rounding!
Wordle score showing 800 played, 100% win rate.
June 22, 2025 at 3:55 PM
v0max.bsky.social
Bath time!
Photo of the Roman baths in Bath, with the cathedral in the background.
June 13, 2025 at 12:32 PM
v0max.bsky.social
It turns out Spinal Tap had it right all along.
Me standing in front of a tiny Stonehenge.
June 12, 2025 at 11:14 AM
v0max.bsky.social
I keep referring to this font as “Saarinen Sans” because it’s straight out of Dulles or the TWA JFK terminal, but it probably has a real name…
Hotel room numbers on the wall in a font straight out of the 70s, just like the check-in counter signs at Dulles.
June 8, 2025 at 9:11 PM
v0max.bsky.social
Here's the abstract for a paper I wrote with Joel Reardon and Ken Bamberger for Yale JOLT, which will be online once the editors finish butchering it.

We call bullshit—empirically—on adtech claims of anonymity & consent. Though as we point out, this isn't really bullshit, these are sparkling lies.
While legal scholars have cited decades of computer sci-ence research that demonstrates why anonymity is hard (and that datasets should not be labelled as “anonymous” cavalier-ly), industry and legal practitioners have not heeded those warnings: many organizations trafficking in consumer data con-tinue to make assertions to customers, courts, and regulators, that their data is anonymous or “deidentified.” We acquired datasets from multiple data brokers to demonstrate empirically why these assertions are false. Using publicly-available email addresses found in data breaches posted on the Internet, we trivially reidentified 88% of the hashed email addresses that we obtained; using modern password-cracking techniques, we were able to reidentify 97% of the 6 million email addresses that we collected. Reidentifying hashed email addresses need not rely on illicit data: by constructing rainbow tables with syn-thetic data representative of typical email addresses, we reidentified a majority of the hashed email addresses. In all cases, the hashed email addresses were linked to other device-based identifiers (e.g., mobile data advertising IDs, IPs, etc.), demonstrating why device-based identifiers have long been considered personally-identifiable information. Relatedly, organizations trafficking in this data make anoth-er assertion, that this data was collected from consumers with their consent. To evaluate this claim, we performed a survey (n=369), in which we emailed a subset of the reidentified indi-viduals in our datasets to recruit them to participate. This sur-vey asked participants about their recollections of having pro-vided consent (99% had no recollection) and their feelings about the sale of their information (94% were opposed, while 77% said they planned to submit deletion requests). Overall, our study shows that hashed email addresses and device identi-fiers do not come close to meeting commonly-understood defi-nitions of “anonymous” or... ...“deidentified” data, and that any notion of “consent” must also involve a similarly-tortured definition. We argue that this in-dustry and its defenders are not simply misinformed or indif-ferent to the veracity of their statements, but that this is an ex-ample of Plato’s “noble lie”: their entire social order relies on these demonstrably untrue statements being true.
May 26, 2025 at 2:07 PM
v0max.bsky.social
That’s the Palace Hotel, not the Ritz :)
The same stained glass dome taken at the Palace Hotel in Madrid.
May 10, 2025 at 3:32 PM
v0max.bsky.social
Another flight, another credit card chargeback…
Simpsons “don’t make me tap the sign meme”: “paying for airplane WiFi is no guarantee of receiving airplane WiFi”
April 26, 2025 at 9:50 PM
v0max.bsky.social
It’s like a live action version of this:
Bors cartoon about neonazi claiming to be forced to be a neonazi due to criticism.
April 26, 2025 at 2:27 PM
v0max.bsky.social
Rob Reeder! csd.cmu.edu/sites/defaul...
Despite the need for usable policy-authoring interfaces, there is evidence that today’s widely-used policy-authoring interfaces are prone to serious errors. The “Memogate” scandal, in which staffers from one political party on the United States Senate Judiciary Committee stole the opposing party’s confidential memos from a file server that the two parties shared, was caused in part by an inexperienced system administrator’s error using the Windows NT interface for setting file permissions [132]. "
March 26, 2025 at 6:02 PM
v0max.bsky.social
New table, who dis?
Handsome eucalyptus and walnut console table in situ (in my office against a wall).
March 22, 2025 at 4:00 PM