The Privacy Company • End-to-End Encryption • Cloud Storage and Communication • Privacy by Design
127.0.0.1
Joined August 2013
- Tweets5.6K
- Following24
- Followers103K
- Likes1.6K
Pinned Tweet
Mainstream cloud storage like Google Drive and Dropbox costs around $5 to $6 per TB. Should privacy-first alternatives cost more? 💸
Privacy shouldn't come at a premium. After all, it should be the standard.
Full breakdown of secure cloud storage in 2026 here 👉blog.mega.io/best-secure-clo…
🚨 Discord is about to put messages from its public servers on Google to bring back “what made forums great.”
Here’s how it will work:
On November 16, Discord will create a public web page for every Discoverable server.
Then, from mid-December, messages from Discoverable servers can appear in web search results in the members’ own words. ON by default in most regions, btw.
Why are they doing this? Discord says forums and message boards used to host this kind of help, but many have moved into Discord servers, leaving answers “inaccessible to the wider internet.” Its fix is making that content searchable, to bring back “what made forums great.”
Anyway, here’s how to turn it off because everything is opt-in nowadays:
- Open User Settings
- Select Data & Privacy
- Turn off “Show my message content from Discoverable channels on web pages”
It only covers messages you send after you turn it off, so do it before mid-December.
Discord is about to put your public messages on Google
Discord will start making messages from Discoverable public servers searchable on Google and other search engines from mid-December.
The feature is ON by default in most regions, but you can opt out:
User Settings → Data & Privacy → turn off “Show my message content from Discoverable channels on web pages.”
In the EU, UK, Canada, Brazil, Australia and South Korea, it will be OFF by default.
Private servers, DMs and group DMs are not included. Usernames and avatars won’t appear alongside indexed messages.
WARNING: Google can now use your Gmail, Drive, and photos for ads
In familiar Google fashion, the data-collecting company quietly updated its privacy policy on 16 October, and news sites only spotted it just this weekend. If you connect these apps to its AI features, Google can use its “summaries” and “inferences” for your ads.
Google also says connected data may train its AI and be seen by human reviewers, depending on your settings.
In 2017, it promised your Gmail would never be used for ads. Nine years later, it can.
This is a glaring example of privacy by policy: a company can change what it does with your data at any time, and for its own benefit.
Let's talk about this latest update 🧵
What about Drive? The policy names it but Search can’t connect to Drive yet.
However, Google says more Workspace apps are “coming soon”. When Drive is added and you connect it, the policy already allows information from your files to be used for your ads, depending on your settings.
What can you do?
1. Google Account > Data & privacy > Personalization settings > Manage Personalized Recommendations in Search Services
2. Under Connected Content Apps, disconnect Google Workspace and Google Photos
3. In Gemini, turn off Keep Activity to stop future chats being used for AI training
4. Delete your Search Services History and Gemini Apps activity at activity.google.com
Disconnecting alone doesn’t delete what Google has already saved. Chats already sent for human review can be kept for up to three years.
Here's what changed, what’s unclear, and the full steps, with sources in our latest blog: blog.mega.io/google-gmail-ph…
Watch as @naomibrockwell details how you can move your files from Google Drive to MEGA in just a few clicks 👇
Once they land in your MEGA account, they’re end-to-end encrypted, so only you hold the keys.
Step-by-step guide here: blog.mega.io/how-to-export-f…
Google is reading your Drive.
Your photos, docs, and files are none of their business.
Good news: you can migrate your entire Google Drive to @MEGAprivacy in one click. It’s end-to-end encrypted, so your files are visible to you and no one else — not even Mega.
Couldn’t have said it better ourselves, @naomibrockwell 👇
Moving your Google Drive (or other mainstream cloud services) into MEGA takes a few clicks. No downloading and re-uploading needed and the second your files land they’re end-to-end encrypted. Full guide: blog.mega.io/how-to-export-f…
Google is spying on your drive.
Your photos, docs, & files deserve privacy.
Did you know you can move your entire Google Drive into @MEGAprivacy with a single click? It's E2EE, so only you can see your files. Even Mega can't.
youtu.be/AaXVcAeBjDk
odysee.com/@NaomiBrockwell:4…
📢 MEGA S4 is getting its biggest upgrade yet
MEGA S4 already backs up NAS, media and business archives at petabyte scale. Next, we're aiming for 100,000+ object writes per second and a billion objects, for apps, AI and big backup platforms.
Help us test what’s next: Registration for closed beta access opens soon 🙌
If you have a workload you’d love to bring to S4, this is your chance to test it out. Follow our page to stay posted. More details here
blog.mega.io/mega-s4-q4-2026…
We’ve added Dropbox, OneDrive, and Box to the MEGA migration tool! 🙌
You can now move your files from other cloud services to MEGA in a few clicks: Upload > Import from another cloud service.
With MEGA, your data stays yours, protected by end-to-end encryption by default. So you can keep your files where no service can mine them or train AI on them.
Which cloud storage service are you moving from? 👀
Full blog on how to move your files here: blog.mega.io/how-to-export-f…
Let’s talk about AdFection, because apparently in 2026 not clicking an ad doesn’t mean you’re safe from getting hacked 🙂
Citizen Lab tied zero-click attacks on at least 45 Al Jazeera devices in 2024 and 2025 to Candiru spyware delivered through ads from Discover-Tech, with high confidence. The device only had to load the ad.
Its platform reportedly let customers aim at specific advertising IDs, and ads carrying its script tags showed up in 75,373 apps and 120,768 websites. Nearly 1 in 5 of the bids Citizen Lab analysed appear to carry them.
Google and IAB Europe both listed Discover-Tech as a vendor from 2020 to 2026. The researchers say it “appears to be a front for large-scale ad espionage abuse.” Great vetting work from Google 🙄👏
If loading an ad is all it takes to get hacked, is there any safe way to scroll?
According to Citizen Lab, the script in the ad pings a Discover-Tech server, which apparently checks your IP address and advertising IDs to decide whether you get sent more code. Devices it didn’t pick stay uninfected.
Google has cut Discover-Tech off from its ad exchange platforms and IAB Europe dropped it from its registry in early October. A few other ad platforms have acted too, all after Citizen Lab published.
The lab is also asking regulators to look into whether Discover-Tech and Candiru broke the law.
Full Citizen Lab report here: citizenlab.ca/research/how-d…
It’s 2026, people. You can literally generate strong passwords in one click 🤦
A hacker says password "123456" is all it took to get into Denmark’s national register through an IT contractor’s account, reportedly exposing 8.8 million records. Politiken says at least three of the company’s accounts used it, admin included.
8.8 million records, protected like a gym locker. Nice.
If, for some reason, you also use the weakest password on earth, here's MEGA Pass. It's free mega.io/pass?mct=oct15x
📢 MEGA S4 is now compatible with GoodSync
GoodSync users can now back up and sync from Windows or Mac to MEGA S4's affordable, S3-compatible storage, with 5x free egress.
Here's how to setup MEGA S4 for GoodSync: help.mega.io/megas4/setup-gu…
One word: ads.
Dunkin’s privacy policy says the app may collect precise location and transaction history, and that Dunkin’ “sells” identifiers and transaction history to third parties, including advertising partners.
An app doesn’t need to follow you across other apps and websites to do its job, but some ask anyway.
If an app with no business tracking you asks to track you anyway, tap “Ask App Not to Track” or delete it 🤷
Why does a Discord bot hold this much data? 😳
Double Counter's own privacy policy gives the answer. It links your IP address to your Discord ID to detect alts, and cites GDPR legitimate interests as its legal basis.
Data stays for up to 24 months, and deleting yours only removes your IP while the pseudonymized links between your accounts stay.
That 24 months counts from your most recent detection or verification attempt, so each new one restarts the clock.
So, GDPR gives you the right to erasure but Double Counter's policy also gives itself a retention period that restarts every time you verify. Fun.
Double Counter’s data breach may be much bigger than initially reported, someone in contact with the hacker just sent me more info
The stolen database allegedly contained much more:
-21.7 million verified user records
IP addresses, geographic data, ISPs and Discord usernames
-44.1 million device fingerprint records
14.5 GB of device fingerprint data
-31 million server records
-19.2 million lens-counter records
-14.6 million VPN-attempt records
-831,000 Google user records
~220,000 user emails
~1.08 million Google search records
-A database around 39 GB
>The source also claims Double Counter’s GDPR deletion system did not actually remove all user data.
>According to them, the /privacy deletion command allegedly only removed a user’s current IP, while other information could remain stored, including emails, alternate accounts, their IPs and connections between main and alternate accounts.
>They also claim Double Counter staff deleted messages and banned users who questioned how much data had actually been leaked.
>The source further described an attack chain:
Metabase breach → plaintext password found → same password used on the server → SSH access → logged-in Google Cloud CLI session → access to the cloud environment → database downloaded.
They claim the attackers also obtained secrets, runtime logs and the entire Discord support ticket history.
>One ticket reportedly involved a user warning Double Counter that an ad on its verification page was malicious but the owner refused to remove it because the ad revenue was needed to pay for the servers.
